Date

Call-in Information

Time: 10:00 am, Eastern Time

Attendees

(star)  Indicating note-taker

  1. Dragan Ivanovic 
  2. William Welling (star)
  3. Brian Lowe 
  4. Georgy Litvinov   

Agenda

  1. Release candidate 3 (VIVO 1.14.0)
    1. Published and a couple of issues reported to Georgy
    2. https://github.com/vivo-project/Vitro/pull/407
    3. https://github.com/vivo-project/Vitro/pull/408
    4. https://github.com/vivo-project/Vitro/pull/409
  2. Release candidate 4
  3. Vulnerability
    1. https://vivo-project.slack.com/archives/C8RL9L98A/p1687378615914659
    2. The penetration testers contacted me with an additional finding for the VIVO server. This one relates to a issue with input not being sanitized for special characters, which could then be used to exploit the site. They consider this a high severity vulnerability and documenting it as a reflected cross site scripting vulnerability. The provided an example of exploiting the issue with the below URL.https://vivo.mydomain.edu/visualizationAjax?vis=capabilitymap&query=291822&callback=ipretResultsoesic<script>alert(1)<%2fscript>cwz3i&noCacheIE=1687235208332
  4. Publication claiming
      1. https://vivo-project.slack.com/archives/C8SDQQYJ2/p1687364277662029
      2. Good afternoon all,I have a question about restricting publication claiming. In the 1.11.x release notes, publication claiming is noted as being available to anyone who has the ability to edit in VIVO, whether that be the ability to edit only their profile or edit others. Is there a way to restrict this to be an admin-only privilege?

Notes

A couple of new issues have been recorded related to the Vitro code base. All have been resolved and merged into the main branch. Dragan will generate VIVO 1.14.0 Release candidate 4.

The vulnerability https://vivo.mydomain.edu/visualizationAjax?vis=capabilitymap&query=291822&callback=ipretResultsoesic<script>alert(1)<%2fscript>cwz3i&noCacheIE=1687235208332 is still present in VIVO 1.14.0 release candidate. Not sure what is causing this issue. Dragan will respond to slack message. 

Probably claiming publication is linked with privileges to edit a profile. Once this PR (https://github.com/vivo-project/VIVO/pull/3887) is merged, it will be quite easy to define this as a separate privilege.  Therefore, this issue might be resolved by configuration of VIVO 1.15.0+. Georgy can present how it might be done after summer break. 

Draft notes on Google Drive

Actions

Previous actions 

  • No labels

All content on the LYRASIS Wiki is licensed under the CC BY (Attribution) license, unless otherwise noted.