eric/apprise-wordpress-notifications
Watch
1
0
Fork
You've already forked apprise-wordpress-notifications
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 21 tags
  • 2.5.4 bee61ab047

    2.5.4 Stable

    eric released this 2026-06-28 09:52:08 -07:00 | 0 commits to main since this release

    Forgejo migration and update checker hardening

    Fixed update checker compatibility with Forgejo. Forgejo's /releases.rss feed uses the same URL path as Gitea, but item titles are plain version numbers (e.g. 2.5.3) rather than v-prefixed. The checker now extracts the version from basename(link) instead of the item title, and filters feed items by /releases/tag/ in the link URL — making it robust against any future title format changes regardless of forge software.

    Updated internal docstrings from "Gitea" to "Forgejo".

    Full changelog: 2.5.3...2.5.4

    Downloads
  • 2.5.3 0beb9b9c3d

    2.5.3 Stable

    eric released this 2026-06-28 09:42:33 -07:00 | 2 commits to main since this release

    Security

    • Block CURLOPT_URL in sanitize_curl_options() — CURLOPT_URL (integer 10002) was absent from the cURL option blocklist. A rogue plugin hooking apprise_notifications_request_args could inject this option to redirect any Apprise API request to an arbitrary URL after SSRF validation had already passed. The CURLOPT_RESOLVE DNS pin applied to the original Apprise hostname has no effect on a substituted target, so loopback services, RFC 1918 hosts, and cloud metadata endpoints (e.g. 169.254.169.254) were reachable. Exploitation requires server-side code execution via a malicious or compromised plugin.

    Full changelog: 2.5.2...2.5.3

    Downloads
  • 2.5.2 de4c16e54e

    2.5.2 Stable

    eric released this 2026-06-27 22:48:18 -07:00 | 3 commits to main since this release

    Security fixes and hardening

    • Fixed IPv4-mapped IPv6 SSRF bypass (HIGH) — Addresses in the
      ::ffff:0:0/96 range (e.g. ::ffff:169.254.169.254, ::ffff:7f00:1)
      bypassed both the loopback check and private/reserved range check because
      PHP's FILTER_FLAG_NO_PRIV_RANGE / FILTER_FLAG_NO_RES_RANGE do not
      cover that range. Both resolve_and_validate_url() and
      is_loopback_address() now unwrap IPv4-mapped addresses before range
      checks, mirroring WordPress core's wp_http_validate_url().

    • Added CURLOPT_CAINFO/CAPATH to sanitize_curl_options() blocklist (LOW)
      — Both options substitute the CA bundle used for SSL verification and were
      absent despite all other SSL-bypass cURL options being blocked.

    • Fixed email suppression 'matching' mode not suppressing pingback emails
      when pingback_new is enabled but comment_new is disabled — the
      notify_post_author / notify_moderator filters were only registered
      when comment_new was on.

    • Updated email suppression 'all' mode description to explicitly warn that
      password reset emails have no Apprise notification substitute.

    • Updated Stateless URLs field description to clarify that Apprise makes
      outbound HTTP requests to those URLs, including HTTP-dispatching schemes
      (json://, xml://, form://).

    Downloads