Hey fellow selfhosters 👋
HortusFox v6.2 was recently released. In this post, I'd like to inform you about this release as it contains various fixes for medium security vulnerabilities.
Important note: These vulns are not abusable by unauthenticated users! It needs to trick an admin to do certain actions, such as pulling in a prepared backup archive, or theme archive in order to compromise a workspace. Never trust files from unverified sources. Still, it is advised to update your workspaces to 6.2
What is HortusFox?
HortusFox is a self-hosted, opensource web application for plant parents and garden enthusiasts. You can manage many details about your plants such as various attributes, notes, photos and many more! The app also features a task system, inventory, collaborative group chat, weather forecast, calendar, theme system, API, and a lot more.
Changelog for v6.2
Fixed security vulnerability [GHSA-4w8p-x2jj-42w7](https://github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-4w8p-x2jj-42w7)
Fixed security vulnerability GHSA-8phf-v3xj-8jjg
Fixed security vulnerability [GHSA-8rwp-2337-54mm](https://github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-8rwp-2337-54mm)
Fixed security vulnerability GHSA-pjvc-wpc6-wf73
Fixed security issues related to SQL query tokenization, attachment linking and legacy file extensions ([\#572](https://github.com/danielbrendel/hortusfox-web/issues/572))
Prevent importing potentially dangerous files (1c7108f)
Remove unsafe files from imported themes ([3b87393](https://github.com/danielbrendel/hortusfox-web/commit/3b87393d38ce408ec6f0946ffb3cbf0d08b5f07c))
New UI language available: italian (\#554)
Added console command `product:info` ([f498dbe](https://github.com/danielbrendel/hortusfox-web/commit/f498dbe31c8175a83b7b4abde71ca00e3393ddad))
Added console command
migrate:email (\#575)Added console command `migrate:version` ([\#573](https://github.com/danielbrendel/hortusfox-web/issues/573))
Cronjobs are now only reachable via POST requests (\#579)
Note: Meanwhile v6.3 was released as an urgent hotpatch due to a bug being introduced that affected new installations. If you update to 6.2, consider updating to v6.3 as well. However, new installations should not go below version 6.3.
➡️ Link to release:
https://github.com/danielbrendel/hortusfox-web/releases/tag/v6.2
Happy plant parenting! 💚
https://preview.redd.it/95syo4t2pouh1.png?width=1920&format=png&auto=webp&s=e9d54eb8603809619e42c982deac725426d38574
https://redd.it/1x2mjsw
@r_SelfHosted
