6 posts tagged with "security"

Published on September 30, 2026

Uni-Verein 1.8.2 continues the security work from 1.8.1: mail bodies are sanitized on the server, IBANs are masked for regular users, and changing your password now requires the current one. On top of that come a dedicated sender name for mails and the club logo in the sidebar.

Highlights​

• 🛡️ Safer mails: Mail bodies are sanitized on the server. Only the formatting the mail editor can produce is kept, scripts, event handlers, javascript: links, forms, and iframes are stripped
• 🔒 IBANs masked for regular users: Only ADMIN and FINANCIAL_MANAGER see full IBANs, the USER role sees them masked except for the last 6 characters
• 🔑 Password change requires the current password: Wrong attempts count towards the login lockout
• ✉️ Sender name for mails: New "Sender name" field in the mail settings, so mails can show up as e.g. Vorstand <vorstand@verein.de>
• 🖼️ Club logo in the sidebar: The sidebar now shows the logo from the general settings

New Features​

• ✉️ Sender name (UV-47): The mail settings have a new optional "Sender name" field that recipients see as the sender. Previously the "Sender email (From)" value was used as both name and address, so entering a name there made sending mails fail. The sender email field now only accepts a valid address
• 🖼️ Club logo in the sidebar (UV-24): The logo from the general settings appears in the top-left corner of the sidebar, both expanded and collapsed. The first letter of the club name is still used when no logo is uploaded

Security​

• 🛡️ Sanitized mail bodies (UV-17): The body of mails sent via /mail/send is sanitized server-side with HtmlSanitizer. Text, headings, lists, links, images, color, and alignment are kept. Scripts, event handlers, javascript: links, forms, and iframes are removed, and data: URLs are only allowed for inline images (no SVG). Markdown release notes in firmware update mails also no longer render raw HTML
• 🔒 Masked IBANs (UV-26): Full IBANs of members are only returned to ADMIN and FINANCIAL_MANAGER. The USER role gets them masked except for the last 6 characters (member list, member create/update responses, and the "Pending members" review queue), so they can still check an IBAN and replace it with a new one. A masked IBAN sent back to the API is treated as unchanged and never stored
• 🔑 Current password required (UV-30): Changing your own password now requires the current password, both in the profile settings and when an admin edits their own account in the user management. Wrong attempts count towards the login lockout. Admins can still reset other users' passwords without it
• 🧰 The transitive build dependency serialize-javascript was bumped to 7.1.2 to fix GHSA-gfhx-hw2g-v5hg (XSS via unescaped </script> in serialized function bodies, severity low)

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README
• The database migration (AddMailFromName) runs automatically on startup. Existing mail settings keep working, the new sender name is simply empty until you set it
• If you entered a name in "Sender email (From)" as a workaround, move it to the new "Sender name" field. The sender email field now only accepts a valid address

Why These Updates Matter​

Email is a sensitive channel: anyone sending content from the editor should be able to rely on no active code travelling along. Masked IBANs make sure that bank details are only fully visible to those who really need them, and asking for the current password protects accounts even when someone briefly sits at an unlocked computer. A sender name and the logo also make the club easier to recognize in the inbox and in the interface.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 26, 2026

Uni-Verein 1.8.1 is a security release: the installation gets HTTPS out of the box, the login becomes much more resistant to attacks, uploads are checked more strictly, and all containers now run without root privileges.

Highlights​

• 🔐 HTTPS out of the box: A new docker-compose-tls.yml plus Caddyfile puts Caddy in front of the stack and automatically fetches a Let's Encrypt certificate. This is now the recommended installation path
• 🛡️ Hardened login: Per-IP rate limiting, no more hints about whether a username exists, and lockouts last at most 15 minutes instead of up to 24 hours
• 🔑 No more default admin password in use: Logging in with admin123 now forces you to set a new password first
• 📦 Safer uploads and containers: Receipt files are checked by their actual content, upload sizes are capped, and every container runs as a non-root user

New Features​

• 🔐 HTTPS with Let's Encrypt (UV-27): docker-compose-tls.yml and Caddyfile set up automatic HTTPS (requires a DNS record plus ports 80 and 443). The self-update flow detects and supports both setups and also updates the Caddyfile. nginx recovers the real client IP behind Caddy, so rate limiting and audit logs keep working
• 🚦 Login rate limiter (UV-31): /auth/login is limited per IP address (default 20 requests per window, configurable via RateLimiting:AuthLogin:PermitLimit)
• 🔑 Forced password change (UV-25): Logging in with the default password admin123 opens a dialog that can't be dismissed until a new password is set
• 🔍 Automated dependency checks (UV-42): npm audit --audit-level=high runs in CI, plus Dependabot (one bundled weekly PR, no major updates)

