hledger-web 1.52.1 → 1.52.2
raw patch · 7 files changed
+54/−24 lines, 7 filesdep ~hledgerdep ~hledger-libdep ~yesod-static
Dependency ranges changed: hledger, hledger-lib, yesod-static
Files
- CHANGES.md +23/−0
- hledger-web.1 +2/−2
- hledger-web.cabal +7/−7
- hledger-web.info +10/−10
- hledger-web.txt +2/−2
- static/hledger.js +1/−1
- templates/add-form.hamlet +9/−2
CHANGES.md view
@@ -23,6 +23,29 @@ See also the hledger changelog. +# 1.52.2 2026-08-24++Fixes++- An XSS (cross-site scripting) vulnerability has been fixed in the add+ transaction form's autocomplete. Journal data from an untrusted source+ could execute javascript when shown as a completion suggestion. All+ hledger-web users are encouraged to upgrade. Full technical details:+ GHSA-538p-cvc4-4qjm.+ (Arthur Cinader, Simon Michael, #2698)+ + Note: this bug was detected, and the original patch was generated, by+ Arthur Cinader with AI assistance, for hledger 2.x. Because the+ vulnerability is in theory quite severe, and the fix is small and+ obvious, and I don't want to add risk by redoing it from memory, and+ no-one else volunteered promptly to do that work - and after+ discussion in the chat and mail list (see today's thread), and careful+ human review and testing - I manually backported the same fix to+ hledger 1. And, updated the project's https://hledger.org/AI.html+ policy to allow this for needed security-related fixes like this one+ (which I expect to be very rare).++ # 1.52.1 2026-04-28 Improvements
hledger-web.1 view
@@ -1,5 +1,5 @@ -.TH "HLEDGER\-WEB" "1" "March 2026" "hledger-web-1.52 " "hledger User Manuals"+.TH "HLEDGER\-WEB" "1" "March 2026" "hledger-web-1.52.1 " "hledger User Manuals" @@ -17,7 +17,7 @@ .PD \f[CR]hledger web [OPTS] [QUERY]\f[R] .SH DESCRIPTION-This manual is for hledger\(aqs web interface, version 1.52.+This manual is for hledger\(aqs web interface, version 1.52.1. See also the hledger manual for common concepts and file formats. .PP hledger is a robust, user\-friendly, cross\-platform set of programs for
hledger-web.cabal view
@@ -1,11 +1,11 @@ cabal-version: 2.2 --- This file has been generated from package.yaml by hpack version 0.39.1.+-- This file has been generated from package.yaml by hpack version 0.39.6. -- -- see: https://github.com/sol/hpack name: hledger-web-version: 1.52.1+version: 1.52.2 synopsis: Web user interface for the hledger accounting system description: A simple web user interface for the hledger accounting system, providing a more modern UI than the command-line or terminal interfaces.@@ -154,7 +154,7 @@ hs-source-dirs: ./ ghc-options: -Wall -Wno-incomplete-uni-patterns -Wno-missing-signatures -Wno-orphans -Wno-type-defaults -Wno-unused-do-bind -threaded- cpp-options: -DVERSION="1.52.1"+ cpp-options: -DVERSION="1.52.2" build-depends: Decimal >=0.5.1 , aeson >=1 && <2.3@@ -176,8 +176,8 @@ , filepath , githash >=0.1.6.2 , hjsmin- , hledger >=1.52.1 && <1.53- , hledger-lib >=1.52.1 && <1.53+ , hledger >=1.52.2 && <1.53+ , hledger-lib >=1.52.2 && <1.53 , hspec , http-client , http-conduit@@ -222,7 +222,7 @@ hs-source-dirs: app ghc-options: -Wall -Wno-incomplete-uni-patterns -Wno-missing-signatures -Wno-orphans -Wno-type-defaults -Wno-unused-do-bind -threaded- cpp-options: -DVERSION="1.52.1"+ cpp-options: -DVERSION="1.52.2" build-depends: base >=4.18 && <4.23 , hledger-web@@ -242,7 +242,7 @@ hs-source-dirs: test ghc-options: -Wall -Wno-incomplete-uni-patterns -Wno-missing-signatures -Wno-orphans -Wno-type-defaults -Wno-unused-do-bind -threaded- cpp-options: -DVERSION="1.52.1"+ cpp-options: -DVERSION="1.52.2" build-depends: base >=4.18 && <4.23 , hledger-web
hledger-web.info view
@@ -18,7 +18,7 @@ or 'hledger web [OPTS] [QUERY]' - This manual is for hledger's web interface, version 1.52. See also+ This manual is for hledger's web interface, version 1.52.1. See also the hledger manual for common concepts and file formats. hledger is a robust, user-friendly, cross-platform set of programs@@ -528,15 +528,15 @@ Tag Table: Node: Top223-Node: OPTIONS2575-Node: PERMISSIONS11473-Node: EDITING UPLOADING DOWNLOADING12623-Node: RELOADING13638-Node: JSON API14205-Node: DEBUG OUTPUT19854-Node: Debug output20006-Node: ENVIRONMENT20524-Node: BUGS20760+Node: OPTIONS2577+Node: PERMISSIONS11475+Node: EDITING UPLOADING DOWNLOADING12625+Node: RELOADING13640+Node: JSON API14207+Node: DEBUG OUTPUT19856+Node: Debug output20008+Node: ENVIRONMENT20526+Node: BUGS20762 End Tag Table
hledger-web.txt view
@@ -11,7 +11,7 @@ hledger web [OPTS] [QUERY] DESCRIPTION- This manual is for hledger's web interface, version 1.52. See also the+ This manual is for hledger's web interface, version 1.52.1. See also the hledger manual for common concepts and file formats. hledger is a robust, user-friendly, cross-platform set of programs for@@ -470,4 +470,4 @@ SEE ALSO hledger(1), hledger-ui(1), hledger-web(1), ledger(1) -hledger-web-1.52 March 2026 HLEDGER-WEB(1)+hledger-web-1.52.1 March 2026 HLEDGER-WEB(1)
static/hledger.js view
@@ -123,7 +123,7 @@ // or it will recursively add helper elements for those, causing confusion (#2215). newrow.find('.tt-hint').remove(); newrow.find('.tt-input').removeClass('tt-input');- accountfield.typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter() });+ accountfield.typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter(), templates: { suggestion: globalThis.suggestionTemplate } }); // Add the new row to the page. $('#addform .account-postings').append(newrow);
templates/add-form.hamlet view
@@ -20,9 +20,16 @@ }); globalThis.accountsCompleter.initialize(); + // use template to ensure proper escaping+ globalThis.suggestionTemplate = function(d) {+ var p = document.createElement('p');+ p.textContent = d.value;+ return p;+ };+ // Attach the completers to the initial form inputs.- jQuery('input[name=description]').typeahead({ highlight: true }, { source: globalThis.descriptionsCompleter.ttAdapter() });- jQuery('input[name=account]' ).typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter() });+ jQuery('input[name=description]').typeahead({ highlight: true }, { source: globalThis.descriptionsCompleter.ttAdapter(), templates: { suggestion: globalThis.suggestionTemplate } });+ jQuery('input[name=account]' ).typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter(), templates: { suggestion: globalThis.suggestionTemplate } }); }); const utf8textdecoder = new TextDecoder();