Release v3.12.1
This release includes several security fixes to the platform. Listed in no particular order:
platform#1596 - Secure Credentials Leak: sanitize HTTP headers sent to sentry.
platform#1606 - Length of Password is Not Validated After Reset: validate the password lenght on password reset.
platform#1607 - Lack of Bruteforce Protection new user: send a HTTP 429 response if the rate limit is reached due to multiple requests to the registration endpoint.
platform#1610- Missing X-XSS-Protection HTTP Header: add the HTTP header in the response as: X-XSS-Protection: 1; mode=block. Please note that for OSS deployers (not in ushahidi.io), you will need to update your ngnix or apache configuration. The updated configuration templates are available at platform-release.
platform#1617 - Role Creation and Permission Assignment: verify if a user is a paid or non-paid member of ushahidi.io before creating roles.
platform#1618 - Internal Server Error While Uploading Photo: prevent upload errors from disclosing information about the underlying host where the images are located
USH-016 - SSL Cookie Without Secure Flag Set: Set the Secure flag for all cookies that are being communicated over a secure channel.