Updated endpoint image querying to generally follow the same logic to
ensure filtering on just the expected types which are intended to be
managed by this endpoint, and it err on the side of caution in terms of
access control.
Updated exception handler to reduce the amount of detail shown to
prevent potentially sensitive details (like internal paths) being shown
in the error message.
Added an interface for specifically marking exceptions whos messages we
may want to show.
Thanks to Tanner Marks for reporting.
- Added more complex srcset parsing and URI handling via custom built
HTMLPurifier filter, which I've also provided upstream.
- Added a custom URI filter to force require URI schemes.
- Adds a dummy hash attempt to balance the time of unknown user login
attempt with known user login attempt to help prevent timing being
used to indicate existing accounts.
- Adds some random variance to failed login attempts to help prevent
timing based information discovery.
Thanks to Tanner Marks for their responsible disclosure of this.
Thanks to Ashutosh Jena(MAVERICK-VF142) for reporting.
Not considered a significant security issue since it already required
page update permissions, which would generally be considered higher
privileged than the added page view.
Role permission checkboxes (shelves, books, chapters, pages, revisions,
images, attachments) used short labels like 'Own' and 'All' for their
aria-labels. Screen readers would announce these without any context
about what resource or action the permission applies to.
Added 'role_permission_aria' translation key with the pattern
':action :resource: :value' and updated all permission row templates
to use trans() with parameters. This gives translators full control
over word order and separators while providing screen readers with
descriptive labels like 'Create books: All'.
The custom checkbox components (custom-checkbox.blade.php and
toggle-switch.blade.php) use a <span role="checkbox"> as the
visual/interactive element while hiding the native <input type="checkbox">
with display:none. The span had no accessible name, so screen readers
would announce "checkbox" without any label context.
Added aria-label to the role="checkbox" span in both templates.
Also added optional parameter to custom-checkbox that
falls back to when not provided, allowing callers to supply
a more descriptive accessible name.
Uses the shared date formatter for audit log activity dates so APP_DISPLAY_TIMEZONE is respected while APP_TIMEZONE can remain UTC for storage.
Related to issue #4786 and PR #5790, which introduced APP_DISPLAY_TIMEZONE and updated most in-app absolute date displays but left the audit log table rendering the raw created_at value.
Added a central URLFilter class to check & clean URLs used for
attachments, which is also used for validation, and by the purifier to
standardise protocols (and to make protocol config easier in future).
Thanks to mfk25 for reporting.
Upstream libraries used did not specifically treat values in srcset as
URIs like other attributes, so this adds a simple filter for possible
bad values.
Updated tests to cover.
Thanks for Gurmandeep Deol for reporting.
- Fixed issues picked up by PHPStan updates.
- Not sure why it was flagging the BookSorter issue, but swapping if
statements made it go away.
- Updated BookSortMapItem with modern syntax.
- Attempted to fix CI issues by adding DOM extension.
- Attempted to make migration CI more efficient via tmpfs
This is to reduce the amount of content which will be logged, since
these messages don't really indicate an actual system error but advise
the user of something which went wrong with their request.
Avoids providing responses with potential sensitive attachment info
before permission checks.
Added tests to cover.
Thanks to Rafael Castilho for reporting.
Updated allow list/purifier system to only allow file protocol use on
anchor hrefs to avoid potential security concerns with, after export,
content being auto loaded via interactive elements like
embeds/objects/videos etc...
Updated tests to cover.
Thanks to Gurmandeep Deol at Seneca Polytechnic for reporting.
## Details
<!-- Write details of your pull request in here -->
<!-- Include references to any relevant issues/discussions -->
## Checklist
<!-- Put an 'x' in between the brackets below to confirm these elements -->
- [ ] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/).
- [ ] This PR does not feature significant use of LLM/AI generation as per the community rules above.
Co-authored-by: Crowdin Bot <[email protected]>
Reviewed-on: https://codeberg.org/bookstack/bookstack/pulls/6139
- Removed unused import
- Added some trailing newlines to code files
- Prevented <hr>s confusing logic in MD editor
- Aligned logic to select end of header across editors
Dan Brown