With the new reality of living with Covid-19, it is difficult to host in-person meetings. At Plastic Pollution Coalition, we used to host in-person coalition meetings in several cities as a way for people to learn and network with others in their community. In June, we transitioned to doing webinars. Although it's difficult for people to network during webinars, we can still continue sharing best practices and have a dialogue with our community.
Josh here with the CiviCRM Core Team. Each January we publish an annual report that highlights our past operational and financial performance as well as our plans for the coming year. This year, we’re taking it a step further and hosting quarterly community round tables in conjunction with the CiviCRM Community Council (the next one is on July 13, details forthcoming).
Some permissions were not being checked adequately before returning results from the CiviCRM APIv4. This did not affect everyday use of CiviCRM, but an attacker could potentially exploit this to bypass security checks and read private data from the database. To date there are no known sites that have been compromised due to this bug. APIv3 was not affected.
The CiviCRM Community Council and CiviCRM Core Team are putting together quarterly meetings and invite you to attend. Dubbed ‘Community Round Tables’, these online meetings are intended to provide attendees with general project updates as well as an opportunity for Q&A and general feedback with the Community Council, the Core Team, and community members at large.
The Community Round Tables will include 2 meetings every quarter in order to accommodate users around the world, with the first happening on April 20th. Information and registration online:
As you may be aware, CiviCRM was recently given an award for its incredible social impact by the Free Software Foundation. I think we can all agree that CiviCRM is amazing software! Likewise, I believe that we all recognize that our diversity in perspectives, nationalities, genders, text editors, etc. is vital to the health of both the software and the project.
I’m writing this blog post because now may be one of those times where, as a member of our diverse community, you may wish to express your individual views.
Coleman Watts of the CiviCRM Core Team will give a webinar to present new developments in SearchKit and FormBuilder on April 7 @ 11am US Eastern Time (4pm BST). The webinar will include time for Q&A on planned developments for both SearchKit and Form Builder.
Update: The recording is now available here:
(This is a public service announcement related to security functionality. It does not detail an exploitable vulnerability. Rather, we wish to advise administrators and developers about an on-going change to improve security.)
CiviCRM v3.1 introduced a helper "CRM_Utils_Crypt" which encrypted the SMTP password. This mechanism is being phased-out circa 5.34 in favor of a more secure mechanism. We will briefly consider the purpose of the mechanism, some of its issues, and the details of the change.
In the Joomla integration, some references to user-account records were not properly sanitized.
CiviCRM's REST API traditionally requires two keys, the "API Key" and the "Site Key". The "Site Key" could potentially be extracted by a "timing attack". In this scenario, an attacker would send many invalid requests, build a statistical profile, and infer the most likely value.
The introduction text on a Personal Campaign Page (PCP) was not properly sanitised prior to display on the Personal Campaign page.