Release 0.1.258

Date 2024-06-06

Mulberry v2.0.1.258 introduces library field reordering, system-wide task labeling, and security enhancements to prevent XSS attacks and bot crawling.

Release Notes

New Features:
  • You can now reorder library fields in Mulberry libraries to better suit your needs.
  • When performing an action, the recipient's role name is now displayed, even if the recipient is a vacancy with a predefined replacement.
  • System-wide task labeling is now available, in addition to user-wide labeling.
Improvements:
  • Library references have been refactored to store referred library names as foreign keys instead of IDs, improving data integrity.
  • We've added a robots.txt file to prevent bots from crawling installations, improving security.
  • We've cleaned up "undefined" settings from accounts' settings to avoid synchronization and storage overheads.
Security Enhancements:
  • We've improved login validation responses to ensure consistency across all error types.
  • We've fixed several stored XSS vulnerabilities in task action-comments views, tooltips, and address book logos.
  • We've refactored file download handlers to avoid filename mutations and implemented filename sanitization.
  • We've improved XSS sanitization on user-created action comments fields and detected XSS payloads in web-service endpoints.
Bugs:
  • This release fixes several issues with search functionality, attachment editing, task visibility, and UI rendering to improve overall system reliability and user experience.