diff --git a/config.json b/config.json
index c8e7e68..fce0eb9 100644
--- a/config.json
+++ b/config.json
@@ -14,7 +14,7 @@
"enableDirectoryListingWithDefaultHead": false,
"serverAdministratorEmail": "[no contact information]",
"stackHidden": false,
- "enableRemoteLogBrowsing": true,
+ "enableRemoteLogBrowsing": false,
"exposeServerVersion": true,
"disableServerSideScriptExpose": true,
"rewriteMap": [
@@ -96,4 +96,4 @@
"sni": {},
"disableNonEncryptedServer": false,
"disableToHTTPSRedirect": false
-}
\ No newline at end of file
+}
diff --git a/index.html b/index.html
index 6f189fe..eb38a18 100644
--- a/index.html
+++ b/index.html
@@ -1,7 +1,7 @@
- SVR.JS 3.4.32
+ SVR.JS 3.4.34
- Welcome to SVR.JS 3.4.32
+ Welcome to SVR.JS 3.4.34
@@ -36,7 +36,7 @@
"enableDirectoryListingWithDefaultHead": false,
"serverAdministratorEmail": "[no contact information]",
"stackHidden": false,
- "enableRemoteLogBrowsing": true,
+ "enableRemoteLogBrowsing": false,
"exposeServerVersion": true,
"disableServerSideScriptExpose": false,
"rewriteMap": [
@@ -119,10 +119,8 @@
Changes:
- - Added "svrmodpack" deprecation warning.
- - Removed unmaintained primitive analytics mod.
- - Removed unmaintained and undocumented hexstrbase64 library.
- - Added TypeError workaround for Bun 1.0.0
+ - Changed enableRemoteLogBrowsing property to be false by default.
+ - Mitigated security vulnerability: Sensitive data is no longer leaked from temp directory inside SVR.JS installation directory.
Bugs:
diff --git a/licenses/index.html b/licenses/index.html
index c22958a..3c2b7da 100644
--- a/licenses/index.html
+++ b/licenses/index.html
@@ -1,7 +1,7 @@
- SVR.JS 3.4.32 Licenses
+ SVR.JS 3.4.34 Licenses
- SVR.JS 3.4.32 Licenses
- SVR.JS 3.4.32
+ SVR.JS 3.4.34 Licenses
+ SVR.JS 3.4.34
MIT License
@@ -37,7 +37,7 @@
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
- Packages used by SVR.JS 3.4.32 and utilities
+ Packages used by SVR.JS 3.4.34 and utilities
License: MIT
diff --git a/svr.js b/svr.js
index 9453f4e..ca3d04c 100644
--- a/svr.js
+++ b/svr.js
@@ -71,7 +71,7 @@ function deleteFolderRecursive(path) {
}
var os = require("os");
-var version = "3.4.32";
+var version = "3.4.34";
var singlethreaded = false;
if (process.versions) process.versions.svrjs = version; //Inject SVR.JS into process.versions
@@ -1561,11 +1561,10 @@ if (secure) {
forbiddenPaths.svrjs = getInitializePath("./" + ((__dirname[__dirname.length - 1] != "/") ? __filename.replace(__dirname + "/", "") : __filename.replace(__dirname, "")));
forbiddenPaths.serverSideScripts = [];
forbiddenPaths.serverSideScripts.push("/serverSideScript.js");
-forbiddenPaths.serverSideScripts.push(getInitializePath("./temp/serverSideScript.js"));
forbiddenPaths.serverSideScriptDirectories = [];
-forbiddenPaths.serverSideScriptDirectories.push(getInitializePath("./temp/modloader"));
forbiddenPaths.serverSideScriptDirectories.push(getInitializePath("./node_modules"));
forbiddenPaths.serverSideScriptDirectories.push(getInitializePath("./mods"));
+forbiddenPaths.temp = getInitializePath("./temp");
forbiddenPaths.log = getInitializePath("./log");
//Create server
@@ -3981,11 +3980,15 @@ if (!cluster.isPrimary) {
callServerError(403);
serverconsole.errmessage("Access to configuration file/certificates is denied.");
return;
- } else if (checkIfIndexOfForbiddenPath(decodedHref, "log") && !isProxy && (configJSON.enableLogging || configJSON.enableLogging == undefined) && !(configJSON.enableRemoteLogBrowsing || configJSON.enableRemoteLogBrowsing == undefined)) {
+ } else if (checkIfIndexOfForbiddenPath(decodedHref, "temp") && !isProxy) {
+ callServerError(403);
+ serverconsole.errmessage("Access to temporary folder is denied.");
+ return;
+ } else if (checkIfIndexOfForbiddenPath(decodedHref, "log") && !isProxy && (configJSON.enableLogging || configJSON.enableLogging == undefined) && configJSON.enableRemoteLogBrowsing) {
callServerError(403);
serverconsole.errmessage("Access to log files is denied.");
return;
- } else if (checkIfForbiddenPath(decodedHref, "svrjs") && !isProxy && !exposeServerVersion && process.cwd() == __dirname) {
+ } else if (checkIfForbiddenPath(decodedHref, "svrjs") && !isProxy && !exposeServerVersion) {
callServerError(403);
serverconsole.errmessage("Access to SVR.JS script is denied.");
return;
@@ -4793,7 +4796,7 @@ function saveConfig() {
if (configJSONobj.enableDirectoryListingWithDefaultHead === undefined) configJSONobj.enableDirectoryListingWithDefaultHead = false;
if (configJSONobj.serverAdministratorEmail === undefined) configJSONobj.serverAdministratorEmail = "[no contact information]";
if (configJSONobj.stackHidden === undefined) configJSONobj.stackHidden = false;
- if (configJSONobj.enableRemoteLogBrowsing === undefined) configJSONobj.enableRemoteLogBrowsing = true;
+ if (configJSONobj.enableRemoteLogBrowsing === undefined) configJSONobj.enableRemoteLogBrowsing = false;
if (configJSONobj.exposeServerVersion === undefined) configJSONobj.exposeServerVersion = true;
if (configJSONobj.disableServerSideScriptExpose === undefined) configJSONobj.disableServerSideScriptExpose = true;
if (configJSONobj.allowStatus === undefined) configJSONobj.allowStatus = true;
diff --git a/tests.html b/tests.html
index 8c1e29e..31e6ca6 100644
--- a/tests.html
+++ b/tests.html
@@ -1,7 +1,7 @@
-
SVR.JS 3.4.32 Tests
+ SVR.JS 3.4.34 Tests
- SVR.JS 3.4.32 Tests
+ SVR.JS 3.4.34 Tests
Directory
Directory (with query)