Improvements​

• 🔒 Authentication by default (UV-41): Endpoints now require authentication by default. Intentionally public ones (login, self-enrollment, public page configuration, /health) are explicitly allowed
• ⏱️ Fairer lockouts (UV-45): Failed login attempts expire after 15 minutes, and the lockout is capped at 15 minutes (previously up to 24 hours)
• 👤 Admin protection (UV-25): The default admin account is only created when no users exist at all. Admins can no longer delete their own account or change their own role
• 🧾 Uploads checked by content (UV-32): Receipt files are validated by their magic bytes (PNG, JPEG, GIF, WebP, PDF) instead of the type reported by the browser. SVG and unknown formats are rejected. Downloads send X-Content-Type-Options: nosniff and Content-Disposition: attachment
• 📏 Upload limits (UV-43): The global request limit drops from 10 GB to 100 MB, only the backup restore keeps 10 GB. Receipt files and the CSV import of members are capped at 10 MB per file, and oversized PDFs are rejected right in the browser
• 🧱 Security headers (UV-33): Both nginx configs send CSP, X-Frame-Options, nosniff, Referrer-Policy, and Permissions-Policy
• 🌐 CORS (UV-28): Allowed origins are configured via Cors:AllowedOrigins (empty in production) instead of allowing any localhost origin
• 🔗 Safe confirmation links (UV-35): Self-enrollment links use a stored PublicBaseUrl instead of the request's Host header, preventing phishing links via forged hosts
• 📦 Containers without root (UV-37): All containers run as non-root users, with cap_drop: [ALL] and no-new-privileges where possible
• 🗝️ Secrets (UV-38, UV-39): The init script generates random database passwords and only prints the names of the .env keys, not their values. .env.example ships placeholders only instead of real keys
• 🧰 Dependencies (UV-40): Serilog.Sinks.File is pinned to the stable 7.0.0, the unused BCrypt.Net-Next was removed, plus minor/patch updates for backend and frontend

Fixes​

• 🖥️ Blank screen after login (UV-18): After an update, stale lazily-loaded parts of the app could cause an empty screen. The app now reloads automatically when a new service worker takes over
• 🔔 Firmware hint (UV-46): The firmware-update hint now compares real version numbers and only shows when a newer version actually exists
• 🕵️ Username enumeration (UV-44): Login response timing no longer reveals whether a username exists. Raw usernames are no longer written to the log
• 🌍 Forged IP headers (UV-34): X-Real-IP is only trusted from private/internal networks, so IP-based rate limits can no longer be bypassed with a spoofed header

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README. Proxy and frontend now listen on port 8080 inside the container (the host port stays 80), so nginx.conf and the compose file have to be replaced together. The update script does this for you
• logs/ and receipts/ must be writable by the non-root backend (UID 1654). The update script handles this via docker-compose-ini.yml. On a manual setup, run chown -R 1654:1654 logs receipts
• Self-enrollment users: If self-enrollment was already enabled before this update, an admin has to open the general settings and save them once. This stores the public URL used in confirmation links. Until then, new submissions fail
• The database migration (AddLastFailedLoginAttemptAndPublicBaseUrl) runs automatically on startup

Why These Updates Matter​

A club management system holds names, addresses, and bank details, so it should be run as securely as possible. With HTTPS out of the box, a more robust login, and stricter checks for uploads and network access, 1.8.1 closes a whole series of possible attack surfaces at once. Running the containers without root privileges also limits the damage should something ever go wrong.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 5, 2026

Uni-Verein 1.7.0 makes onboarding new members easier: prospective members can now sign themselves up through a public form, no account needed. This release also ships important security updates for a couple of dependencies.

New Features​

• 📝 Self-enrollment: A new, publicly reachable form lets prospective members sign themselves up as a member, no account required
• 🔒 Server-enforced hidden fields: Data that only users may set or that is assigned automatically (task within the club, date fields, SEPA consent) is hidden from the public form and enforced server-side
• 🚫 Duplicate checks: Email address and IBAN are checked for duplicates just like when an user creates a member, and rejected on a match
• 🔗 "Self-enrollment" toggle: A new setting in the general club settings that turns the public form on or off, including a button to directly share the link

Improvements​

• 🧩 Member-creation logic was consolidated into a shared MemberService.CreateMemberAsync instead of being duplicated between user creation and self-enrollment
• 🧩 Recurring EF Core queries were unified behind a new ReferenceDataService
• 🌐 frontend/nginx.conf now serves the SPA with a try_files fallback to index.html

Security​

• 🔐 Updated the fast-uri and @tiptap/* dependencies, closing four High-severity SSRF/host-confusion advisories and one Moderate-severity prototype-pollution-to-XSS advisory

Why These Updates Matter​

Self-enrollment takes a lot of manual work off a club board's plate: instead of creating every new member one by one, you simply share the form's link and prospective members enter their own details. Server-enforced fields and the duplicate checks keep data quality on par with an admin-created member. The security updates also close known vulnerabilities in dependencies the project relies on.

What's Next?​

As always, feedback and feature requests are very welcome via GitHub Issues. Check back here again soon!

