otterwiki

v2.20.7 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis

✓ No known CVEs patched

This release patches 3 known CVEs

Topics

git markdown wiki

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates Security Fixes, Bug Fixes, and https://github.com/redimp/otterwiki/compare/v2.20.6...v2.20.7 across a mixed release.

Full changelog

Use HMAC with SECRET_KEY for the webhook hash, generate the webhook URL server-side,
and add GIT_REMOTE_PULL_URL_SECURE for backward-compatible hashes, see #443 (bc77b7d by @onovy).
Prevent style attribute XSS in InfoBox, ImageFrame and Figure embeddings (8c5d311).
Deny any possibility for malicious redirects, see #504 (15f5a86 by @deseven).
Thanks to @Fushuling for reaching out and bringing this potential security risk to our attention.

Open external links in a new tab with an icon, see #215 #507 (e18304f by @ribbal).
Allow multiple sub-tree items to be unfolded in the page index, see #512 (df49a45 by @ribbal).

Add a TOP focus option and unfold all folders when focus is OFF, see #506 (0bc25d8).
Safely encode DataTable caption using json.dumps, see #502 (8911f1a by @turfin-logic).
Lowercase crumb paths for isdir checks on case-sensitive filesystems (d5b1bdc).
Fix referencing pages plugin, see #498 (473ec48 by @ribbal).

@ribbal made their first contribution in https://github.com/redimp/otterwiki/pull/498
@turfin-logic made their first contribution in https://github.com/redimp/otterwiki/pull/502

Use HMAC with SECRET_KEY for webhook hash and add GIT_REMOTE_PULL_URL_SECURE for backward-compatible hashes (CVE not listed)
Prevent style attribute XSS in InfoBox, ImageFrame and Figure embeddings
Deny any possibility for malicious redirects

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track otterwiki

Get notified when new releases ship.

About otterwiki

A minimalistic wiki powered by python, markdown and git.