BookStack Code Mirror - website/blob - content/blog/2021/security-release-v21-12-1.md

1 +++

2 categories = ["Releases"]

3 tags = ["Releases"]

4 title = "BookStack Security Release v21.12.1"

5 date = 2022-01-06T11:00:00Z

6 author = "Dan Brown"

7 image = "/images/blog-cover-images/unsplash/lock-jornada-produtora.jpg"

8 slug = "bookstack-release-v21-12-1"

9 draft = false

10 +++

12 BookStack v21.12.1 has been released.

13 This is a security release that better enforces permissions on book-sort &

14 chapter-move operations to address scenarios where content could be moved to

15 non-permissible locations.

17 It's advised to upgrade as soon as possible if untrusted users can update books

18 or chapters in your BookStack instance.

20 * [Update instructions](https://www.bookstackapp.com/docs/admin/updates)

21 * [GitHub release page](https://github.com/BookStackApp/BookStack/releases/tag/v21.12.1)

23 Thanks again to @haxatron for discovering and reporting this vulnerability via huntr.dev.

25 ### Full List of Changes

27 * Added timeout and debugging statuses to webhooks. ([#3139](https://github.com/BookStackApp/BookStack/pull/3139))

28 * Added new webhook_call_before logical theme system event hook. ([#3138](https://github.com/BookStackApp/BookStack/pull/3138))

29 * Updated support for APNG images to retain animation. ([#3136](https://github.com/BookStackApp/BookStack/issues/3136))

30 * Updated book sort and chapter move handling to enforce more permissions. ([#3134](https://github.com/BookStackApp/BookStack/issues/3134))

31 * Updated item-search/select box to autofocus on search field. ([#3127](https://github.com/BookStackApp/BookStack/issues/3127))

32 * Updated webhooks to not stop application on endpoint call failure. ([#3122](https://github.com/BookStackApp/BookStack/issues/3122))

33 * Updated translations with latest Crowdin changes. ([#3117](https://github.com/BookStackApp/BookStack/pull/3117))

34 * Fixed webhooks list view issue where columns would become to narrow. ([#3135](https://github.com/BookStackApp/BookStack/issues/3135))

35 * Fixed linked images showing small in PDF export. ([#3120](https://github.com/BookStackApp/BookStack/issues/3120))

36 * Fixed issue where pasting certain code blocks would cause erratic editor behavior. ([#3133](https://github.com/BookStackApp/BookStack/issues/3133))

38 ### For More Information

40 If you have any questions or comments about this advisory:

41 * Open an issue in [the BookStack GitHub repository](https://github.com/BookStackApp/BookStack/issues).

42 * Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).

43 * Follow the [BookStack security policy](https://github.com/BookStackApp/BookStack/blob/development/.github/SECURITY.md) to contact someone privately.

45 ----

47 <span style="font-size: 0.8em;opacity:0.9;">Header Image Credits: <span>Photo by <a href="https://unsplash.com/@jornadaprodutora?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Jornada Produtora</a> on <a href="https://unsplash.com/?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Unsplash</a></span></span>