diff --git a/CHANGELOG.md b/CHANGELOG.md index 35b218e734362076075fe34079639c2e585258b5..389ec917bb2460c29e0b4fb7e54eac4d8aac63fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,34 @@ # Changelog +## 2.3.2 +This release fixes a security vulnerability in the account management API. It is +highly recommended to upgrade if you are using database authentication. + +Additional changes: +* Libraries have been upgraded to fix potential bugs + +## 2.2.1 +This release fixes a security vulnerability in the account management API. It is +highly recommended to upgrade if you are using database authentication. + +Additional bug fixes: +* The `security.authentication.login-try-limit` setting now works as intended. + +## 2.1.1 +This release fixes a security vulnerability in the account management API. It is +highly recommended to upgrade if you are using database authentication. + +Additional changes: +* Libraries have been upgraded to fix potential bugs + +## 2.0.3 +This release fixes a security vulnerability in the account management API. It is +highly recommended to upgrade if you are using database authentication. + +Additional changes: +* Libraries have been upgraded to fix potential bugs +* Some unnecessary log warnings for Websocket communication are filtered + ## 2.3.1 Bug fixes: * Case-insensitive user IDs are now correctly handled for LDAP authentication. diff --git a/pom.xml b/pom.xml index ab0ad876709976976017f35a68a6844b173e4c95..4c62b984aa188b2c736bc3b33b29cc44ffa14d44 100644 --- a/pom.xml +++ b/pom.xml @@ -7,7 +7,7 @@ <packaging>war</packaging> <properties> - <io.spring.platform-version>2.0.4.RELEASE</io.spring.platform-version> + <io.spring.platform-version>2.0.5.RELEASE</io.spring.platform-version> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <timestamp>${maven.build.timestamp}</timestamp> <sonar.language>java</sonar.language> @@ -290,7 +290,7 @@ <dependency> <groupId>io.swagger</groupId> <artifactId>swagger-annotations</artifactId> - <version>1.5.8</version> + <version>1.5.9</version> </dependency> </dependencies> diff --git a/src/main/java/de/thm/arsnova/controller/UserController.java b/src/main/java/de/thm/arsnova/controller/UserController.java index 7afea39cada90db1e2cbd640d7576973a1dece5a..032bf264487b6435455e4504abea6a3cca1bb2cb 100644 --- a/src/main/java/de/thm/arsnova/controller/UserController.java +++ b/src/main/java/de/thm/arsnova/controller/UserController.java @@ -81,7 +81,7 @@ public class UserController extends AbstractController { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); } - @RequestMapping(value = { "/{username}" }, method = RequestMethod.DELETE) + @RequestMapping(value = { "/{username}/" }, method = RequestMethod.DELETE) public void activate( @PathVariable final String username, final HttpServletRequest request, diff --git a/src/main/java/de/thm/arsnova/services/UserService.java b/src/main/java/de/thm/arsnova/services/UserService.java index f672b74141523879a6911d29f82c2f938f8afc6c..7b1fa751189784f5cda04dfe01a33f12b1616b60 100644 --- a/src/main/java/de/thm/arsnova/services/UserService.java +++ b/src/main/java/de/thm/arsnova/services/UserService.java @@ -426,7 +426,7 @@ public class UserService implements IUserService { public DbUser deleteDbUser(String username) { User user = getCurrentUser(); if (!user.getUsername().equals(username) - && SecurityContextHolder.getContext().getAuthentication().getAuthorities() + && !SecurityContextHolder.getContext().getAuthentication().getAuthorities() .contains(new SimpleGrantedAuthority("ROLE_ADMIN"))) { throw new UnauthorizedException(); }