Skip to main content

Uni-Verein 1.8.2 – Safer Mails, Masked IBANs, and Club Logo 🛡️✉️

· 4 min read
René Herrmann
René Herrmann
Senior developer

Published on September 30, 2026

Uni-Verein 1.8.2 continues the security work from 1.8.1: mail bodies are sanitized on the server, IBANs are masked for regular users, and changing your password now requires the current one. On top of that come a dedicated sender name for mails and the club logo in the sidebar.

Highlights​

  • 🛡️ Safer mails: Mail bodies are sanitized on the server. Only the formatting the mail editor can produce is kept, scripts, event handlers, javascript: links, forms, and iframes are stripped
  • 🔒 IBANs masked for regular users: Only ADMIN and FINANCIAL_MANAGER see full IBANs, the USER role sees them masked except for the last 6 characters
  • 🔑 Password change requires the current password: Wrong attempts count towards the login lockout
  • ✉️ Sender name for mails: New "Sender name" field in the mail settings, so mails can show up as e.g. Vorstand <vorstand@verein.de>
  • 🖼️ Club logo in the sidebar: The sidebar now shows the logo from the general settings

New Features​

  • ✉️ Sender name (UV-47): The mail settings have a new optional "Sender name" field that recipients see as the sender. Previously the "Sender email (From)" value was used as both name and address, so entering a name there made sending mails fail. The sender email field now only accepts a valid address
  • 🖼️ Club logo in the sidebar (UV-24): The logo from the general settings appears in the top-left corner of the sidebar, both expanded and collapsed. The first letter of the club name is still used when no logo is uploaded

Security​

  • 🛡️ Sanitized mail bodies (UV-17): The body of mails sent via /mail/send is sanitized server-side with HtmlSanitizer. Text, headings, lists, links, images, color, and alignment are kept. Scripts, event handlers, javascript: links, forms, and iframes are removed, and data: URLs are only allowed for inline images (no SVG). Markdown release notes in firmware update mails also no longer render raw HTML
  • 🔒 Masked IBANs (UV-26): Full IBANs of members are only returned to ADMIN and FINANCIAL_MANAGER. The USER role gets them masked except for the last 6 characters (member list, member create/update responses, and the "Pending members" review queue), so they can still check an IBAN and replace it with a new one. A masked IBAN sent back to the API is treated as unchanged and never stored
  • 🔑 Current password required (UV-30): Changing your own password now requires the current password, both in the profile settings and when an admin edits their own account in the user management. Wrong attempts count towards the login lockout. Admins can still reset other users' passwords without it
  • 🧰 The transitive build dependency serialize-javascript was bumped to 7.1.2 to fix GHSA-gfhx-hw2g-v5hg (XSS via unescaped </script> in serialized function bodies, severity low)

⚠️ Upgrade Notes​

  • Always update with docker-compose-update.yml, as described in the README
  • The database migration (AddMailFromName) runs automatically on startup. Existing mail settings keep working, the new sender name is simply empty until you set it
  • If you entered a name in "Sender email (From)" as a workaround, move it to the new "Sender name" field. The sender email field now only accepts a valid address

Why These Updates Matter​

Email is a sensitive channel: anyone sending content from the editor should be able to rely on no active code travelling along. Masked IBANs make sure that bank details are only fully visible to those who really need them, and asking for the current password protects accounts even when someone briefly sits at an unlocked computer. A sender name and the logo also make the club easier to recognize in the inbox and in the interface.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!