Release v1.5.13

Version 1.5.13 is a security release that fixes multiple security-related issues and many bugs. While this is a security release, it’s important to note that the fixed security-related issues are low-severity.

We want to note that this version has nothing to do with the PHP security patches released last week. We prepared this version before the announcement of the PHP security patches, but postponed the release from last week to today.

Update and setup

• Fixed the SAVEPOINT errors that can occur in MySQL setups. Reported by camlafit in #456
• Added a function to handle errors during migration processing.
• Resolved the duplicate update checks.
• Setup: The admin password is now removed from the session after the user is created.
• Changed the update log filenames to use random_bytes for more random names.

Verification

• Changed the hash verification to hash_equals and made it case-insensitive.
• Fixed a race condition when two requests wanted to verify the same submit token.
• The verification simulation on the submission detail page no longer shows the real hashes.

Security settings

• All IP-based security features (delay, lockout, and so on) use the IPv6 /64 subnet to count based on the IP address.

Frontend

• Switched the delay message’s innerHTML to a safer method.
• Fixed the Last-Modified date in the CSS redirect.
• Added the required logic to validate the URL to prevent redirecting to a new host.

Projects

• Added a missing access-level check for creating new projects.
• Adjusted the search in the project list to search case-insensitively.
• Fixed a bug where the user saw an error instead of the empty project group after deleting a project.

Rules

• Submission rule random values: Added constraints to enforce the correct values and fixed a logic bug. The rating needs to be greater than or equal to 0.1. The status is now displayed correctly in the list.

Rule packages

• Changed the hash comparison to case-insensitive and handle missing newlines.
• Adjusted the logic to remove the aborted imports.
• Using a stream wrapper in the file path is no longer possible. The path needs to be an absolute file path.
• Rule packages based on a URL need to start with http:// or https://.
• Added additional logic to handle rule package files larger than 1 MB, which libmagic could identify as text/plain.
• Handle missing sources correctly and prevent errors.

Project import

• The default overrides were not preselected.
• Import and job files were not deleted if the import failed.

Password

• Increased the minimum password length to 8 characters. Existing shorter passwords will still work after the update.
• Password reset no longer shows the error message when sending the email.
• Fixed an error 500 during login when the password hash was automatically upgraded.

Other

• Fixed the reverse proxy header replacement, which was not correctly applied due to a typo.
• Updated all backend dependencies.
• Fixed multiple PHP 8.4 deprecations.

Details of the security issues

Description of the security issue

The most problematic security fix is the functionality to create a new project, which is not limited to users with the “can create project” role. This means that every authenticated user can create a new project.

Additionally, we increased the minimum password length to 8 characters, adjusted the hash comparison in the verification API, hid the full hash in the verification simulation, and made other adjustments to make mosparo more secure.

Risk assessment

We recommend updating to v1.5.13 as soon as possible.

The only risk in this update is the fix for the missing access check when creating a new project. But this means that an authenticated user can create a new project without the role to create new projects. The user is unable to delete or modify any existing projects; therefore, the risk is considered low. If all your users have the access level to create new projects, there is no risk at all.

The other security-related fixes are not directly a threat to your mosparo installation.