v1.7.2-rc-1 #1646

nielsdrost7 · 2026-07-30T19:46:34Z

nielsdrost7
Jul 30, 2026
Maintainer

InvoicePlane v1.7.2 RC 1

Hash Format	Hash
MD5	398d355d1bdfc5ca040386af781d6d8e
SHA-256	9ab69432acb07a9802d351fcfffc0bf061d5bb3e022d662bd63fa2006d5d6eaf

Many thanks to @drewangell, @Jannomag, @mpldr, and @PatrickGTR for their contributions to this release.

Huge thanks to @0raN9ewww, @5ud0er, @akgul7990, @alanturing881, @ali-iltizar, @capt-bl4ck0ut, @chakrapani150, @Char0n1507, @Chittu13, @cyabell, @de3erve-hunter, @EvidentObscurity, @FelipeSilvany, @FORIMOC, @geo-chen, @HuajiHD, @iiihaiii, @kitu232, @lighthousekeeper1212, @mattmumford-git, @PLpaPLpa, @QiaoNPC, @radoi-teodor, @tikket1, @tonghuaroot, @udaypali, @venkatesh2003631, and @Vijay-raghav7 for responsibly disclosing these vulnerabilities. Without you, this release wouldn't have been possible.

New Contributors

@Jannomag made their first contribution in Implement recipient determination logic in QrCode.php #1548

Improvements / Changes

Security & Stability

Full details — severity, CVSS, and GHSA advisories — are tracked in the Security Vulnerability Summary in .github/CHANGELOG.md.

