Skip to content

Commit 4d6b4ef

Browse files
Copilotnielsdrost7
Copilot
and
nielsdrost7
committed
Add comprehensive version 1.7.0 documentation to README and CHANGELOG
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
1 parent 2e4cff7 commit 4d6b4ef

2 files changed

Lines changed: 90 additions & 0 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Changelog
2+
3+
All notable changes to InvoicePlane will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [1.7.0] - 2025-12-02
9+
10+
### Added
11+
- Full PHP 8.2+ compatibility support (PHP 8.1, 8.2, 8.3+)
12+
- Enhanced security logging for file uploads and template operations
13+
- Comprehensive input validation for template parameters
14+
- Security warnings in admin interface for SVG logo files
15+
16+
### Changed
17+
- Updated all PHP dependencies for PHP 8.2+ compatibility
18+
- Improved error handling in PDF generation
19+
- Enhanced input sanitization across all user-facing forms
20+
- Modernized codebase to follow PHP 8+ standards
21+
22+
### Security
23+
- **CRITICAL:** Fixed multiple Cross-Site Scripting (XSS) vulnerabilities
24+
- Quote and invoice number fields now properly escaped in all templates
25+
- Tax rate names and payment method names sanitized
26+
- Custom field labels and client addresses protected from XSS
27+
- Sumex observations and quote notes/passwords sanitized
28+
- Email templates now use proper HTML escaping
29+
- **CRITICAL:** Fixed Local File Inclusion (LFI) vulnerabilities
30+
- Template validation added to PDF generation endpoints
31+
- Invoice and quote template parameters now validated
32+
- Prevented directory traversal attacks through template selection
33+
- **HIGH:** Fixed log poisoning vulnerability in file upload controller
34+
- File names are now sanitized before logging
35+
- Prevents control character injection in log files
36+
- **HIGH:** SVG logo files are now blocked entirely
37+
- SVG files can contain embedded JavaScript that could execute in user browsers
38+
- Existing SVG logos will not display (security block)
39+
- Users should convert to PNG, JPG, or GIF formats
40+
41+
### Removed
42+
- Support for SVG logo uploads (security measure)
43+
- Deprecated library dependencies
44+
- PHP 7.x compatibility (minimum PHP 8.1 required)
45+
46+
### Fixed
47+
- Email address verification now supports both comma and semicolon separators
48+
- QR code image width reduced to 100px for better display
49+
- Version checking and logging for e-invoicing fields
50+
- File access vulnerabilities across multiple controllers
51+
52+
## [1.6.4] - Earlier Release
53+
54+
For changes in version 1.6.4 and earlier, please see the git commit history.
55+
56+
---
57+
58+
## Security Disclosure
59+
60+
If you discover a security vulnerability in InvoicePlane, please email **[mail@invoiceplane.com](mailto:mail@invoiceplane.com)** before disclosing it publicly. We will address all security concerns promptly.

‎README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,36 @@ _A libre self-hosted web application designed to help you manage invoices, clien
2323

2424
---
2525

26+
## 🎉 What's New in Version 1.7.0
27+
28+
**InvoicePlane 1.7.0** brings PHP 8.2+ compatibility and critical security enhancements to keep your financial data safe.
29+
30+
### Major Improvements
31+
32+
- **✅ PHP 8.2+ Compatibility:** Full support for modern PHP versions (8.1, 8.2, 8.3+)
33+
- **🔒 Enhanced Security:** Multiple security vulnerabilities have been addressed:
34+
- Fixed Cross-Site Scripting (XSS) vulnerabilities across templates and user inputs
35+
- Resolved Local File Inclusion (LFI) vulnerabilities in PDF generation
36+
- Patched log poisoning vulnerability in file upload handling
37+
- **🛡️ SVG Logo Protection:** SVG uploads are now blocked to prevent embedded script execution (see details below)
38+
- **📦 Updated Dependencies:** All PHP packages updated for compatibility and security
39+
40+
### Upgrading from Version 1.6.x
41+
42+
If you're upgrading from InvoicePlane 1.6.x:
43+
44+
1. **Backup your data** - Create a full backup of your database and files
45+
2. **Check PHP version** - Ensure your server runs PHP 8.1 or higher
46+
3. **Update files** - Replace all application files with the new version
47+
4. **Run migrations** - Visit `/index.php/setup` to apply database updates
48+
5. **Review logo settings** - If using an SVG logo, convert it to PNG/JPG (see SVG notice below)
49+
50+
For detailed upgrade instructions, visit the [InvoicePlane Wiki](https://wiki.invoiceplane.com/).
51+
52+
> **📋 Full Release Notes:** See [CHANGELOG.md](CHANGELOG.md) for a complete list of changes, security fixes, and improvements.
53+
54+
---
55+
2656
## Key Features
2757

2858
- **Invoice & Quote Management:** Create, send, and manage professional invoices and quotes effortlessly.

0 commit comments

Comments
 (0)