Dear OpenBoxes Community,
We are happy to announce the release of OpenBoxes v0.9.8
Notable Changes
Product import will now throw an error if a category assigned to a product does not exist. Going forward, you will need to create any categories before creating products.
If want to preserve the old product import behaviour of creating any non-existing categories, set the following application property:
openboxes:
import:
product:
createMissingCategories: true
Security Patches
The following security advisory vulnerabilities were fixed as a part of this release:
- Server-Side Template Injection leading to Remote Code Execution in Zebra template rendering · Advisory · openboxes/openboxes · GitHub discovered by nedlir
- SSRF in product document upload via unvalidated caller-supplied URL · Advisory · openboxes/openboxes · GitHub discovered by nedlir
- Privilege escalation via Manager-role user creation and role assignment · Advisory · openboxes/openboxes · GitHub discovered by nedlir
You can read more about v0.9.8 here:
Release Notes 0.9.8.docx (1.0 MB) (en)
Notes de Version 0.9.8.docx (1.0 MB) (fr)
Notas de la versión 0.9.8.docx (1.0 MB) (es)
Download the latest version of the release from here: Release Release v0.9.8 · openboxes/openboxes · GitHub