v1.13.11.9 rc0 #202
skrashevich
announced in
Announcements
v1.13.11.9 rc0
#202
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Highlights of v1.13.11.9:
This release brings in much-needed flexibility for deployment configurations with the introduction of environment variables to set the server host and port. It also simplifies the integration between the API and frontend configurations, ensuring aligned service endpoints. The new
expire_afterMQTT configuration option enhances the control users have over the expiration time for MQTT messages.Under the hood, the Dockerfiles have been updated for the frontend-builder, and key dependencies have been updated to their latest versions, ensuring a smooth and efficient development experience.
In terms of improvements, unnecessary code has been pruned for clarity, and the app's styles have received refinements for a better user interface.
Please refer to the changelog for a complete list of changes and updates included in this version. We value the feedback from our users and the community, and we continue to strive for excellence in each release. Thank you for your continued support.
This release includes several bug fixes, a major refactor, and dependency updates.
Added
expire_afterfor customizing the timeout for "recognized" state in Home Assistant. (PR [FEAT] Decrease time of recognised state - MQTT #181)DOUBLETAKE_HOST) and port (DOUBLETAKE_PORT) to allow for more flexible deployment scenarios. (Patch 26/38)Changed
oven/bun:1.0.15and useapt-getfor package installations. (Patch 29/38)18.19-bookwormand installednpm@^10.2.4withfetch-retriesset to20. (Patch 30/38)ace-builds,ace-code,@vitejs/plugin-vue,@vue/eslint-config-airbnb,@vue/eslint-config-prettier,eslint, andeslint-plugin-vue. (Patch 24/38)viteto5.0.5in the frontend. (Patch 31/38)README.md. (Patch 33/38)/.storage..github/workflows/playwright.ymlto useactions/checkout@v4andactions/setup-node@v4.entrypoint.shscript improvements for better directory handling.Fixed
recognize.util.js. (Patch 13/38)entrypoint.shscript to remove unnecessary double quotes around path variables. (Patch 34/38)Toolbar.vuestyles to remove unnecessary CSS rules and improve readability. (Patch 36/38)recognize.util.jsby removing the unusedfsmodule import. (Patch 35/38)Security
The changes in
storage.controller.jsfile reflect a security enhancement in the handling of filenames. The code modification takes place in thematchesmethod of a controller that likely manages file retrieval.Previously, the server was directly using the
filenameparameter from the request parameters inreq.params. However, user-supplied filenames can be dangerous because they may contain special characters or sequences that could lead to file path traversal attacks, where an attacker attempts to access files and directories stored outside the intended directory structure.The updated code now sanitizes the
filenameby calling thesanitizefunction, which presumably removes or escapes potentially dangerous characters in the filename. The sanitized filename is then used to construct the file's path and check its existence on the server.Security Implication
The addition of filename sanitation ensures that any attempt by an attacker to manipulate the file path is mitigated. The
sanitize-filename-truncatelibrary likely removes or encodes characters that could lead to vulnerabilities such as directory traversal, allowing file operations to be performed safely on the server.Summary of the Security Fix
In summary, this security fix mitigates a potential vulnerability by ensuring that user input (in this case, a filename) is properly sanitized before being used in file system operations. This helps protect the server from attacks that could exploit unsanitized input to gain unauthorized access to the file system.
Deprecated
Removed
Commits
New Contributors
Full Changelog: v1.13.11.8...v1.13.11.9rc0
This discussion was created from the release v1.13.11.9 rc0.
Beta Was this translation helpful? Give feedback.
All reactions