Merge branch 'master' of github.com:appwrite/appwrite into feat-decouple-collections

.travis.yml

@@ -1,8 +1,8 @@
-dist: xenial
+dist: focal
 
 arch:
   - amd64
-  - arm64
+  - arm64-graviton2
 
 os: linux
 
@@ -30,7 +30,7 @@ before_install:
 - echo "_APP_FUNCTIONS_RUNTIMES=php-8.0" >> .env
 
 install:
-- docker-compose up -d
+- docker-compose up -d --build
 - sleep 10
 
 script:
@@ -43,6 +43,9 @@ script:
 - docker-compose exec appwrite test --debug
 - docker-compose logs appwrite
 
+after_failure:
+- docker-compose logs appwrite
+
 deploy:
   - provider: script
     edge: true

CHANGES.md

@@ -6,6 +6,12 @@
 - Grouped oAuth related attributes in project collection. Introduced new attribute `providers` and removed all attributes related to OAuth2 providers. All OAuth2 attributes are grouped under `providers`
 - Project model changed, `userAuth<AuthMethod>` => `auth<AuthMethod>` example `userAuthEmailPassword` => `authEmailPassword`, also `userOauth2<Provider>...` => `provider<Provider>...` example `userOauth2GithubAppid` => `providerGithubAppid`
 
+# Version 0.9.4
+
+## Security
+
+- Fixed security vulnerability that exposes project ID's from other admin users (#1453)
+
 # Version 0.9.3
 
 ## Bugs

Dockerfile

@@ -19,8 +19,8 @@ ENV DEBUG=$DEBUG
 
 ENV PHP_REDIS_VERSION=5.3.4 \
     PHP_MONGODB_VERSION=1.9.1 \
-    PHP_SWOOLE_VERSION=v4.6.7 \
-    PHP_IMAGICK_VERSION=3.5.0 \
+    PHP_SWOOLE_VERSION=v4.7.0 \
+    PHP_IMAGICK_VERSION=3.5.1 \
     PHP_YAML_VERSION=2.2.1 \
     PHP_MAXMINDDB_VERSION=v1.10.1
 

README.md

@@ -57,7 +57,7 @@ docker run -it --rm \
     --volume /var/run/docker.sock:/var/run/docker.sock \
     --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
     --entrypoint="install" \
-    appwrite/appwrite:0.9.3
+    appwrite/appwrite:0.9.4
 ```
 
 ### Windows
@@ -69,7 +69,7 @@ docker run -it --rm ^
     --volume //var/run/docker.sock:/var/run/docker.sock ^
     --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^
     --entrypoint="install" ^
-    appwrite/appwrite:0.9.3
+    appwrite/appwrite:0.9.4
 ```
 
 #### PowerShell
@@ -79,7 +79,7 @@ docker run -it --rm ,
     --volume /var/run/docker.sock:/var/run/docker.sock ,
     --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw ,
     --entrypoint="install" ,
-    appwrite/appwrite:0.9.3
+    appwrite/appwrite:0.9.4
 ```
 
 Once the Docker installation completes, go to http://localhost to access the Appwrite console from your browser. Please note that on non-linux native hosts, the server might take a few minutes to start after installation completes.

app/controllers/general.php

@@ -319,7 +319,7 @@ App::error(function ($error, $utopia, $request, $response, $layout, $project) {
         
         if($route) {
             Console::error('[Error] Method: '.$route->getMethod());
-            Console::error('[Error] URL: '.$route->getURL());
+            Console::error('[Error] URL: '.$route->getPath());
         }
         
         Console::error('[Error] Type: '.get_class($error));

app/controllers/mock.php

@@ -518,7 +518,7 @@ App::shutdown(function($utopia, $response, $request) {
         throw new Exception('Failed to read results', 500);
     }
 
-    $result[$route->getMethod() . ':' . $route->getURL()] = true;
+    $result[$route->getMethod() . ':' . $route->getPath()] = true;
 
     $tests = \array_merge($tests, $result);
 
@@ -526,5 +526,5 @@ App::shutdown(function($utopia, $response, $request) {
         throw new Exception('Failed to save results', 500);
     }
 
-    $response->dynamic(new Document(['result' => $route->getMethod() . ':' . $route->getURL() . ':passed']), Response::MODEL_MOCK);
+    $response->dynamic(new Document(['result' => $route->getMethod() . ':' . $route->getPath() . ':passed']), Response::MODEL_MOCK);
 }, ['utopia', 'response', 'request'], 'mock');

app/controllers/shared/api.php

@@ -41,7 +41,7 @@ App::init(function ($utopia, $request, $response, $project, $user, $events, $aud
         ->setParam('{userId}', $user->getId())
         ->setParam('{userAgent}', $request->getUserAgent(''))
         ->setParam('{ip}', $request->getIP())
-        ->setParam('{url}', $request->getHostname().$route->getURL())
+        ->setParam('{url}', $request->getHostname().$route->getPath())
     ;
 
     // TODO make sure we get array here

app/init.php

@@ -61,7 +61,7 @@ const APP_PAGING_LIMIT = 12;
 const APP_LIMIT_COUNT = 5000;
 const APP_LIMIT_USERS = 10000;
 const APP_CACHE_BUSTER = 151;
-const APP_VERSION_STABLE = '0.10.0';
+const APP_VERSION_STABLE = '0.9.4';
 const APP_STORAGE_UPLOADS = '/storage/uploads';
 const APP_STORAGE_FUNCTIONS = '/storage/functions';
 const APP_STORAGE_CACHE = '/storage/cache';

app/views/install/compose.phtml

@@ -9,7 +9,7 @@ $image = $this->getParam('image', '');
 
 services:
   traefik:
-    image: traefik:2.3
+    image: traefik:2.5
     container_name: appwrite-traefik
     command:
       - --providers.file.directory=/storage/config

docker-compose.yml

@@ -7,7 +7,7 @@ version: '3'
 
 services:
   traefik:
-    image: traefik:2.3
+    image: traefik:2.5
     container_name: appwrite-traefik
     command:
       - --log.level=DEBUG

src/Appwrite/Migration/Migration.php

@@ -42,6 +42,7 @@ abstract class Migration
         '0.9.1' => 'V08',
         '0.9.2' => 'V08',
         '0.9.3' => 'V08',
+        '0.9.4' => 'V08',
         '0.10.0' => 'V08', // TODO Eldad: `I need this to pass the tests`
     ];
 

src/Appwrite/Specification/Format/OpenAPI3.php

@@ -91,7 +91,7 @@ class OpenAPI3 extends Format
         $usedModels = [];
 
         foreach ($this->routes as $route) { /** @var \Utopia\Route $route */
-            $url = \str_replace('/v1', '', $route->getURL());
+            $url = \str_replace('/v1', '', $route->getPath());
             $scope = $route->getLabel('scope', '');
             $hide = $route->getLabel('sdk.hide', false);
             $consumes = [$route->getLabel('sdk.request.type', 'application/json')];

src/Appwrite/Specification/Format/Swagger2.php

@@ -89,7 +89,7 @@ class Swagger2 extends Format
         $usedModels = [];
 
         foreach ($this->routes as $route) { /** @var \Utopia\Route $route */
-            $url = \str_replace('/v1', '', $route->getURL());
+            $url = \str_replace('/v1', '', $route->getPath());
             $scope = $route->getLabel('scope', '');
             $hide = $route->getLabel('sdk.hide', false);
             $consumes = [$route->getLabel('sdk.request.type', 'application/json')];