#1505 Remote code execution via the writable templates directory closed by replacing dynamic filesystem template discovery with a static allowlist and ipconfig.php-based configuration; also closes five related open-redirect instances (GHSA-v735-2x3r-gwpp)
#1514 Password-reset tokens now expire, closing a broken-authentication window that previously allowed indefinite reuse (GHSA-5r28-6rw3-25c2)
#1512 Arbitrary file deletion via path traversal in the invoice-logo setting closed with path-traversal guards, symlink protection, and attachment-name XSS prevention (also completed in Fix file path traversal vulnerabilities across codebase #1510) (GHSA-65v2-4g37-rxjw, GHSA-45vj-9p52-f8mq)
#1494 Password-reset tokens now use a cryptographically secure random_bytes(32) generator instead of a predictable md5(time()) seed (GHSA-jfgr-778p-m943)
#1479 SQL/DDL injection via the tax-rate decimal-places setting hardened with transaction-wrapped validation and unit tests (also completed in Harden tax rate decimal setting against DDL injection #1488) (GHSA-x6rh-cr7q-5w7j, GHSA-34g5-4hfc-g983)
#1513 Configuration injection in the database setup wizard blocked by rejecting newline characters in db_hostname and related fields (GHSA-ffq5-mw9f-mv6j)
#1471 Guest quote approve/reject and payment-gateway callbacks now enforce client scoping and require POST, closing a horizontal-privilege-escalation IDOR and a GET-based CSRF-equivalent vector reachable through email link prefetching (also completed in Fix IDOR, CSRF, and SQL injection vulnerabilities in guest controllers #1482, Fix CSRF and authorization vulnerabilities in guest quote and payment gateways #1487) (GHSA-pjf5-c2m5-7m4x, GHSA-6xj3-274m-4mvg, GHSA-7r3g-fppx-2p79)
#1517 Guest invoice/payment endpoints gained a guest_visible() filter, closing an access-control bypass that exposed non-public invoices (also completed in Fix authorization bypass in guest payment endpoints allowing access to draft invoices #1537) (GHSA-f95x-25mh-wcxv)
#1491 Setup wizard locked after install (SETUP_COMPLETED), with an admin security-warning system, closing unauthenticated re-entry into the installer (also completed in fix: block setup wizard access when SETUP_COMPLETED=true #1511, Automatically disable setup wizard and add security warning system with internationalization #1518) (GHSA-37pr-q48j-46gg, GHSA-2j6j-6f6q-57vq, GHSA-jx5h-6r8f-m2h3)
#1622 CSRF via GET-based logo removal closed by converting the settings logo-removal links to POST forms with CSRF-token validation (GHSA-qx8h-35wf-cgqf)
#1559 Missing CSRF protection on invoice delete()/delete_invoice_tax() closed by requiring POST and a valid CSRF token (also completed in Centralize POST/CSRF validation in Admin_Controller and apply to Quotes/Invoices #1561, fix: Security Fixes #1624) (GHSA-mhvh-4j3w-7pvj)
#1555 Authentication bypass via MD5 magic-hash type juggling hardened on the legacy auth path (GHSA-x66r-7wf6-wgv7)
#1621 Deactivated user accounts can no longer authenticate (GHSA-jw57-6692-jh2q)
#1620 Sensitive SUMEX invoice XML disclosure closed by writing to a non-web-accessible storage/temp/ directory (GHSA-583r-4pw9-6rc9)
#1623 Sensitive import CSV disclosure closed by denying direct web access to uploads/import/ (GHSA-wv2c-c285-9hrq)
#1626 Authorization bypass through a user-controlled key (IDOR) closed with can_user_access() / can_user_manage() object-level checks for clients, projects, invoices, and quotes (GHSA-h4xh-4jwc-485r)
#1545 Guest attachment access bypass closed — the guest Get controller now enforces the same guest-visible status check as the guest View controller (GHSA-phh5-3jc3-pm6w)
#1556 Sensitive financial data exposure via unauthenticated public invoice closed — the guest View controller now extends Guest_Controller and enforces client-ownership scoping (GHSA-9hx6-6h6f-2wq3)
#1573 Authenticated and second-order SQL injection via the custom_field_table identifier closed with a server-side allowlist and defense-in-depth sink guards (also completed in Harden custom_field_table against SQL injection (CWE-89) #1632) (GHSA-98vm-2r9v-mpgj, GHSA-vv4r-cgmw-w6x2)
#1630 SQL injection in the user/client name-search Ajax endpoint closed by replacing string-concatenated LIKE clauses with parameterized query-builder calls (GHSA-g7f2-mj3r-xx88)
#1615 Arbitrary local file read via mPDF file:// in the Sales-by-Year report closed (GHSA-j89p-m59x-86r9)
#1547 Local file inclusion via the SUMEX PDF template parameter closed by validating the template name in Sumex::pdf() and the guest SUMEX PDF actions before rendering (GHSA-wj6q-j965-2w2v)
#1616 Unauthenticated PayPal capture payment forgery closed by validating currency and amount against the invoice (GHSA-35qh-94hc-hm2w)
#1492 SSRF via admin-stored PDF footer content closed by sanitizing content before mPDF rendering (GHSA-vgq9-469p-q7j3)
#1515 Stripe/PayPal API credential exposure via HTML source closed (GHSA-8543-x4j8-jj4q)
#1574 Stored XSS via CSV import (payment method name) closed (GHSA-vm87-2qmm-rhg8)
#1516 Stored XSS in the Online Payment settings page (Stripe API key / PayPal client secret fields) closed with proper output escaping (GHSA-xvrc-hv8j-8v8w)
#1557 Invoice PDF passwords encrypted at rest instead of stored in plaintext (GHSA-vphv-wmr3-68fp)
#1496 Duplicate payment processing (Stripe callback replay) closed with a unique payment_external_id index (GHSA-6cpc-hr8h-xgr2)
#1486 Email-template preview XSS closed by rendering previews as sanitized/plain text instead of raw HTML (also completed in Fix Stored XSS Vulnerabilities with Comprehensive Application-Wide Protection #1500, Comprehensive XSS fixes across InvoicePlane (30+ vulnerabilities) #1516, Fix email template preview rendering raw HTML instead of rendered content #1499) (GHSA-4wqv-84px-8jc6)
#1635 Stored XSS via unescaped client_email in invoice/quote mailer views closed (GHSA-477r-xmgc-vcvj)
#1583 Non-constant-time cron_key comparison in the recurring-invoice cron endpoint fixed (GHSA-jg68-6mqc-hxcr)
#1507 Optional EXIF metadata stripping from uploads added (SEC_STRIP_EXIF_FROM_IMAGES, off by default) (GHSA-7j67-2v6p-275v)
#1495 PHPMailer SMTP debug output no longer leaks into AJAX responses (internal audit finding)
#1567 Session & infrastructure hardening: cookie_httponly=true, default X-Frame-Options: SAMEORIGIN, session-fixation fix, password-reset log-injection sanitization, and a Referrer-Policy header (internal audit findings)
#1640 Authentication checkpoint hardened with strict comparison for the user_type/required_key session check (GHSA-346c-gqqq-mrm2, by @Char0n1507)
#1639 Log injection via unsanitized cron_key in Cron::recur() fixed (GHSA-g53q-v2pv-xr83, by @Char0n1507)
#1638 IDOR closed: the primary administrator's password can no longer be changed by another admin (GHSA-x38q-xhjj-jr8w, by @Char0n1507)
#1637 CSRF token validation added to seven delete-style endpoints that relied only on a URL-substring check (GHSA-9372-vj68-hmc3, by @Char0n1507)
#1636 CSRF bypass in Recurring::stop() via GET request closed (GHSA-qf9q-2hxm-4wh9, by @Char0n1507)
#1536 Review follow-ups: entrypoint.sh config-injection guard, XSS trait ordering fix, logo URL escaping, custom-template allowlisting, Mdl_reports cast fix
#1558 Quote PDF passwords encrypted at rest
#1560 Local file inclusion via the invoice XML-config identifier closed with strict allowlist validation before the config file is included (GHSA-9248-qccw-7x7j)
#1589 Session ID regenerated on login to prevent session fixation
#1604 csrf_meta/csrf_token_value refreshed on every XHR request (by @sudwebdesign)
#1605 CSRF_REGENERATE option added to ipconfig (by @sudwebdesign)

