From 07f5c5d1ee9cfd0ff5767b0e299eff9c7d47759d Mon Sep 17 00:00:00 2001 From: Florian Sylvain Date: Thu, 22 Oct 2026 00:50:33 +0200 Subject: [PATCH] docs: release notes for v3.4.2-beta --- docs/release-notes.md | 1 + docs/releases/v3.4.2-beta.md | 39 ++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 docs/releases/v3.4.2-beta.md diff --git a/docs/release-notes.md b/docs/release-notes.md index b26e721..8546329 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -42,3 +42,4 @@ Each body lives in `docs/releases/.md`. Publish with `tea releases create - | `v3.3.0-beta` | Sites, authors and search and sharing | | `v3.4.0-beta` | Custom content types | | `v3.4.1-beta` | Media field and security updates | +| `v3.4.2-beta` | Security and privacy hardening | diff --git a/docs/releases/v3.4.2-beta.md b/docs/releases/v3.4.2-beta.md new file mode 100644 index 0000000..40833f0 --- /dev/null +++ b/docs/releases/v3.4.2-beta.md @@ -0,0 +1,39 @@ +This release hardens sign-in, sessions and mail against common attacks, and reduces the personal data RenewCMS keeps or shares, following a security, GDPR and CNIL review. + +## Improvements and fixes + +- Signing out now ends the session on the server. A copied session cookie stops working at once, while the same user's other sessions keep working. +- The limit on login, password reset and invitation attempts now applies per client address. Before, opening a new connection reset the count, so the limit could be bypassed. +- Requests that change data and come from another website are refused, and the session cookie is now `SameSite=Lax`. A malicious page can no longer act on behalf of a signed-in user. +- A session made stale by a password reset can no longer read draft articles. +- Signing in with an unknown username now takes as long as signing in with a wrong password, so response times no longer reveal which usernames exist. +- A password longer than 72 bytes is refused with a clear message, where it used to cause a server error. +- Uploaded JPEG, PNG and WebP images lose their hidden metadata (GPS position, camera serial number, dates, comments) before they are stored. Pixels and colour profiles are untouched, and rotated photos keep their orientation. +- The back office no longer loads its fonts from Google. The fonts ship with RenewCMS, so no visitor IP address is sent to a third party. +- Unverified sign-ups are deleted 7 days after their verification code expired, and invitations 30 days after they expired or were accepted. +- Exported activity CSV files also neutralise cells starting with a tab or a carriage return, which spreadsheets could otherwise treat as formulas. + +## API + +- Changed: `POST`, `PUT`, `PATCH` and `DELETE` requests sent by a browser from another origin without an `Authorization` header answer `403` "Cross-origin requests are not allowed." Scripts on other origins must send their API key. +- Changed: `POST /v1/auth/logout` revokes the presented session. It answers `500` only when the revocation cannot be stored, and clears the cookie either way. +- `POST /v1/auth/register`, `POST /v1/auth/password-reset/confirm` and `POST /v1/auth/invite/accept` answer `400` "The password must be 72 bytes or fewer." for longer passwords. + +## Under the hood + +- A new `docs/privacy.md` lists the personal data RenewCMS stores, how long it is kept, the cookies, what leaves the server and how to answer access or erasure requests. It is meant to help operators with their record of processing and privacy notice. +- Cross-origin protection uses the Go standard library, so no dependency was added. +- New feature specs and tests cover the hardening, in `features/security_privacy_hardening.feature`. + +## Upgrading + +- Replace the binary, or pull the new image. Back up the database first as usual. +- A new `revoked_sessions` table is created automatically at startup. +- The server now refuses to start when `JWT_SECRET` is shorter than 32 bytes or is still an example value. Generate one with `openssl rand -hex 32`. Changing it signs everyone out. +- Mail to an SMTP server on another host now requires encryption (STARTTLS, or port 465). If your relay offers neither, set the new `SMTP_ALLOW_INSECURE=true`. Credentials are still never sent unencrypted. +- Sessions created before v3.4.1-beta, which carry no expiry, are refused. Those users sign in once more. + +## Known limitations + +- Images uploaded before this release keep their metadata. Re-upload them if they may contain GPS positions. +- Verified users still cannot be deleted from the interface, and there is no self-service data export yet.