mirror of
https://github.com/opf/openproject.git
synced 2026-06-14 03:30:14 +00:00
docs(links): adjust changed statement-on-security url
This commit is contained in:
as-op
@@ -49,7 +49,7 @@ will keep our community secure. If you happen to come across a security issue we
|
||||
you to disclose it to us privately to allow our users and community enough time to
|
||||
upgrade. Security issues will always take precedence over anything else in the pipeline.
|
||||
|
||||
For more information on how to disclose a security vulnerability, [please see this page](docs/development/security/README.md).
|
||||
For more information on how to disclose a security vulnerability, [please see this page](docs/development/[statement-on-security](docs/security-and-privacy/statement-on-security/README.md).
|
||||
|
||||
## License
|
||||
|
||||
|
||||
+1
-1
@@ -1 +1 @@
|
||||
Please find our statement on security in this document: https://www.openproject.org/docs/development/security/
|
||||
Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/
|
||||
|
||||
@@ -73,4 +73,4 @@ Please navigate to -> Administration -> GDPR and you can now online review and s
|
||||
|
||||
|
||||
|
||||
Find out more about [OpenProject's security features](../../../development/security/#openproject-security-features).
|
||||
Find out more about [OpenProject's security features](../../../security-and-privacy/statement-on-security/#openproject-security-features).
|
||||
|
||||
@@ -26,7 +26,7 @@ The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are
|
||||
If you are unable to upgrade in a timely fashion, the following patch can be applied: [https://github.com/opf/openproject/pull/9983.patch](https://github.com/opf/openproject/pull/9983.patch)
|
||||
|
||||
#### Credits
|
||||
This security issue was responsibly disclosed by [Daniel Santos](https://github.com/bananabr) (Twitter [@bananabr](https://twitter.com/bananabr)). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/development/security/).
|
||||
This security issue was responsibly disclosed by [Daniel Santos](https://github.com/bananabr) (Twitter [@bananabr](https://twitter.com/bananabr)). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/).
|
||||
|
||||
### Bug fixes and changes
|
||||
- Fixed: Frontend including editor and time logging unusable when there are many activities \[[#40314](https://community.openproject.com/wp/40314)\]
|
||||
|
||||
@@ -19,7 +19,7 @@ The release contains two security related bug fixes and we recommend updating to
|
||||
|
||||
When a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device.
|
||||
|
||||
This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/development/security/).
|
||||
This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/).
|
||||
|
||||
For more information, [please see our security advisory](https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28q).
|
||||
|
||||
@@ -33,7 +33,7 @@ When a user requests a password reset, an email is sent with a link to confirm a
|
||||
|
||||
The issue has been resolved in OpenProject version 12.5.4 by actively revoking any active password reset tokens for user accounts having changed their passwords successfully within the application.
|
||||
|
||||
This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/development/security/).
|
||||
This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/).
|
||||
|
||||
<!--more-->
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ For the full advisory and patches for older unsupported versions,
|
||||
post](https://groups.google.com/d/msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ).
|
||||
For our statement on security and further information on how to
|
||||
responsible disclose security related issues to us, please see our
|
||||
[statement on security](../../../development/security/).
|
||||
[statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/).
|
||||
|
||||
Thanks to Thanaphon Soo from the [SEC Consult Vulnerability
|
||||
Lab](https://www.sec-consult.com) for identifying and responsibly
|
||||
|
||||
@@ -57,7 +57,7 @@ If you can, please send us a PGP-encrypted email using the following key:
|
||||
|
||||
- Key ID: [0x7D669C6D47533958](https://keys.openpgp.org/vks/v1/by-fingerprint/BDCFE01EDE84EA199AE172CE7D669C6D47533958),
|
||||
- Fingerprint BDCF E01E DE84 EA19 9AE1 72CE 7D66 9C6D 4753 3958
|
||||
- You may also find the key [attached in our OpenProject repository.](https://github.com/opf/openproject/blob/dev/docs/development/security/security-at-openproject.com.asc)
|
||||
- You may also find the key [attached in our OpenProject repository.](https://www.openproject.org/docs/security-and-privacy/statement-on-security/security-at-openproject.com.asc)
|
||||
|
||||
Please include a description on how to reproduce the issue if possible. Our security team will get your email and will attempt to reproduce and fix the issue as soon as possible.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user