Work in progress Chevereto v4.5.8 announcement

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.5

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.4

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed bug preventing changes to enabled storage media types

Fixed a bug that prevented changing which media types are enabled for a storage, it was working only for creation.

 

[Rodolfo]

Fixed bug preventing storage service attribute changes

Fixed a bug that prevented the service attribute from being changed when editing a storage configuration.

 

[Rodolfo]

Removed storage minimum capacity constrain

Before Chevereto V5.0, editing a storage required its capacity to be large enough to accommodate the storage's current usage. This made increasing or adjusting storage capacity unnecessarily difficult, as you had to delete files before making the change.

Storage capacity can now be adjusted without being restricted by the current amount of stored data.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.1

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.2

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed TLS verification for cURL requests in the upgrade process

The upgrading.php file was missing TLS certificate validation. We fixed the TLS bypass, blocking MITM attacks where fake certs let attackers push malicious or downgraded updates undetected.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.3

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Improved Akismet integration with HTTPS, caching, no server params sent

The Akismet integration has been significantly improved: it no longer sends server parameters, all communication now uses HTTPS, and isSpam results are cached to avoid redundant requests.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.6

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.7

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.8

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.9

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Added CLI command to generate Cloudflare trusted proxies

The system now includes the app/bin/cli -C Cloudflare-proxies command which is now part of the application release build process, enabling to provide universal trusted IP proxy validation for Cloudflare users under any given setup/infra.

 

[Rodolfo]

Added Cloudflare trusted proxy support in get_client_ip() function

When using CHEVERETO_HEADER_CLIENT_IP=CF-Connecting-IP, the function get_client_ip() will now check if REMOTE_ADDR comes from Cloudflare, avoiding IP client spoofing at the application layer.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.10

<REDACTED>

This is a security vulnerability that will be disclosed after release.

 

[Rodolfo]

Added column name validation for SQL queries in the DB class

The DB class now validates the shape for mysql column identifiers.

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.11

<REDACTED>

This is a security vulnerability that will be disclosed after release

 

[Rodolfo]

Fixed security vulnerability <REDACTED> | REDACTED ID.12

<REDACTED>

This is a security vulnerability that will be disclosed after release