Change:
, CVSSv3=7.5 (nixos-unstable) CVSSv3=5.3 (nixos-unstable) CVSSv3=5.3 (nixos-unstable) In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication. In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. Scanned versions: nixos-unstable: . Cc

Discussion:
version = src.version; src = pkgs.invoiceplane; <del> patchPhase = '' </del> <ins> postPhase = '' </ins> # Patch index.php file to load additional config file substituteInPlace index.php  <del> --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); $dotenv = new DotenvDotenv(__DIR__, 'extraConfig.php'); $dotenv->load();"; </del> <ins> --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); $dotenv = DotenvDotenv::createImmutable(__DIR__, 'extraConfig.php'); $dotenv->load();"; </ins> ''; installPhase = ''

services.invoiceplane.webserver = "caddy"; services.invoiceplane.sites = { "site1.local" = { <del> #database.name = "invoiceplane1"; </del> <ins> database.name = "invoiceplane1"; </ins> database.createLocally = true; enable = true; }; "site2.local" = { <del> #database.name = "invoiceplane2"; </del> <ins> database.name = "invoiceplane2"; </ins> database.createLocally = true; enable = true; };

stdenv.mkDerivation rec { pname = "invoiceplane"; <del> version = "1.5.11"; </del> <ins> version = "1.6-beta-1"; </ins> src = fetchurl { url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip"; <del> sha256 = "137g0xps4kb3j7f5gz84ql18iggbya6d9dnrfp05g2qcbbp8kqad"; </del> <ins> sha256 = "sha256-hIbk9zzqbwv2kSFClgPfTObB1YHj7KR4swKjGoN2v2E="; </ins> }; <del> patches = [ # Fix CVE-2021-29024, unauthenticated directory listing # Should be included in a later release > 1.5.11 # https://github.com/NixOS/nixpkgs/issues/166655 # https://github.com/InvoicePlane/InvoicePlane/pull/754 (fetchpatch { url = "https://patch-diff.githubusercontent.com/raw/InvoicePlane/InvoicePlane/pull/754.patch"; sha256 = "sha256-EHXw7Zqli/nA3tPIrhxpt8ueXvDtshz0XRzZT78sdQk="; }) # Fix CVE-2021-29023, password reset rate-limiting # Should be included in a later release > 1.5.11 # https://github.com/NixOS/nixpkgs/issues/166655 # https://github.com/InvoicePlane/InvoicePlane/pull/739 (fetchpatch { url = "https://patch-diff.githubusercontent.com/raw/InvoicePlane/InvoicePlane/pull/739.patch"; sha256 = "sha256-6ksJjW6awr3lZsDRxa22pCcRGBVBYyV8+TbhOp6HBq0="; }) # Fix CVE-2021-29022, full path disclosure # Should be included in a later release > 1.5.11 # https://github.com/NixOS/nixpkgs/issues/166655 # https://github.com/InvoicePlane/InvoicePlane/pull/767 #(fetchpatch { #  url = "https://patch-diff.githubusercontent.com/raw/InvoicePlane/InvoicePlane/pull/767.patch"; #  sha256 = "sha256-rSWDH8KeHSRWLyQEa7RSwv+8+ja9etTz+6Q9XThuwUo="; #}) ]; </del> nativeBuildInputs = [ unzip ]; sourceRoot = "."; installPhase = '' mkdir -p $out/ <del> cp -r . $out/ </del> <ins> cp -r ip/. $out/ </ins> ''; passthru.tests = {