search

cognizance-amrita / cognizance_cms

An open-source club management system of the club, by the club, for the club.
https://cognizance-amrita.herokuapp.com
GNU Lesser General Public License v2.1
7 stars 11 forks source link

Bump flask-security-too from 3.4.2 to 3.4.5 #16

Closed dependabot[bot] closed 3 years ago

dependabot[bot] commented 3 years ago

Bumps flask-security-too from 3.4.2 to 3.4.5.

Release notes

Sourced from flask-security-too's releases.

Fix CSRF Vulnerability

The /login and /change endpoints allowed a GET request to return the users authentication token. That's not good. Now, as prior to 3.3.0, only successful POSTs can return the token.

Release 3.4.4

Fix 3 regressions and a couple other bugs.

Release 3.4.3

Fix a regression in two-factor.

Backport some documentation fixes.

Changelog

Sourced from flask-security-too's changelog.

Version 3.4.5

Released January 8, 2021

Security Vulnerability Fix.

Two CSRF vulnerabilities were reported: qrcode_ and login_. This release fixes the more severe of the 2 - the /login vulnerability. The QRcode issue has a much smaller risk profile since a) it is only for two-factor authentication using an authenticator app b) the qrcode is only available during the time the user is first setting up their authentication app. The QRcode issue has been fixed in 4.0.

.. _qrcode: Flask-Middleware/flask-security#418 .. _login: Flask-Middleware/flask-security#421

Fixed +++++

  • (:issue:421) GET on /login and /change could return the callers authentication_token. This is a security concern since GETs don't have CSRF protection. This bug was introduced in 3.3.0.

Backwards Compatibility Concerns ++++++++++++++++++++++++++++++++

  • (:issue:421) Fix CSRF vulnerability on /login and /change that could return the callers authentication token. Now, callers can only get the authentication token on successful POST calls.

Version 3.4.4

Released July 27, 2020

Bug/regression fixes.

Fixed +++++

  • (:issue:359) Basic Auth broken. When the unauthenticated handler was changed to provide a more uniform/consistent response - it broke using Basic Auth from a browser, since it always redirected rather than returning 401. Now, if the response headers contain WWW-Authenticate (which is set if basic @​auth_required method is used), a 401 is returned. See below for backwards compatibility concerns.

  • (:pr:362) As part of figuring out issue 359 - a redirect loop was found. In release 3.3.0 code was put in to redirect to :py:data:SECURITY_POST_LOGIN_VIEW when GET or POST was called and the caller was already authenticated. The method used would honor the request next query parameter. This could cause redirect loops. The pre-3.3.0 behavior of redirecting to :py:data:SECURITY_POST_LOGIN_VIEW and ignoring the next parameter has been restored.

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/cognizance-amrita/cognizance_cms/network/alerts).
dependabot[bot] commented 3 years ago

Looks like flask-security-too is no longer a dependency, so this is no longer needed.