v0.12.1

Timm Fitschen
2023-12-14T15:07:45Z

REL: prepare release 0.12.1

Changelog

See full changelog

[0.12.1] - 2023-12-13

(Timm Fitschen)

Fixed

Insufficient permission checks during subproperty filters of SELECT queries when an entity with retrieve permissions references one without linkahead-server#244

Insufficient permission checks in queries when a name of an invisible record is used in a filter where a visible record references the invisible one linkahead-server#242

Security

This is an important security patch release. The bugs linkahead-server#244 and linkahead-server#242 possibly leak sensitive data when an attacker with read access to linkahead (i.e. the attacker needs an active user account or anonymous needs to be enabled) can guess the name of entities or properties of referenced entities and construct a malicious FIND or SELECT statement and when the attacker has read permissions for an entity which references the entities containing the sensitive information. See the bug reports for more information.