• Updated the backend dependencies.
• Updated the frontend dependencies.
• Added new Khmer translations for the backend.

The post Release v1.5.6 appeared first on mosparo.

• Fixed a timing attack security issue in the backend API endpoints to verify a submission, request statistics, and manage rule packages. Found and reported by senti-man via the security advisories (GHSA-9w98-5239-39c2).
• Fixed the wrong command name for the refresh rule package cron jobs. Reported by ffPjrZUGXfcxuAj in #435

Thank you, senti-man, for finding and reporting this issue to us in private via the security advisories.

We recommend updating to v1.5.5 as soon as you can.

Details of the security issue

Description of the security issue

The API endpoints use hashes to validate requests and grant access to the backend. We’ve wrongfully used a simple string comparison, which means that you could guess the private API key by measuring the time.

Risk assessment

The risk of this security issue is manageable. To exploit this issue, an attacker needs to make many requests (thousands) and needs favorable network conditions to guess the correct private key.

Even if the attacker found the private key, the only bad things the attacker could do are adding metadata to a submission and manipulating rule packages, if there are any, in a mosparo project.

It is not possible to request any form or user data. If an attacker successfully obtained the private key, they could only obtain metadata for a submission, project statistics, and the contents of a rule package.

Changes to mitigate the security issue

As suggested by senti-man, we’ve switched the hash comparison to the hash_equals method, which PHP provides specifically for this kind of attack.

The post Release v1.5.5 appeared first on mosparo.

• Ensure that the project is not loaded after the update. If the update changes the table structure, the project table might not be compatible with the source files, leading to errors during the update process. Reported by OvalMedia and Moskito89 in #432
• Added the required configuration to ignore the deprecation messages in the production environment from the log files and the console output. Reported by ffPjrZUGXfcxuAj in #435

Thank you very much for your help in fixing these issues!

The post Release v1.5.4 appeared first on mosparo.

• Fixed a typo in a query when deleting a project. ffPjrZUGXfcxuAj reported this in #430
• Updated the translations for Bulgarian, Catalan, and Spanish thanks to our contributors.

We’re thankful for all the contributions made by our contributors.

The post Release v1.5.3 appeared first on mosparo.

• Removed the unnecessary orderBy call from the statistics query since the call is not required and breaks mosparo when a PostgreSQL database is used. Reported by lporcheron in #427

The post Release v1.5.2 appeared first on mosparo.

• Changed one of the API parameters for the request-submit-token endpoint to optional. This will fix issues where the frontend JavaScript file is cached in the browser and a submit token request fails due to a missing parameter. Additionally, the field may be left blank for a valid purpose, so it should not be required in the first place. Reported by BDphilBen in #426
• Fixed a minor visual issue with the info message in the empty project list

The post Release v1.5.1 appeared first on mosparo.

• Validating multi-step forms (#343). Suggested by Digi92
• Submit additional metadata (#392). Suggested by winkelement
• Add silent mode (#402). Suggested by gitlabisbetterthangithub
• Submission rules (#405). Inspired by GeorgBNM and Jens
• New data format for rule packages (#370).
• Added translations in the project settings (#377). Suggested by FlorianH
• Added form-based security policies (#371). Inspired by demon_ru
• Adjust font size and line height (#378). Suggested by dkray
• Add throughput statistics and reset functionality (#404). Inspired by PinkImagination
• Add option to adjust the number of items per page (#372).
• Add the required API endpoints to manage the rule package cache (#386). Inspired by Digi92
• Show the number of submissions in the project list (#399). Suggested by PinkImagination
• Replaced the illustrations because of a changed license.
• Fixed multiple issues with the statistics API endpoint and added a property (lastSubmissionAt).
• Updated the translations for the new version 1.5.

You can find all the highlights about version 1.5 on this page: https://mosparo.io/highlights/version-1-5/

Please report any potential bugs or issues as new issues on GitHub.

We’re thankful for all the support, feedback, ideas, bug reports, translations, and help we get from all of our contributors. Thank you very much!

The post Release v1.5.0 appeared first on mosparo.

• Fixed the logic to handle the page and perPage properties correctly in the rule package API. Previously, the property was treated as a string, resulting in invalid API requests.
• Added the correct logic to handle the nullable updatedAt value for the rule package rule cache.
• Updated the backend dependencies.

Thank you very much for all your help to make mosparo better!

To see the full list of new features in this new version, please have a look here: Highlights of 1.5

The post Release v1.5.0-beta.3 appeared first on mosparo.

• Fixed the logic to handle the `range` property correctly in the statistics API. Previously, the property was treated as a string, resulting in invalid API requests.
• Added the property `lastSubmissionAt` to the response of the statistics API to get the timestamp of the last submission that was processed by a project.
• Fixed a typo in the security guidelines.
• Updated the backend dependencies.
• Updated the translations.

Thank you very much for all your help to make mosparo better!

To see the full list of new features in this new version, please have a look here: Highlights of v1.5

The post Release v1.5.0-beta.2 appeared first on mosparo.

• Validating multi-step forms (#343). Suggested by Digi92
• Submit additional metadata (#392). Suggested by winkelement
• Add silent mode (#402). Suggested by gitlabisbetterthangithub
• Submission rules (#405). Inspired by GeorgBNM and Jens
• New data format for rule packages (#370).
• Added translations in the project settings (#377). Suggested by FlorianH
• Added form-based security policies (#371). Inspired by demon_ru
• Adjust font size and line height (#378). Suggested by dkray
• Add throughput statistics and reset functionality (#404). Inspired by PinkImagination
• Add option to adjust the number of items per page (#372).
• Add the required API endpoints to manage the rule package cache (#386). Inspired by Digi92
• Show the number of submissions in the project list (#399). Suggested by PinkImagination
• Replaced the illustrations because of a changed license.

You can find all the highlights about version 1.5 on this page: Highlights of 1.5

Please report any potential bugs or issues as new issues on GitHub. Thank you very much for your help testing this new version of mosparo.

The stable release of version 1.5 is planned for the beginning of June 2026.

The post Release v1.5.0-beta.1 appeared first on mosparo.