publify_core 11.0.0 → 11.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ce0abf6a55254193cdc6475dd86481f250201069155275d9178b17f87fb5e9e
-  data.tar.gz: fe986ec81f387a6bd29a91a7be4d62d7f3655bbd19523ad12c02ba4e1b7cf292
+  metadata.gz: 16a87fd4d120dd099f95cf2a12b656ae5f6499f8f00a6ab3508dab3d348265e2
+  data.tar.gz: c38df0645ff6406bc290db81d899b3edc0a9e6fa982fad8b0ade600600530e1d
 SHA512:
-  metadata.gz: 93aaa5759263e4e8fb3fe8cb56f33e3469a0ed085503e10d6b37c12c6ca45816c56f567424283ea171d8109b0968679b4cebf0fc97c0217db32172dcb095ca1d
-  data.tar.gz: 1d954da004caa610dd8f306f5c482a415887cde00f9b0a2ad4ea7e2d5ab67ade36bb3f90826071ac101d1f7e7525d435724e5f5bc89cc7ec52c97be19c0573cb
+  metadata.gz: cefee755bf83488c84cb9ed7d67c77d6bfb5f93c4645dc62e2d6f7de7e7877be4fce12f4afccdd406cde14e613af5730fec6bdf6926c4c3715e6bad79d8faaaa
+  data.tar.gz: 8a80743ba80d26b1673e6f96ce471583ffafab0097de14417b08e7b58281ce230150887dab2c4cef537c0d4d9d6fc2111e79d3e63558fe7f3f3e9fcbd5d49bd3

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 11.0.2 / 2026-10-31
+
+This release fixes a security issue in the article password checker which could
+expose the contents of unpublished articles.
+
+* Only allow password check for published articles ([#275] by [mvz])
+
+[#275]: https://github.com/publify/publify_core/pull/275
+
+## 11.0.1 / 2026-10-23
+
+This release fixes a security issue where a user with publisher role can update
+any other user's articles.
+
+* Support Rails 8.0 ([#270] by [mvz])
+* Update `mini_magick` dependency ([#271] by [mvz])
+* Support Rails 8.1 ([#272] by [mvz])
+* Check user update rights in admin article create action ([#274] by [mvz])
+
+[#270]: https://github.com/publify/publify_core/pull/270
+[#271]: https://github.com/publify/publify_core/pull/271
+[#272]: https://github.com/publify/publify_core/pull/272
+[#274]: https://github.com/publify/publify_core/pull/274
+
 ## 11.0.0 / 2026-10-04
 
 This major release updates Rails to version 7.2, and updates supported Ruby

data/app/controllers/admin/articles_controller.rb

@@ -37,7 +37,10 @@ class Admin::ArticlesController < Admin::BaseController
 
   def create
     article_factory = Article::Factory.new(this_blog, current_user)
-    @article = article_factory.get_or_build_from(params[:article][:id])
+    id = params[:article][:id].presence
+    return if id && !access_granted?(id)
+
+    @article = article_factory.get_or_build_from(id)
 
     update_article_attributes
 

data/app/controllers/articles_controller.rb

@@ -67,8 +67,13 @@ class ArticlesController < ContentController
   def check_password
     return unless request.xhr?
 
-    @article = Article.find(params[:article][:id])
-    if @article.password == params[:article][:password]
+    form_params = params.require(:article).permit(:id, :password)
+
+    @article = this_blog.published_articles.find(form_params[:id])
+    expected = @article.password
+    actual = form_params[:password]
+
+    if ActiveSupport::SecurityUtils.secure_compare(expected, actual)
       render partial: "articles/full_article_content", locals: { article: @article }
     else
       render partial: "articles/password_form", locals: { article: @article }

data/lib/publify_core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PublifyCore
-  VERSION = "11.0.0"
+  VERSION = "11.0.2"
 end

data/lib/tasks/appraisal.rake

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+namespace :appraisal do
+  desc "Check appraisals"
+  task :check do
+    Appraisal::AppraisalFile.each do |appraisal|
+      existing = File.read(appraisal.gemfile_path)
+      signature = Appraisal::Customize.heading || "This file was generated by Appraisal"
+      header = appraisal.send :comment_lines, signature
+      body = appraisal.send :quoted_gemfile
+      expected = [header, body].join("\n\n")
+      raise "Outdated appraisal: #{appraisal.name}" unless existing.chomp == expected.chomp
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: publify_core
 version: !ruby/object:Gem::Version
-  version: 11.0.0
+  version: 11.0.2
 platform: ruby
 authors:
 - Matijs van Zuijlen
@@ -278,20 +278,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.9'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 4.9.4
+        version: '5.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.9'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 4.9.4
+        version: '5.4'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -329,7 +323,7 @@ dependencies:
         version: 7.1.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -339,7 +333,7 @@ dependencies:
         version: 7.1.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: rails_autolink
   requirement: !ruby/object:Gem::Requirement
@@ -882,6 +876,7 @@ files:
 - lib/sidebar_field.rb
 - lib/sidebar_registry.rb
 - lib/spam_protection.rb
+- lib/tasks/appraisal.rake
 - lib/tasks/publify_core_tasks.rake
 - lib/text_filter_plugin.rb
 - lib/theme.rb
@@ -908,7 +903,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.22
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Core engine for the Publify blogging system.
 test_files: []