8000 Release HedgeDoc 1.11.0 · hedgedoc/hedgedoc · GitHub

Repository navigation

HedgeDoc 1.11.0

ErikMichelson released this 18 Jun 22:04

· 7276 commits to develop since this release

f115b2d

Security fixes

This release contains four security fixes:

GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to Chandler Johnson, taylorodell and alanturing881 for reporting!

Important notices

When using Cloudflare in front of HedgeDoc, you should set rateLimitUsingCloudflare in the config.json or CMD_RATE_LIMIT_USING_CLOUDFLARE as environment variable to true.

Enhancements

Added a warning page when clicking external links
Improve the config.json.example file, which is used by bin/setup
Allow configuration of login / signup rate-limits
Allow configuration of Cloudflare usage in regards of rate-limits
Several improvements in the documentation at https://docs.hedgedoc.org

Assets 3

0