Chevereto v4.5.8 announcement

[Rodolfo]

Chevereto v4.5.8 is a security-focused update. Its headline change is fixes for 19 security vulnerabilities (4 critical, 7 high, and 8 moderate), with details to be disclosed two weeks after release.

Alongside these, the release adds trusted proxy support through the CHEVERETO_HEADER_CLIENT_IP_TRUSTED_PROXIES setting, including Cloudflare support in the get_client_ip() function and a new CLI command that generates Cloudflare’s trusted proxy list. It also hardens the codebase by validating column names in database SQL queries, enforcing TLS verification on cURL calls (including during upgrades), and no longer trusting the MIME type the client provides when detecting uploaded media types. The Akismet spam integration now uses HTTPS, caches results, and stops sending server parameters. FFprobe errors are now logged instead of shown to users, and update checks now include installation details.

On the bug-fix side, it resolves issues that prevented changes to enabled storage media types and storage service attributes, and fixes guest image tracking when Redis-backed sessions are used.

Finally, the minimum capacity requirement for storage has been removed.

 

[Rodolfo]

Added CLI command to generate Cloudflare trusted proxies

Introduced the cloudflare-proxies command which generates a trusted-proxies.php file with the IP ranges used by Cloudflare.

 

[Rodolfo]

Added Cloudflare trusted proxy support in get_client_ip() function

Function get_client_ip() now reads the Cloudflare trusted proxies to assign the client ip.

 

[Rodolfo]

Added column name validation for SQL queries in the DB class

The DB class has been enforced with strict column validation to prevent SQL injection.

 

[Rodolfo]

Added installation details to update checks

When checking for updates, the system now sends the following data to chevereto.com: version_filesystem, version_installed, public_url, incoming_email, servicing and license. This information lets us respond faster when we need to notify you about must-have security updates (such as the one in v4.5.8) and identify which installations are exposed to these threats.

The email sent is the one set as "Incoming email" at /dashboard/settings/email, described there as "Recipient for contact form and system alerts."

The data your installation reports to us is kept private and is not shared with third parties.

 

[Rodolfo]

Added support for trusted proxies (CHEVERETO_HEADER_CLIENT_IP_TRUSTED_PROXIES)

Introduced the env key CHEVERETO_HEADER_CLIENT_IP_TRUSTED_PROXIES which is used to define the IP/CIDR ranges accepted as trusted proxies, used to determine the client IP.

You can learn more about proxy setup at the documentation.

 

[Rodolfo]

Added TLS verification on curl calls

All cURL calls now require TLS certificate verification.

 

[Rodolfo]

Fixed 19 security vulnerabilities (8 moderate, 7 high, 4 critical)

Chevereto v4.5.8 resolves multiple security vulnerabilities found in the most extensive security audit in the project's history. Details will be disclosed two weeks after release. Please update at your earliest convenience.

You can learn more at Security update v4.5.8 on the blog.

Critical (4)

= 4.0.0, < 4.5.8
= 4.0.3, < 4.5.8
= 3.0.0, < 4.5.8 (2)

High (7)

= 3.0.0, < 4.5.8 (2)
= 3.7.0, < 4.5.8
= 3.12.0, < 4.5.8
= 4.0.0, < 4.5.8
= 4.0.11, < 4.5.8
= 4.3.0, < 4.5.8

Moderate (8)

= 3.0.0, < 4.5.8 (4)
= 3.5.14, < 4.5.8
= 3.7.0, < 4.5.8
= 3.8.4, < 4.5.8
= 3.12.0, < 4.5.8

 

[Rodolfo]

Fixed bug preventing storage service attribute changes

Storage form was failing to update under certain conditions, when altering the video/image storage support.

 

[Rodolfo]

Fixed bug with guest image tracking when using Redis backed sessions

Guest upload tracking when using Redis based sessions had a race condition that prevented guest uploads to be added to an album.

 

[Rodolfo]

Fixed bug with upload media type detection trusting the client provided MIME type

Media detection is now stricter as it rely on the system file info rather than the FILES passed mime.

 

[Rodolfo]

Improved Akismet integration with HTTPS, caching, no server params sent

Akismet integration now has full HTTPS support and it doesn't send extra data to Automattic servers.

 

[Rodolfo]

Improved FFprobe error handling to log details instead of displaying them

The errors are now logged to the error log device rather than being displayed on screen.

 

[Rodolfo]

Removed storage minimum capacity constrain

Storage editing doesn't block changes anymore based on the available storage capacity.

 

[Rodolfo]

Fixed bug with variables cache storing encrypted values instead of plaintext

The system was wrongly storing the variable cache, this affected the cache on new install and when altering cipher.

 

[Rodolfo]

Fixed bug with page cache not being cleared after inserting a new page

Cache wasn't being updated when inserting a new page, causing to delay page appearing on the menu for one hour.