Releases/Release announcements/Release 2.5.3 - Revision history

Dan: /* Security patch */ Add Chirag Prajapati to community security reporters

2020-02-12T20:58:22Z

‎Security patch: Add Chirag Prajapati to community security reporters

Dan: /* Additional security notice - PHP 7.2 vulnerability announced */

2019-10-30T18:30:34Z

‎Additional security notice - PHP 7.2 vulnerability announced

Dan: /* Security patch */ minor formatting fixes

2019-10-30T18:28:42Z

‎Security patch: minor formatting fixes

Dan: /* Security patch */ fix admonition formatting

2019-10-30T18:28:00Z

‎Security patch: fix admonition formatting

Dan: /* Security patch */ fix subheading formatting

2019-10-30T18:27:28Z

‎Security patch: fix subheading formatting

Dan: Add initial page content

2019-10-30T18:26:53Z

Add initial page content

New page

{{#pagetitle:Release 2.5.3}}
[[Main Page]] > [[Releases]] > [[Releases/Release announcements]] > Release 2.5.3

'''Release date''': October 30, 2019

'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.5.3.tar.gz atom-2.5.3.tar.gz]

'''Release 2.5.3''' is a security patch release for AtoM 2.5. We've also closed several bug tickets, including a regression in the permissions module that was affecting custom groups. You can view more details on each ticket in our issue tracker at the following links:

* [https://projects.artefactual.com/versions/130 Release 2.5.3 Roadmap / Overview]
* [http://bit.ly/2MZpNrJ 2.5.3 issues organized by category]

Visit the [https://www.accesstomemory.org/download/ Downloads] page to download the most recent release, and consult the 2.5 [https://www.accesstomemory.org/docs/2.5/admin-manual/installation/upgrading/ Upgrading] and [https://www.accesstomemory.org/docs/2.5/admin-manual/installation/linux/linux/ Installation] guides in our documentation for further information.

==Security patch==

<admonition type="note">
Thank you to community users Kenny Pierce, Cindy Shen, and Jeremy Heil for helping to bring this issue to our attention!
</admonition>

A regression discovered in releases [[Releases/Release announcements/Release 2.5|2.5]] and [[Releases/Release announcements/Release 2.5.1|2.5.1]] that exposes AtoM users to a potential cross-site scripting ([https://en.wikipedia.org/wiki/Cross-site_scripting XSS]) vulnerability was addressed in Release [[Releases/Release announcements/Release 2.5.2|2.5.2]] with patches that resolve the issue. However, since then, additional locations with the same issue have been reported.

This 2.5.3 release includes a global escaping strategy to fix the regression, rather than patching issues locally as they are discovered.

Related issue ticket: #13192 - Reconsider escaping strategy modification when Markdown support is enabled

'''We encourage all 2.5 users to upgrade as soon as possible'''. For those who are concerned about this issue but unable to upgrade at this time, disabling Markdown via ''Admin > Settings > Markdown'' will also circumvent the issue until upgrading is possible.

Alternatively, users could apply the following commit as a patch to a 2.5.2 installation to resolve the issue in their current installation:

https://github.com/artefactual/atom/commit/5b6b6ee95a7b89125208eb81813be07e333499af

<admonition type=”tip”>
You can add <code>.patch</code> to the commit URL above to see it in raw form as a patch that can be applied to your instance. Here's one of many online tutorials on how to work with patches using git:
https://nithinbekal.com/posts/git-patch/
</admonition>

‘’’Additional security notice - PHP 7.2 vulnerability announced’’’

Users may also wish to review the following announcement - thank you to Matthew Bruton for bringing this to our attention:

https://thehackernews.com/2019/10/nginx-php-fpm-hacking.html

Artefactual has reviewed the report, and AtoM’s configuration does not meet the criteria for this being a security risk. Nevertheless, we recommend that PHP 7.2 users consider upgrading to PHP version [https://www.php.net/ChangeLog-7.php#7.2.24 7.2.24] if possible.

==Bug fixes and minor enhancements==

<admonition type="tip">
Issue numbers associated with new features and bug fixes listed below refer to the AtoM project [https://projects.artefactual.com/projects/atom/issues issue tracker]. Artefactual uses the issue tracker to track bug reports, development tasks, feature requirements, quality assurance testing, and related development discussion. You can use the numbers to search for the related issue ticket in our Issue tracker - often the tickets will include more information on how the feature was implemented.
</admonition>

* #13169 - Editors and translators should be able to access the physical storage module
* #13190 - Digital object metadata area header disappears when Markdown is not enabled
* #13202 - Custom groups with Create and Publish permissions cannot access the Add menu or publish descriptions

<admonition type="seealso">
For a full list of issues related to the 2.5.3 release, see the following links to our issue tracker:

* [https://projects.artefactual.com/versions/130 Release 2.5.3 Roadmap / Overview]
* [http://bit.ly/2MZpNrJ 2.5.3 issues organized by category]
</admonition>

-----

* [[Releases/Release_announcements|Back to Release announcements]]
* [[Releases|Back to Releases]]
* [[Main Page|AtoM wiki Home]]

[[Category:Releases]]

@@ Line 40: / Line 40: @@
 ===Additional security notice - PHP 7.2 vulnerability announced===
-Users may also wish to review the following announcement - thank you to Matthew Bruton for bringing this to our attention:
+Users may also wish to review the following announcement - thank you to community user Matthew Bruton for bringing this to our attention:
 * https://thehackernews.com/2019/10/nginx-php-fpm-hacking.html

@@ Line 16: / Line 16: @@
 <admonition type="note">
-Thank you to community users Kenny Pierce, Cindy Shen, and Jeremy Heil for helping to bring this issue to our attention!
+'''Thank you''' to community users Kenny Pierce, Cindy Shen, Jeremy Heil, and Chirag Prajapati for helping to bring this issue to our attention!
 </admonition>

@@ Line 29: / Line 29: @@
 Alternatively, users could apply the following commit as a patch to a 2.5.2 installation to resolve the issue in their current installation:
-https://github.com/artefactual/atom/commit/5b6b6ee95a7b89125208eb81813be07e333499af
+* https://github.com/artefactual/atom/commit/5b6b6ee95a7b89125208eb81813be07e333499af
 <admonition type="tip">
 You can add <code>.patch</code> to the commit URL above to see it in raw form as a patch that can be applied to your instance. Here's one of many online tutorials on how to work with patches using git:
 https://nithinbekal.com/posts/git-patch/
 </admonition>
@@ Line 40: / Line 42: @@
 Users may also wish to review the following announcement - thank you to Matthew Bruton for bringing this to our attention:
-https://thehackernews.com/2019/10/nginx-php-fpm-hacking.html
+* https://thehackernews.com/2019/10/nginx-php-fpm-hacking.html
 Artefactual has reviewed the report, and AtoM’s configuration does not meet the criteria for this being a security risk. Nevertheless, we recommend that PHP 7.2 users consider upgrading to PHP version [https://www.php.net/ChangeLog-7.php#7.2.24 7.2.24] if possible.