• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space

Work in progress Chevereto v5.0.0 announcement

Fixed security vulnerability <REDACTED> | REDACTED ID.7

<REDACTED>

This is a security vulnerability that will be disclosed after release.
 
Fixed security vulnerability <REDACTED> | REDACTED ID.8

<REDACTED>

This is a security vulnerability that will be disclosed after release.
 
Added "Powered by Chevereto" on email footers (when enabled)

I keep discovering mysterious ways to keep the software and its brand relevant.
 
Updated signup and account routes to don't expose existing usernames or emails

The system won't longer expose username or email collision to users, it will just prompt "Unable to process your request".
 
Added /api/5/translations/{locale} route

This new route will enable the retrieval (GET) of the json translation object required for translating application strings. It improves the system by enabling both HTTP caching and async load, instead of V4's approach where the entire translation object thing was re-computed and included on the HTML response for every load.
 
Fixed security vulnerability <REDACTED> | REDACTED ID.9

<REDACTED>

This is a security vulnerability that will be disclosed after release.
 
Added CLI command to generate Cloudflare trusted proxies

The system now includes the app/bin/cli -C cloudflare command which is now part of the application release build process, enabling to provide universal trusted IP proxy validation for Cloudflare users under any given setup/infra.
 
Added Cloudflare trusted proxy support in get_client_ip() function

When using CHEVERETO_HEADER_CLIENT_IP=CF-Connecting-IP, the function get_client_ip() will now check if REMOTE_ADDR comes from Cloudflare, avoiding IP client spoofing at the application layer.
 
Fixed security vulnerability <REDACTED> | REDACTED ID.10

<REDACTED>

This is a security vulnerability that will be disclosed after release.
 
Added column name validation for SQL queries in the DB class

The DB class now validates the shape for mysql column identifiers.
 
Fixed security vulnerability <REDACTED> | REDACTED ID.11

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed security vulnerability <REDACTED> | REDACTED ID.12

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed security vulnerability <REDACTED> | REDACTED ID.13

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed bug with guest image tracking when using Redis backed sessions

When utilizing Redis as the session save handler, a race condition occurred between concurrent guest uploads. This issue resulted in image loss within the collection and disrupted the expected functionality for guest album creation following upload completion.
 
Fixed security vulnerability <REDACTED> | REDACTED ID.14

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed security vulnerability <REDACTED> | REDACTED ID.15

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed security vulnerability <REDACTED> | REDACTED ID.16

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed security vulnerability <REDACTED> | REDACTED ID.17

<REDACTED>

This is a security vulnerability that will be disclosed after release
 
Fixed security vulnerability <REDACTED> | REDACTED ID.18

<REDACTED>

This is a security vulnerability that will be disclosed after release
 

Chevereto Cloud

Back
Top