Community

NodeBB 2.8.7 Security Update

NodeBB Development

Suggested Topics

  • barisB

    NodeBB 2.8.1 Security Update

    Moved NodeBB Development
    3 Votes
    4 Posts
    286 Views
    barisB

    It is basically the same vulnerability exploited with a different socket call. The initial fix in 2.6.1 only prevented a specific case, the fix in 2.8.1 should cover all cases.
    You can either upgrade to 2.8.1 or only get the changes from the specific commit.

  • gotwfG

    nodebb, nginx, and modsecurity?

    Technical Support
    2 Votes
    5 Posts
    556 Views
    gotwfG

    Maybe not a lot of interest in this due to complexity of deploying/configuring ModSecurity, combined w/absence of nodebb stack specific rulesets. Security is difficult so not much can be done about the deploy/config aspects but ModSecurity devs are starting to focus some efforts on the latter.

    For those interested, and willing to roll up their sleeves, development of node.js targeted attack ruleset is slated for next release of OWASP CRS, scheduled for Sept. 2019. More info here:

    https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1487#issuecomment-519071541

    P.S.; Obviously ModSecurity can be deployed on Apache setups as well but my sense is that Nginx is the overwhelming favorite w/the nodebb community and I didn't want to start a new thread.

  • DravereD

    How to add a skin for NodeBB Persona

    Moved NodeBB Development
    0 Votes
    4 Posts
    1653 Views
    djensen47D

    I'd like to do the same. For instance, some folks don't like round avatars, so I would override the CSS for that. Other folks want zero color, so I'd make a monochrome skin.

  • X

    Multifactor Authentication e.g. Authy, Google Authenticator

    Feature Requests
    2 Votes
    3 Posts
    2255 Views
    ShardS

    On my to-do list. But it's down there a ways.

  • D

    Security logging?

    NodeBB Development
    0 Votes
    3 Posts
    2001 Views
    D

    Yeah, events.js seems like it should contain the functionality for this. It currently only logs UID, but a lot of those functions should probably log the IP of the triggering party as well.

    It seems like the only way to do that is to have IP be a parameter for most of those calls. That's a little tedious.

    my fantasy: events are logged to the db as well as flatfile, have severity/importance levels, contain as much info as possible about who triggered it if the logging fn is passed a socket or request object, there's hooks for events of high severity, by default sends email or notification to admins when high-sev occurs

Copyright © 2023 NodeBB | Contributors