Other improvements

#1288 Re-introduced Stripe & PayPal, adding PayPal Advanced Credit Cards and Venmo support (by @drewangell)
#1376 QR-code size on invoices is now configurable
#1466 Move the setup-php-composer composite action into .github/actions/
#1483 Batch settings save: reduce DB queries from ~70 to 3 (transaction-wrapped)
#1490 Add a Laravel Pint code-style check
#1503 Add database indexes on frequently queried columns
#1509 Add the Docker application container (combined web server + PHP) (by @mpldr)
#1529 Document the arbitrary file-deletion vulnerability for CVE allocation
#1538 Add v1.7.2 PR/issue/security-advisory release table and security-improvements doc
#1548 Implement recipient determination logic in QrCode.php (by @Jannomag)
#1552 Remove orphaned docblock left after deduplication of Settings::remove_logo()
#1572 Client birthdate field support
#1603 Reorganize security documentation and update release notes for v1.7.2
#1607 fullpage-loader: move loader-error.svg into loader-error-message (by @sudwebdesign)
#1618 Setup now fails loudly when a migration SQL file cannot be read
#1627 Add php -l pre-push requirement to CLAUDE.md
#1629 GitHub Action release build automation
#1140 Remittance slip / QR-code remittance text
#1449 quote_templates/public showing the client on both header and footer
#1451 QR-code generation for batch invoice processing
#1465 Simplify redundant conditionals in email template tags
#1180 Undefined-array-key error for mPDF footer names on PHP 8.3+
#1478 Add the missing attachment() method to the guest Get controller
#1575 Fix MariaDB 1066 duplicate join on guest Payments page
#1576 Fix 7 pre-beta bugs found in security-hardening review
#1617 Harden migration SQL runner against semicolons in strings/comments
#1628 Misc fixes

Full Changelog: v1.7.1...v1.7.2-rc-1

This discussion was created from the release v1.7.2-rc-1.

Navigation Menu

InvoicePlane

v1.7.2-rc-1 #1646

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

InvoicePlane

v1.7.2-rc-1 #1646

Uh oh!

nielsdrost7 Jul 30, 2026 Maintainer

InvoicePlane v1.7.2 RC 1

New Contributors

Improvements / Changes

Security & Stability

Other improvements

Replies: 0 comments

nielsdrost7
Jul 30, 2026
Maintainer