public web root, full migration to composer, PHP 8.2 minimum), a large number of security fixes and bugfixes. You can find full changelog below, please read it. You can download it on github.
Important notes:
- Please read upgrade guide and UPDATE.md before upgrading!
- As usual backup your database before upgrade.
- Minimum required PHP version is now 8.2.0.
- HTML files have been moved to the 'public' folder - webserver document root must be updated accordingly.
- Git submodules have been removed, dependencies are now fully managed by composer.
- API controllers have been moved to 'functions/api/controllers' folder.
- Support for mcrypt has been removed.
- This release contains many security fixes, upgrade is highly recommended.
Donations
If you find phpIPAM useful for your company donation would be highly appreciated to support further development of phpIPAM software!
If you find phpIPAM useful for your company donation would be highly appreciated to support further development of phpIPAM software!
Special thanks to all the people submitting bug reports, translators and feature testers, and of course special thanks to @GarryAllan for his work on this relase and squashing bugs !
Full changelog for this release is:
== 1.9.0
Bugfixes:
----------------------------
+ PHP8 compatibility fixes;
+ Rack SVG image errors (#4595);
+ Rack dropdown fails to populate while editing a device (#4602);
+ Dynamic authentication API endpoints returns 409 (#4640);
+ Passkey enrolment issues;
Enhancements, changes:
----------------------------
+ Minimum PHP version raised to 8.2.0;
+ HTML files moved to 'public' folder (see UPDATE.md);
+ API controllers moved to 'functions/api/controllers' folder (see UPDATE.md);
+ Removed git submodules, full migration to composer (see UPDATE.md);
+ Removed support for mcrypt;
+ Open MySQL connections with Pdo\Mysql::ATTR_MULTI_STATEMENTS=false;
+ 2FA and passkey improvements;
Security Fixes:
----------------------------
+ API authentication bypass via object cache key collision;
+ Disabled API endpoints still accessible;
+ API read only permission bypass;
+ API controller arbitrary local file inclusion;
+ Temporary shares can enumerate all addresses;
+ Temporary share creation, missing permission checks;
+ Temporary share creation, missing CSRF checks;
+ Second-Order SQL injection in custom field reordering;
+ Second-Order SQL injection in NAT fields;
+ Custom field reordering, missing CSRF checks;
+ Subnet permissions can be rewritten by any authenticated user;
+ Cross subnet and ping insecure direct object references;
+ 2FA activation, bypass CSRF checks;
+ Insecure direct object references (x2);
+ Reflected Cross-Site Scripting (XSS) in /upgrade/index.php;
+ Reflected Cross-Site Scripting (XSS) in show-rack-popup.php;
+ Favourites, missing permission and CSRF checks;
+ Passkey enrolment can bypass TOTP;
Translations:
----------------------------
+ Updated Ukrainian translation (#4669);
br, Miha