Published on July 26, 2026

Just one day after 1.3.0, Uni-Verein 1.3.1 follows with a clear focus: noticeably better frontend performance and an important security fix.

Improvements​

• 🚀 Lazy loading of frontend routes: Page components (Mail, Members, SEPA, Contributions, user/link/contribution-plan/email/creditor/general/member-category configuration, Audit, Backup) are now loaded on demand instead of being bundled into the initial payload, the main bundle shrinks from about 1.4 MB to about 577 kB
• 🖼️ The icon picker ("Select icon") now caps the number of rendered icon tiles at 250 and prompts for a more specific search beyond that, instead of mounting all ~8,600 icons at once, this previously froze the UI for over a second every time the dialog was reopened
• ⏳ The icon picker now waits for icons to be fully loaded/cached before revealing the grid, showing a loading spinner in the meantime instead of an empty or partially populated dialog
• 🧹 IconPickerDialog.tsx no longer redundantly dynamically imports muiIcons for loadIconNames when it's already imported statically elsewhere, resolving a Vite build warning and allowing the module to be chunked correctly
• ⚙️ The enforce-source-branch CI job from 1.3.0 now also runs for pull requests targeting development, so merging main back into development isn't blocked by a status check that previously only evaluated PRs targeting main

Bug Fixes​

• 🐛 Vite's chunk-size warning for the @mui/icons-material barrel (loaded on demand by the icon picker) is now suppressed via chunkSizeWarningLimit, since that chunk is expected to be large and is never part of the initial page load

Security​

• 🔐 Bumped the brace-expansion npm override to ^5.0.8 to close a high-severity ReDoS advisory (exponential-time expansion of consecutive non-expanding {} groups); the previous override version had drifted out of sync with the lockfile and a duplicate vulnerable copy remained nested under filelist

Why These Updates Matter​

The icon picker in particular had felt noticeably sluggish, thanks to lazy loading and capping the number of rendered icons, the UI now responds much more smoothly. The smaller main bundle also means Uni-Verein loads faster, especially on mobile connections. The ReDoS fix additionally closes a high-severity vulnerability in a transitive dependency.

What's Next?​

This performance work pays off directly in the user experience. Bigger feature additions are up next. Check back soon!

Published on July 25, 2026

Uni-Verein 1.3.0 brings a handy new search feature for sending newsletters, along with a number of under-the-hood improvements that make deployments and CI runs more reliable.

New Features​

• 🔍 Name search in the Broadcast email "Recipient" tab: Recipients can now be filtered by first or last name (fuzzy, Jaro-Winkler similarity), in addition to the existing member category filter
• ❤️ /health endpoint: A new unauthenticated GET /health endpoint plus Docker HEALTHCHECKs for backend and frontend

Improvements​

• 🩺 backend, frontend, and proxy now have proper health checks (previously only the database did), and each service waits for its dependencies to be actually ready (service_healthy) instead of just started, across all docker-compose*.yml files
• 🚦 CI now fails immediately with container logs attached when the stack doesn't become healthy in time, instead of silently continuing on to the Playwright tests and failing there with no diagnostics
• ⏱️ Increased the database health check's retry budget to tolerate occasional slow first-time initialization on CI runners
• 📝 .env.example now lists BACKUP_PATH, matching every value docker-compose-ini.yml generates
• 🔒 CI now enforces that PRs into main may only come from development (new enforce-source-branch job)

Bug Fixes​

• 🐛 The newsletter recipient category dropdown showed the raw translation key instead of the category name for custom (non-default) member categories
• 🐛 The proxy container could stay unhealthy indefinitely because its health check resolved localhost to IPv6 while nginx.conf only listens on IPv4
• 🐛 The backend Docker image build occasionally failed due to transient package-mirror errors during apt-get install

Security​

• 🔐 Pinned sharp to ^0.35.3 via npm overrides to pull in a fixed version instead of the vulnerable transitive one

Why These Updates Matter​

The name search saves a lot of time for larger organizations that need to quickly find individual newsletter recipients. Just as important are the health check improvements: they make deployments start up more reliably and surface CI problems immediately with meaningful logs, instead of only showing up late and without context.

What's Next?​

Work on performance and infrastructure continues, the next release already focuses on noticeably faster load times.

Published on July 12, 2026

Just a few days after the big release of the first version, the first update has already arrived: Uni-Verein 1.0.1 is here. This time it's a small but important security update.

What Changed?​

A security vulnerability (CVE-2026-33630) was identified in the frontend's Docker image. This update adjusts the underlying Dockerfile to close the vulnerability.

• 🔒 Security fix: Updated the frontend Dockerfile to resolve CVE-2026-33630

Why Does This Matter?​

Since Uni-Verein is used by organizations with sensitive member data, the security of the software is a top priority for me. Security updates like this one are therefore rolled out as quickly as possible whenever known vulnerabilities are identified.