Review Board 2.0.31 Release Notes¶

Security Updates¶

This release fixes two security vulnerabilities. Thanks to Dylan Ayrey for reporting and discussing these issues with us.

• URLs beginning with javascript: in text fields were being turned into clickable links, which could be used to run malicious code on a user’s behalf if clicked. We no longer convert these into links.

• Attempting to download an SVG file attachment would default to displaying it in the web browser, allowing any malicious JavaScript within the SVG to load and run on the user’s behalf when served from a standard Review Board install. (If you use a CDN hosted on a separate domain, you are not at risk.)

  We now force all file attachments to download when clicking Download or when accessing its URL directly in the browser. This applies only to new and existing Apache-based installs. If using Nginx or a custom server configuration, you will need to ensure that all uploaded media files are served with a Content-Disposition: attachment header.

We also fixed an issue that could cause uploaded file security checks in the Security Checklist page to fail.

We recommend that everyone upgrade at their earliest convenience in order to stay secure. Please also view the Security Checklist in the administration UI once you have upgraded and make sure that all tests have passed.

Upgrade Instructions¶

To upgrade to Review Board 2.0.31, run:

pip install ReviewBoard==2.0.31

or:

easy_install ReviewBoard==2.0.31

Bug Fixes¶

Contributors¶

• Christian Hammond

• Dylan Ayrey