Community

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

NodeBB 2.8.7 Security Update

NodeBB Development

1 Posts 1 Posters 53 Views

B Offline

B Offline
<baris> NodeBB
wrote on last edited by

#1

A bug in our message parsing code can result in remote code execution.

Affected versions >=2.5.0 <2.8.7

We have resolved this in the latest version of NodeBB(2.8.7), and the fix has already been rolled out as a patch on all of our hosted customers.

The fix is included in the latest 2.8.7 release https://github.com/NodeBB/NodeBB/releases/tag/v2.8.7.

If you are not able to upgrade to the latest release, you can also cherry-pick or apply this commit manually https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092
1 Reply Last reply
2

Suggested Topics

E

NodeBB v1.6.0 has been released!
Scheduled Pinned Locked Moved NodeBB Development

9 Votes

10 Posts

5505 Views

A

@pitaj said in NodeBB v1.6.0 has been released!:

I suggest you try it. It has been tested with Gmail, but we haven't been able to test other providers there.

The switch offers no explanation and seems not to do anything.

The switch enables that configuration, but it only applies if an emailer plugin isn't activated.

OK, thanks for the explanation.

I think I will stick to the external SES plugin since, as far as I understand, this whole section is about using SMTP for sending e-mails which requires storing credentials in database. We use IAM roles to grant implicit permissions to use SES on instances that run our Forums - and nodebb-plugin-emailer-ses is able to pick that up.
L

Secure images for NodeBB with external camo
Scheduled Pinned Locked Moved Tutorials camo image ssl security proxy

3 Votes

6 Posts

5125 Views

T

Bringing an old thread to life again, sorry!

I'd also love some help with the instructions for running this in a Docker image. It would make life a bit easier for deploying this in DigitalOcean.
N

External Login to NodeBB
Scheduled Pinned Locked Moved Plugin Development auth security easy

0 Votes

2 Posts

2898 Views

N

Ok, question is closed 😉
I have created plugin for my needs
L

How to receive NodeBB server notification from external web socket client
Scheduled Pinned Locked Moved NodeBB Development websocket notification

0 Votes

9 Posts

3547 Views

L

@julian said:

I'm unfamiliar with C#, and we don't handle socket establishing on our end, we just let the socket.io library handle it.

Perhaps you can get a better idea by investigating the source code of this project? http://socketio4net.codeplex.com/

Hi Julian,
I am using that only. Can you provide some help on how can I connect using Chrome Web socket plugin, I mean what URL to use? That might clarify my query.

My objective of using C# is that I want to see whether I can get notifications from outside without logging into my local NodeBB application.

Thanks!
X

Multifactor Authentication e.g. Authy, Google Authenticator
Scheduled Pinned Locked Moved Feature Requests two step auth authy multifactor security

2 Votes

3 Posts

2248 Views

S

On my to-do list. But it's down there a ways.

Community

NodeBB 2.8.7 Security Update

Suggested Topics

NodeBB v1.6.0 has been released!

Secure images for NodeBB with external camo

External Login to NodeBB

How to receive NodeBB server notification from external web socket client

Multifactor Authentication e.g. Authy, Google Authenticator