admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security review: F13 to F17 (customer contact isolation) fixed in 8.3.0

Browse Source 
John's decision: urgent, "next release" cases before 8.3.0; hosted and
self-hosted installations equally. Recorded in SECURITY-REVIEW.md and in the
NET10-PORT.md list of cases for this release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-23 19:55:50 -07:00
parent 2004bf197a
commit ee6def1932
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -205,6 +205,11 @@ Status: *candidate* (seen in code, not yet confirmed), *confirmed*, *fixed in ca
| F11 | Low | confirmed | API root page shows licensee, version, licence terms (and DB ID when unlicensed) to anyone |
| F12 | Low | confirmed | Password hashing: PBKDF2-SHA512 with 10,000 iterations |
**Release decisions.** John, 2026-10-23: **F13 to F17 are urgent and are fixed in 8.3.0**, as
"next release" cases (case numbers to come). Hosted and self-hosted perpetual installations
matter equally; how many use customer contact logins is unknown, so every installation is
assumed to. F5, F1 and F18 are recommended for 8.3.0 as well; awaiting John's decision.
### F5 2FA step skips the password (pass 2, confirmed on the local server)
`AuthController.TfaAuthenticate` (`POST auth/tfa-authenticate`, anonymous) finds the user