Releases · emoncms/emoncms

update version
Remove support for cassandra feed engine as not actively used or supported. Part of streamlining emoncms as an application
update version
move app db migrate check to app section
settings clean up match ini with php version
clean up default-settings.php
Merge remote-tracking branch 'origin/master' into settings-cleanup
remove php info
remove old scripts
settings: mirror example.settings.ini in the php template
email: give each setting one home
settings: require the array format in settings.php
settings: remove unused entries from the templates and add missing ones

Merge branch 'master' of github.com:emoncms/emoncms
latest backup module support update version
Merge remote-tracking branch 'origin/master' into backup_support
update default-settings.php to match the ini version
add backup drive actions to the service runner whitelist

update version
email: fix the from address fallback, and rate limit change_email
user: converge on emoncms.org where the two copies had drifted
email: document the transport setting in the settings.php templates
user: load Lib/email.php with require_once
email: select the delivery transport in settings
user: use the shared account gate in passwordreset too
user: apply the account access gate to the remember me path too
user: survive a missing password reset column in every mysqli error mode
user: remove the unused get_salt method
user: do not follow redirects when fetching a gravatar
user: address the gravatar proxy with sha256 only
user: confine the gravatar proxy to the visitor's own avatar
tests: cover the password hashing helpers
user: replace emailed password with a one time password reset link
user: enforce remember me expiry server side and allow bulk revocation
user: only count failed logins towards the login rate limit
user: verify passwords through the new helpers and upgrade hashes on login
user: add bcrypt/argon2id password hashing helpers
update version
return 400 when input/bulk rejects a batch
update version
restore skipping of null values in input bulk upload

Important security update

This release includes an important fix to the Emoncms API helper pages, where user write api key's were accessible from the read api key - a privileged escalation vulnerability. A write api key then enabled user account changes that could enable full account take over.

If you have a public facing emoncms installation AND have shared your read only apikey in a public setting e.g as a emoncms app or dashboard sharing URL, it's particularly important to update your system.

List of commits:

update version
improve consistency, avoid showing read key from write key session
update composer lock
use var emoncms data location for gravatar
public feed check fail closed
update input api notes
update version
new end point for sync module
update version
Merge branch 'api_helper_rebuild'
update version
Merge branch 'restrict_user_actions'
update version
fix read to write apikey privilege escalation in process and schedule api helper pages
update codesniffer version
move fonts and gravatar to local and cache
API helper rebuild
restrict apikey session access
improve gating of multigraph access
improve gating of savad multigraph access
method to check if list of feedids are public
use local gravatar cache in theme
use local gravatar cache
gravatar cache end point
cache gravatar locally
local copy of fonts used in apps