Aquesta és una versió anterior. La versió actual és la 1.52.4. hledger 1.52.4 · Data de publicació:
Fitxers d’instal·lació 1.52.3
| Arquitectura | Tipus | Àmbit | Mida del fitxer | Baixa | SHA256 |
|---|---|---|---|---|---|
| 64 bits | ZIP → Portable | — | — | github.com | VirusTotal |
L’enllaç i l’SHA256 provenen del manifest comunitari del Gestor de paquets del Windows. Convé comparar el hash del fitxer baixat abans d’executar-lo.
Notes de la versió
- Uses hledger-lib 1.52.3.
- Uses hledger 1.52.3.
Fixes
- Another XSS (cross-site scripting) vulnerability has been fixed, in the add transaction form's error message. Any web page visited while hledger-web was running could use it to run javascript in hledger-web's origin, and from there read the whole journal, or alter it. All hledger-web users should upgrade. See also: GHSA-vq7r-8w52-jv84. (Arthur Cinader, Simon Michael, #2700)
- A newline submitted in a transaction's description, code or account name is no longer written into the journal file. This removes the possibility of the user inserting an include directive, which could expose system files readable by the hledger-web server. See also: GHSA-vq7r-8w52-jv84. #2704
Note: as with #2698 in 1.52.2, these fixes were backported from AI-assisted fixes in hledger 2, under the security exception in https://hledger.org/AI.html; they have been reviewed and tested.
- hledger-web's official binaries, and builds from the hledger source tree, now use aeson 2.3, avoiding a denial of service bug. (https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html)
Simon Michael,
Arthur Cinader.https://github.com/plaintextaccounting/hledger/releases/tag/1.52.3
