diff --git a/SECURITY.md b/SECURITY.md index 262e66e2..26ce3c55 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -32,6 +32,8 @@ To receive fixes for security vulnerabilities it is required to always upgrade t | V 0.6.16 | JavaScript could get executed on authors page. Thanks to @alicaz || | V 0.6.16 | Localhost can no longer be used to upload covers. Thanks to @scara31 || | V 0.6.16 | Another case where public shelfs could be created without permission is prevented. Thanks to @nhiephon || +| V 0.6.17 | The SSRF Protection can no longer be bypassed via an HTTP redirect. Thanks to @416e6e61 || +| V 0.6.17 | The SSRF Protection can no longer be bypassed via 0.0.0.0 and it's ipv6 equivalent. Thanks to @r0hanSH || ## Staement regarding Log4j (CVE-2021-44228 and related) diff --git a/cps/constants.py b/cps/constants.py index f9003125..a96f614b 100644 --- a/cps/constants.py +++ b/cps/constants.py @@ -154,7 +154,7 @@ def selected_roles(dictionary): BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, ' 'series_id, languages, publisher') -STABLE_VERSION = {'version': '0.6.17 Beta'} +STABLE_VERSION = {'version': '0.6.17'} NIGHTLY_VERSION = dict() NIGHTLY_VERSION[0] = '$Format:%H$' diff --git a/test/Calibre-Web TestSummary_Linux.html b/test/Calibre-Web TestSummary_Linux.html index c569a45d..5daf8267 100644 --- a/test/Calibre-Web TestSummary_Linux.html +++ b/test/Calibre-Web TestSummary_Linux.html @@ -37,20 +37,20 @@
Start Time: 2022-02-28 21:38:15
+Start Time: 2022-03-02 20:56:18
Stop Time: 2022-03-01 01:36:56
+Stop Time: 2022-03-03 01:48:44
Duration: 3h 14 min
+Duration: 4h 5 min
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_edit_books_author_gdrive.py", line 579, in test_rename_capital_on_upload - self.assertEqual('Useless', details['title']) -KeyError: 'title'-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_edit_ebooks_gdrive.py", line 392, in test_edit_author - self.assertEqual(values['author'][0], 'Pipo, Pipe') -IndexError: list index out of range-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_edit_ebooks_gdrive.py", line 183, in test_edit_title - self.assertEqual('Unknown', values['title']) -KeyError: 'title'-
Traceback (most recent call last): File "/home/ozzie/Development/calibre-web-test/test/test_edit_ebooks_gdrive.py", line 947, in test_watch_metadata self.assertNotIn('series', book) -AssertionError: 'series' unexpectedly found in {'id': 5, 'reader': [], 'title': 'testbook', 'author': ['John Döe'], 'rating': 0, 'languages': ['English'], 'identifier': [], 'cover': '/cover/5?edit=cd72c8b1-57d4-4162-a993-661f44e62822', 'tag': [], 'publisher': ['Randomhäus'], 'pubdate': 'Jan 19, 2017', 'comment': 'Lorem ipsum dolor sit amet, consectetuer adipiscing elit.Aenean commodo ligula eget dolor.Aenean massa.Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus.Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.Nulla consequat massa quis enim.Donec pede justo, fringilla vel, aliquet nec, vulputate', 'add_shelf': [], 'del_shelf': [], 'edit_enable': True, 'kindle': None, 'kindlebtn': None, 'download': ['EPUB (6.7 kB)'], 'read': False, 'archived': False, 'series_all': 'Book 1 of test', 'series_index': '1', 'series': 'test', 'cust_columns': []}+AssertionError: 'series' unexpectedly found in {'id': 5, 'reader': [], 'title': 'testbook', 'author': ['John Döe'], 'rating': 0, 'languages': ['English'], 'identifier': [], 'cover': '/cover/5?edit=22ded0fa-26b4-429d-81fc-bc75707c4e4c', 'tag': [], 'publisher': ['Randomhäus'], 'pubdate': 'Jan 19, 2017', 'comment': 'Lorem ipsum dolor sit amet, consectetuer adipiscing elit.Aenean commodo ligula eget dolor.Aenean massa.Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus.Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.Nulla consequat massa quis enim.Donec pede justo, fringilla vel, aliquet nec, vulputate', 'add_shelf': [], 'del_shelf': [], 'edit_enable': True, 'kindle': None, 'kindlebtn': None, 'download': ['EPUB (6.7 kB)'], 'read': False, 'archived': False, 'series_all': 'Book 1 of test', 'series_index': '1', 'series': 'test', 'cust_columns': []} @@ -2004,11 +1944,11 @@ AssertionError: 'series' unexpectedly found in {'id': 5, 're -
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_email_ssl.py", line 130, in test_SSL_logging_email - self.assertTrue(len(re.findall('subject: Calibre-Web test e-mail', data)),"Email logging not working") -AssertionError: 0 is not true : Email logging not working-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_upload_epubs.py", line 28, in setUpClass - startup(cls, cls.py_version, {'config_calibre_dir': TEST_DB, 'config_uploading': 1}) - File "/home/ozzie/Development/calibre-web-test/test/helper_func.py", line 173, in startup - inst.p = process_open(command, [1], sout=None, env=env, cwd=work_path) - File "/home/ozzie/Development/calibre-web-test/test/subproc_wrapper.py", line 28, in process_open - return subprocess.Popen(exc_command, - File "/usr/lib/python3.8/subprocess.py", line 858, in __init__ - self._execute_child(args, executable, preexec_fn, close_fds, - File "/usr/lib/python3.8/subprocess.py", line 1704, in _execute_child - raise child_exception_type(errno_num, err_msg, err_filename) -FileNotFoundError: [Errno 2] No such file or directory: '/home/ozzie/Development/calibre-web/venv/bin/python3' - -During handling of the above exception, another exception occurred: - -Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_upload_epubs.py", line 32, in setUpClass - cls.driver.quit() -AttributeError: 'NoneType' object has no attribute 'quit'-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_user_list.py", line 53, in setUpClass - startup(cls, cls.py_version, {'config_calibre_dir': TEST_DB, "config_uploading": 1}) - File "/home/ozzie/Development/calibre-web-test/test/helper_func.py", line 173, in startup - inst.p = process_open(command, [1], sout=None, env=env, cwd=work_path) - File "/home/ozzie/Development/calibre-web-test/test/subproc_wrapper.py", line 28, in process_open - return subprocess.Popen(exc_command, - File "/usr/lib/python3.8/subprocess.py", line 858, in __init__ - self._execute_child(args, executable, preexec_fn, close_fds, - File "/usr/lib/python3.8/subprocess.py", line 1704, in _execute_child - raise child_exception_type(errno_num, err_msg, err_filename) -FileNotFoundError: [Errno 2] No such file or directory: '/home/ozzie/Development/calibre-web/venv/bin/python3' +PASS +
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_user_load.py", line 61, in setUpClass - startup(cls, cls.py_version, {'config_calibre_dir': TEST_DB, 'config_access_log': 1}) - File "/home/ozzie/Development/calibre-web-test/test/helper_func.py", line 173, in startup - inst.p = process_open(command, [1], sout=None, env=env, cwd=work_path) - File "/home/ozzie/Development/calibre-web-test/test/subproc_wrapper.py", line 28, in process_open - return subprocess.Popen(exc_command, - File "/usr/lib/python3.8/subprocess.py", line 858, in __init__ - self._execute_child(args, executable, preexec_fn, close_fds, - File "/usr/lib/python3.8/subprocess.py", line 1704, in _execute_child - raise child_exception_type(errno_num, err_msg, err_filename) -FileNotFoundError: [Errno 2] No such file or directory: '/home/ozzie/Development/calibre-web/venv/bin/python3' - -During handling of the above exception, another exception occurred: - -Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_user_load.py", line 65, in setUpClass - cls.driver.quit() -AttributeError: 'NoneType' object has no attribute 'quit'-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_user_template.py", line 20, in setUpClass - startup(cls, cls.py_version, {'config_calibre_dir': TEST_DB}) - File "/home/ozzie/Development/calibre-web-test/test/helper_func.py", line 173, in startup - inst.p = process_open(command, [1], sout=None, env=env, cwd=work_path) - File "/home/ozzie/Development/calibre-web-test/test/subproc_wrapper.py", line 28, in process_open - return subprocess.Popen(exc_command, - File "/usr/lib/python3.8/subprocess.py", line 858, in __init__ - self._execute_child(args, executable, preexec_fn, close_fds, - File "/usr/lib/python3.8/subprocess.py", line 1704, in _execute_child - raise child_exception_type(errno_num, err_msg, err_filename) -FileNotFoundError: [Errno 2] No such file or directory: '/home/ozzie/Development/calibre-web/venv/bin/python3' - -During handling of the above exception, another exception occurred: - -Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_user_template.py", line 22, in setUpClass - cls.driver.quit() -AttributeError: 'NoneType' object has no attribute 'quit'-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_visiblilitys.py", line 25, in setUpClass - startup(cls, cls.py_version, {'config_calibre_dir': TEST_DB}) - File "/home/ozzie/Development/calibre-web-test/test/helper_func.py", line 173, in startup - inst.p = process_open(command, [1], sout=None, env=env, cwd=work_path) - File "/home/ozzie/Development/calibre-web-test/test/subproc_wrapper.py", line 28, in process_open - return subprocess.Popen(exc_command, - File "/usr/lib/python3.8/subprocess.py", line 858, in __init__ - self._execute_child(args, executable, preexec_fn, close_fds, - File "/usr/lib/python3.8/subprocess.py", line 1704, in _execute_child - raise child_exception_type(errno_num, err_msg, err_filename) -FileNotFoundError: [Errno 2] No such file or directory: '/home/ozzie/Development/calibre-web/venv/bin/python3' - -During handling of the above exception, another exception occurred: - -Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_visiblilitys.py", line 27, in setUpClass - cls.driver.quit() -AttributeError: 'NoneType' object has no attribute 'quit'-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_zz_helper.py", line 25, in setUpClass - from cps import helper, updater -ImportError: cannot import name 'helper' from 'cps' (unknown location)-