emoncms

• update version
• changes for consistency with emoncms.org
• security: fix shell injection, session corruption and unescaped args in admin module
• centralise exec & passthru calls
• extract out exec and passthru for ease of reference
• extract out exec calls for easy reference
• refactor: get_rpi_info
• security: harden file upload, redis version check, and service execution
• security: fix command injection risks in admin module
• DiD: prepared statement in schedule create
• DiD: casting and prepared statements for process list mysql timeseries engine methods
• DiD: use prepared statement
• defence in depth casts
• minor fix
• breakout admin user functionality to AdminUserModel class
• remove email from email verification link, there is enough security in the key already
• validate timezone and exit if ip returns empty on ratelimit
• centralise referrer validation
• avoid enumeration in password reset
• tighten apikey validation, remove sql error output
• remove dead code, catch db write error
• comments for readability
• avoid enumeration on login, rate limit change password
• fix setting of uuid
• centralise validation, rate limit on login, auth, register, password reset
• missing auth check on multigraph getlist, would just return empty array but better to have it
• Fix XSS via Broken Sanitize-then-Store Pattern (Type 9 — Colour)
• use core.php get fn here
• fix htmlspecialchars() Misapplied to URL in Logout Flow (Logic Bug)
• avoid usernam enumeration
• Fix: Open Redirect / Potential XSS via referrer Parameter
• upgrade rememberme token to sha256
• remove logging of remember me cookie, use hash_equals better timing, close stmt
• belt and braces
• Merge branch 'master' of github.com:emoncms/emoncms
• harden get_uuid
• Merge pull request #1985 from jeremypoulter/allow_redis_host_configure
• update version
• fix contains error
• breakout common serial config code to simplify maintanence
• Refactor Redis client connection in service-runner to use environment variables for host and port configuration

Full commit diff