This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.
We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.
Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.
Full List of Changes
Updated application PHP dependencies.
Add some additional resource-based limits. (#5968)
Updated translations with latest Crowdin changes. (#5962)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Added support for downloading multiple files and entire folder trees (#26006 by @Nitwel)
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
@directus/sdk
Added support for downloading multiple files and entire folder trees (#26006 by @Nitwel)
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
Fixed missing accountability for files.upload when TUS is enabled (#26247 by @br41nslug)
@directus/types
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/storage-driver-cloudinary
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/storage-driver-supabase
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/extensions-sdk
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
@directus/system-data
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
@directus/sdk
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
This is a security release to address a vulnerability in our dependencies related to XML
handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.
It's strongly advised to update if you're using SAML authentication for BookStack.
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added the ability to define custom part states (PR #1053, thanks to @webdevinition)
Added the ability to automatically suggest and generate IPNs (PR #1054, thanks to @webdevinition)
Added experimental ability to rename datastructure types with the new synonym system, which allows you to define domain specific names for concepts of "parts", "categories", etc. (thanks @webdevinition)
Improvements
Improved ability to determine category from info provider (#1113)
Do not require a trailing slash for DEFAULT_URI (#1118)
Define preview images for partkeepr imports (#1115)
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
hooks now behave more usefully/predictably; 889bd32
hooks returning 0 will run the next hook (if any), and let the initiating action proceed if no other hooks object
hooks returning 100 will stop processing successive hooks, but return success, letting the initiating action proceed
hooks returning anything else will stop processing successive hooks (like the documentation always said) and also fail the initiating action (if hook is checked)
zmq hooks can now respond with json, doing relocations and all that stuff
Note: This was originally accidentally published as v24.11.4, so this is essential a re-publish with the correct version.
The wrong version number commit/history has been retained though to prevent any breakages for git-managed environments.
This release contains the following fixes and changes:
Fixed overly-strict image access permission changes in v25.11.2 which could block images when a secure storage option was used alongside public access. (#5906, #5909)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Removed non-relational types from RELATIONAL_TYPES constant (#25964)
Extensions or external code using RELATIONAL_TYPES should note the excluded presentation and group.
Fixed <scope>.delete filter hook running after permission check. Fixed keys returned by the hook not being used in place of the original keys. (#26034)
Keys returned by the hook are now used in place of the original keys.
The hook will trigger regardless of user permissions. Ensure any necessary permission checks are performed prior to any data processing.
@directus/api
Fixed <scope>.delete filter hook running after permission check. Fixed keys returned by the hook not being used in place of the original keys. (#26034 by @ComfortablyCoding)
Restricted system collection fields to only allow indexing (#24820 by @br41nslug)
@directus/constants
Removed non-relational types from RELATIONAL_TYPES constant (#25964 by @formfcw)
@directus/extensions-sdk
Use node exportConditions when building api extensions. See #25591 (#25591 by @julbd)
✨ New Features & Improvements
@directus/app
Introduced the Content Comparison Modal for side-by-side review of version and revision changes. (#25782 by @robluton)
Added interface config option to control indicator appearance (#26086 by @formfcw)
Added schema snapshot download button to the admin view of the studio (#25903 by @Nitwel)
Added setup flow and license agreement banner (#25983 by @Nitwel)
Added comparison indicators for group interfaces (#26086 by @formfcw)
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
#961 the /?shares listing now shows the list of filenames for each share 2cc53ea
🩹 bugfixes
#967 per-volume md/lg sandbox rules are now applied during navigation db60951
if a volume has no-sb-lg or no-sb-md set then it'll apply when navigating into that volume, and vice-versa
Log in
