eric/apprise-wordpress-notifications
Watch
1
0
Fork
You've already forked apprise-wordpress-notifications
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 21 tags
  • 2.5.2 de4c16e54e

    2.5.2 Stable

    eric released this 2026-06-27 22:48:18 -07:00 | 3 commits to main since this release

    Security fixes and hardening

    • Fixed IPv4-mapped IPv6 SSRF bypass (HIGH) — Addresses in the
      ::ffff:0:0/96 range (e.g. ::ffff:169.254.169.254, ::ffff:7f00:1)
      bypassed both the loopback check and private/reserved range check because
      PHP's FILTER_FLAG_NO_PRIV_RANGE / FILTER_FLAG_NO_RES_RANGE do not
      cover that range. Both resolve_and_validate_url() and
      is_loopback_address() now unwrap IPv4-mapped addresses before range
      checks, mirroring WordPress core's wp_http_validate_url().

    • Added CURLOPT_CAINFO/CAPATH to sanitize_curl_options() blocklist (LOW)
      — Both options substitute the CA bundle used for SSL verification and were
      absent despite all other SSL-bypass cURL options being blocked.

    • Fixed email suppression 'matching' mode not suppressing pingback emails
      when pingback_new is enabled but comment_new is disabled — the
      notify_post_author / notify_moderator filters were only registered
      when comment_new was on.

    • Updated email suppression 'all' mode description to explicitly warn that
      password reset emails have no Apprise notification substitute.

    • Updated Stateless URLs field description to clarify that Apprise makes
      outbound HTTP requests to those URLs, including HTTP-dispatching schemes
      (json://, xml://, form://).

    Downloads