Repository navigation
feat(security): remove remember-me login - #1798
Merged
Merged
Conversation
Authentication::Login() saved the user with UserRepository::Update(), which rewrites most users columns and all preferences from the copy loaded at the start of the login. A password change, deactivation, credit adjustment or preference change made between that load and the save was silently reverted. Add IUserRepository::UpdateLoginData(), which writes only lastlogin, last_modified, the language chosen at login, and the generated public_id when the user had none. Authentication::Login() now uses it. A login that chooses no language leaves the stored language alone instead of writing back the loaded one. Add database integration tests that change the user's row between the login's load and its save, and check that the change survives. Assisted-by: Claude:claude-opus-5-5
Remove the "Remember Me" option from the login page, together with the persistent login cookie behind it. The cookie could not be made safe without a redesign, so this release removes the feature rather than patching it. Users must authenticate again once their normal application session is unavailable. A persist_login cookie left over from an earlier release is never read. Logout still expires it. For authentication plugin authors: - IWebAuthentication::CookieLogin() is removed. Plugins implement IAuthentication and were never required to provide it. - IAuthentication::ShowPersistLoginPrompt() is kept so that existing plugins continue to load, and is marked deprecated. Its result is no longer used. - LoginData::$Persist and the matching constructor argument are kept and marked deprecated. The value is ignored. - FormKeys::PERSIST_LOGIN is kept and marked deprecated. A login template compiled by an earlier release still resolves it, so the login page keeps working until tpl_c is cleared. Update the plugin guide and the authentication plugin readme to match. Assisted-by: Claude:claude-opus-5-5
Booking from the resource display identifies the user by the email address typed there. To find that user the display called the login routine, which recorded a login for the account even though nobody had authenticated as that user. Look the account up read-only instead and build the booking session without logging in. An account that exists but is not active is now refused: it is neither logged in nor replaced by a new guest account. An unknown email address still creates a guest account as before. The booking is attributed to the same user, with the same roles, as before. Assisted-by: Claude:claude-opus-5-5
A reservation made through the resource display took the resource's internal id straight from the request and never checked that the resource was enabled for display. Any resource could be booked that way, not only the one shown on the tablet. Identify the resource by its public id, the same way the display does, and refuse the reservation unless that resource is enabled for display. The check runs before any guest account or reservation is created, so a request naming any other resource has no effect. The authenticated setup actions keep using the internal id and are unchanged. Assisted-by: Claude:claude-opus-4-8
Use a restricted copy of the booking session and prevent stored roles from restoring administrative permissions or exemptions. Preserve ownership, ordinary permissions, and authenticated sessions. Add regression coverage across all four administrative roles. Assisted-by: Codex:GPT-6
The README announced a security release for 13 October 2026 without saying what it fixed. That release is LibreBooking 7.1.0, so replace the announcement with the upgrade notice. The notice tells administrators to upgrade to 7.1.0 or later, says that the release removes the "Remember Me" option, gives the workaround for installations that cannot upgrade right away, and links to security advisory GHSA-mvjx-72w3-wqhp. The notice for the earlier 7.0.0 security release is unchanged. Assisted-by: Claude:claude-opus-5-5 Closes: #1779
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security release. Details in the advisory once published.