Starstruk Logo MarkStarstruk

1.0.8.3

n0-computer/iroh1.0.8.3May 13, 2026by givanz

AI Summary

A security-focused release addressing multiple vulnerabilities including cart manipulation, cross-site scripting (XSS), and PHP memory exhaustion issues.

Key Highlights

  • Fixed cart page to use only encrypted cart_id
  • Fixed wrong module permission checks for admin controllers
  • Fixed Controller Recursion PHP Memory Exhaustion
  • Added sanitization for user display_name field
  • Fixed Stored XSS via Comment Author Field

Full Release Notes

* Fixed cart page to use only encrypted cart_id instead of unencrypted to avoid loading random cart data, vulnerability reported by @Mitchell45 https://github.com/givanz/Vvveb/commit/301e9b66a3b3a1cb42cb05ad1ff3cd428ed30b26
* Fixed wrong module permission check for some admin controllers, vulnerability reported by @Mitchell45 https://github.com/givanz/Vvveb/commit/8d59962b5d9775264f0f05bf87ee1f514ebf7666
* White list sort order and direction for /user/orders, vulnerability reported by @whuHouYF https://github.com/givanz/Vvveb/commit/e855c8572b7298901ebc249e11883eefc03a7b48
* Added sanitization for user display_name field, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/fefac290a8c85d3c87fe80ffed68b6c5bc50e93c
* Validate plugin upload and check that no php is exposed in public folder, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6
* Prevent apache directory listing, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb
* Fixed Controller Recursion PHP Memory Exhaustion reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 
* Added escape for customer_order_id in missing order warning message, fix for GHSA-3xwm-8f6m-cfc6 reported by @whuHouYF https://github.com/givanz/Vvveb/commit/2457d88b125430d0724978993442946e43a6dac2 
* Changed sanitizeHTML to strip javascript code inside tags with escaped entities, fix for GHSA-39gc-pjv5-4w4p reported by @elvinsuleymanov https://github.com/givanz/Vvveb/commit/7e02b0e1a375480bf4b45a10175f6c07f91ff409