Loomio 3.1.2

This security release fixes additional anonymous-poll privacy issues and a group-membership scoping issue found during a continued review of Loomio 3.1.1.

Administrators should upgrade promptly. No database migration or environment-variable change is required.

Security fixes

Anonymous-poll privacy

Loomio replaces the database ID of an anonymous stance with a secret-keyed pseudonymous ID and hides the voter, timestamps, ordering, and written reason, so that a named participant list cannot be joined to an individual stance. These rules already applied to the primary poll and stance data. This release extends the same protection to secondary representations of a stance that each retained a different subset of the underlying fields:

• Version history. Version-history responses for anonymous polls no longer expose a stance's database ID or its edit timestamp.
• Poll CSV export. The per-poll CSV export no longer includes the database ID or the written reason for anonymous stances. The counts and results it reports are unchanged.
• Group data export. The group CSV and JSON exports no longer retain the database ID, written reason, or creation order of anonymous stances.
• Reason translation. On-demand translation of a stance's reason now follows the same visibility rules as the poll itself. A reason can no longer be translated before results are visible, after it has been redacted, or after it has been withdrawn, and translated content no longer carries the stance's database ID. This applies to both the translation request and the live translation update sent to a group.
• Bookmarks. Bookmarking another member's anonymous stance no longer reveals the voter's name or the stance's database ID. An internal aliasing issue that could return the real voter behind an anonymous stance has also been corrected at its source, so the same protection now covers any code path that reads a stance's author.
• Tasks. Creating a task from text inside an anonymous stance no longer discloses the voter, the stance's database ID, or the reason.
• Notification delivery timing. Email and chatbot notifications about a new stance are no longer delivered before a poll set to hide results until it closes has closed.
• Thread Markdown export. The thread Markdown export no longer includes the exact submission time of anonymous stances.
• Ordering metadata. Event, timeline, position-key, and search responses no longer expose ordering or sequence metadata that could reconstruct the order in which anonymous stances were cast.

These changes close composition attacks in which individually exposed IDs, timestamps, ordering, or exported records could be joined with an observable participant list. They apply to existing anonymous polls immediately after upgrade and do not alter poll totals.

This is a defense-in-depth follow-up to the anonymous poll metadata advisory and continues the work in Loomio 3.1.1.

Hidden subgroup membership

The membership-list endpoint returned the members of a subgroup to administrators of a parent group even when the subgroup was configured to be hidden from parent members. An administrator of a parent group who was not a member of a hidden subgroup could therefore retrieve that subgroup's member list, including member names and roles.

The endpoint now applies the subgroup's own visibility setting, matching the rule already used elsewhere to decide whether parent-group members can see a subgroup. Member lists of subgroups that are hidden from parent members are no longer disclosed to parent-group administrators who are not members of the subgroup. Member email addresses were already withheld in this case and were not exposed.

Upgrade notes

This patch release contains no database migrations.

1. Edit .env and set the image tag:

   LOOMIO_CONTAINER_TAG=v3.1.2
   

   Use v3.1.2 to pin this exact release, or v3.1 to track the 3.1 patch series and pick up future 3.1.x releases automatically on each update.

2. Run the update script from your deployment directory:

   ./update.sh
   

   which runs:

   docker system prune -a -f \
     && docker compose pull \
     && docker compose down \
     && docker compose run --rm app rake db:migrate \
     && docker compose down \
     && docker compose up -d --remove-orphans
   

3. Confirm the application and worker services are running.

Full changelog: https://github.com/loomio/loomio/compare/v3.1.1...v3.1.2