Compare commits

..

1 Commits

Author SHA1 Message Date
Xe Iaso
eab0c82b6a fix(web): make the try again button always go back to /
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-25 10:18:00 -04:00
4 changed files with 5 additions and 11 deletions

View File

@@ -1 +1 @@
1.21.3 1.21.2

View File

@@ -13,24 +13,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
<!-- This changes the project to: --> <!-- This changes the project to: -->
## v1.21.3: Minfilia Warde - Echo 3 ## v1.21.2: Minfilia Warde - Echo 2
### Fixes ### Fixes
#### Fixes a problem with nonstandard URLs and redirects #### Fixes a problem with nonstandard URLs and redirects
Fixes [GHSA-jhjj-2g64-px7c](https://github.com/TecharoHQ/anubis/security/advisories/GHSA-jhjj-2g64-px7c).
This could allow an attacker to craft an Anubis pass-challenge URL that forces a redirect to nonstandard URLs, such as the `javascript:` scheme which executes arbitrary JavaScript code in a browser context when the user clicks the "Try again" button. This could allow an attacker to craft an Anubis pass-challenge URL that forces a redirect to nonstandard URLs, such as the `javascript:` scheme which executes arbitrary JavaScript code in a browser context when the user clicks the "Try again" button.
This has been fixed by disallowing any URLs without the scheme `http` or `https`. This has been fixed by disallowing any URLs without the scheme `http` or `https`.
Additionally, the "Try again" button has been fixed to completely ignore the user-supplied redirect location. It now redirects to the home page (`/`). Additionally, the "Try again" button has been fixed to completely ignore the user-supplied redirect location. It now redirects to the home page (`/`).
## v1.21.2: Minfilia Warde - Echo 2
This contained an incomplete fix for [GHSA-jhjj-2g64-px7c](https://github.com/TecharoHQ/anubis/security/advisories/GHSA-jhjj-2g64-px7c). Do not use this version.
## v1.21.1: Minfilia Warde - Echo 1 ## v1.21.1: Minfilia Warde - Echo 1
- Expired records are now properly removed from bbolt databases ([#848](https://github.com/TecharoHQ/anubis/pull/848)). - Expired records are now properly removed from bbolt databases ([#848](https://github.com/TecharoHQ/anubis/pull/848)).

4
package-lock.json generated
View File

@@ -1,12 +1,12 @@
{ {
"name": "@techaro/anubis", "name": "@techaro/anubis",
"version": "1.21.3", "version": "1.21.2",
"lockfileVersion": 3, "lockfileVersion": 3,
"requires": true, "requires": true,
"packages": { "packages": {
"": { "": {
"name": "@techaro/anubis", "name": "@techaro/anubis",
"version": "1.21.3", "version": "1.21.2",
"license": "ISC", "license": "ISC",
"devDependencies": { "devDependencies": {
"cssnano": "^7.1.0", "cssnano": "^7.1.0",

View File

@@ -1,6 +1,6 @@
{ {
"name": "@techaro/anubis", "name": "@techaro/anubis",
"version": "1.21.3", "version": "1.21.2",
"description": "", "description": "",
"main": "index.js", "main": "index.js",
"scripts": { "scripts": {