Skip to content

firefly-iii

v6.6.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 26d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

accounting budget budgeting budgets cash-flow cashflow
+12 more
credit-card docker expenses finance finances financial linux money paycheck personal-finance php php7

Affected surfaces

auth

Summary

AI summary

Broad release touches https://github.com/firefly-iii/firefly-iii/issues/12296, https://github.com/firefly-iii/firefly-iii/issues/12297, https://github.com/firefly-iii/firefly-iii/issues/12305, and https://github.com/firefly-iii/firefly-iii/issues/12306.

Full changelog

Welcome to release v6.6.4 of Firefly III. It contains the latest fixes, translations and features. Docker users can find this release under the latest tag.

Changelog

Changed

  • Expanded AI disclosure rules and security issue disclosure rules.

Fixed

  • Issue 12296 (Limit on the number of repetition of a recurring operation is inconsistent between API & web form) reported by @AlexRNL
  • Issue 12297 (CurrencyRepository::enable() sets enabled = false (copy/paste from disable())) reported by @abhibalu
  • Issue 12305 (2FA QR code not rendered: enable-mfa.twig outputs google2fa-qrcode v4 data-URI as text, not an image) reported by @Pioszym
  • Issue 12306 (Deprecated apple-mobile-web-app-capable meta tag - add standard mobile-web-app-capable) reported by @Pioszym
  • Issue 12309 (Incorrect account total on account overview page) reported by @halilim
  • Issue 12339 (Default currency resets / coult not find transaction currency with code) reported by @rarosalion
  • Issue 12354 (Redirect after session expiry on mobile leads to 404 /transactions/:tag) reported by @boosnie
  • Issue 12353 ([UI] add margin or padding to tags) reported by @zhiiwg
  • Issue 12356 (Tags page all transaction link invalid) reported by @ppslim
  • Issue 12370 (Running balance uses an incorrect currency indicator when dealing with cash accounts) reported by @jgmm81
  • Issue 12396 (User creation using API error - user has no user group.) reported by @gesdomuscom
  • Issue 12401 (Minimal amount of subscription can be above max amount) reported by @bastantoine

Security

  • Fix issue with cron API call not recognizing cron tokens, found by Rajib Mahmud
  • Fix issue with installer, found by Rajib Mahmud and others

Installation and upgrade instructions

The releases are signed, and you can verify them using the Firefly III releases PGP key.

Develop with Firefly III

Are you interested in (future) API changes to Firefly III, or other interesting dev-related updates? Sign up to the Firefly III developer newsletter to receive low-frequency updates about the development of Firefly III.

Support Firefly III

Did you know you can support the development of Firefly III? You can donate in many ways, like GitHub Sponsors or Patreon. Please follow this link for more information. Thank you for your consideration.

Security Fixes

  • Fixed cron API call not recognizing cron tokens
  • Fixed installer vulnerability

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track firefly-iii

Get notified when new releases ship.

Sign up free

About firefly-iii

Firefly III: a personal finances manager

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]