Starstruk Logo MarkStarstruk

1.23.9

louislam/uptime-kuma1.23.9Dec 10, 2023by louislam

AI Summary

Critical security release implementing WebSocket origin checks and fixing password change socket handling vulnerabilities.

Key Highlights

  • Implemented WebSocket origin check (similar to CORS policy)
  • Fixed password change not closing all socket connections
  • Added UPTIME_KUMA_WS_ORIGIN_CHECK environment variable
  • Fixed maintenance time input timezone handling

Breaking Changes

  • WebSocket origin must now match server hostname - may break 3rd party tools
  • Reverse proxy configuration required (ProxyPreserveHost for Apache, proxy_set_header Host for Nginx)

New Features

  • WebSocket origin validation
  • Configurable origin check (cors-like or bypass)
  • Accessibility improvements

Full Release Notes

> [!CAUTION]
> If you are using a reverse proxy, the security fix may cause connection issue to the WebSocket server. You should add `ProxyPreserveHost on` in your `<VirtualHost>` for Apache, and `proxy_set_header Host $host;` for Nginx. Read more: https://github.com/louislam/uptime-kuma/issues/4210#issuecomment-1849227424

> [!WARNING]
> If you are using a 3rd-party frontend/tools this may be a breaking change, as the WebSocket Origin has to now match your server hostname.
> Set the environment variable `UPTIME_KUMA_WS_ORIGIN_CHECK=bypass` to skip this check.
> See [GHSA-mj22-23ff-2hrr](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-mj22-23ff-2hrr) for further details.

### ⬆️ Improvements
- #4163 Add an `aria-label` to the monitor search box (Thanks @CommanderStorm)
- #4175 chore: added a helptext for `ntfy`'s `priority` field (Thanks @CommanderStorm)

### 🐛 Bug Fixes
- #4186 Fix: Correct Maintenance Start/End Time Input to Use Explicitly Specified Timezone (Thanks @Ritik0102)
- #4162 Fixed the buttons of `ActionsSelect` and `ActionsInput` having a default `type="submit"` (Thanks @CommanderStorm)

### ⬆️ Security Fixes
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3 Fix: Changing Password did not close all logged in socket connections immediately
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-mj22-23ff-2hrr WebSocket server can only be connected from the same origin only (Similar to the CORS policy)
- Added an environment variable `UPTIME_KUMA_WS_ORIGIN_CHECK`: `cors-like` (default) and `bypass`

### Others
- Other small changes, code refactoring and comment/doc updates in this repo:
- #4158 (Thanks @Saibamen)

Please let me know if your username is missing, if your pull request has been merged in this version, or your commit has been included in one of the pull requests.