sync with master

.github/workflows/codeql-analysis.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/deploy.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Enable command line
         shell: bash
@@ -45,16 +45,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           push: true
           file: ./Dockerfile-core

.github/workflows/docker-image.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set output
         id: vars
@@ -26,13 +26,13 @@ jobs:
           echo ${{ steps.vars.outputs.tag }}
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           context: .
           push: true
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set output
         id: vars
@@ -57,13 +57,13 @@ jobs:
           echo ${{ steps.vars.outputs.tag }}
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           push: true
           file: ./Dockerfile-api
@@ -74,7 +74,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set output
         id: vars
@@ -88,13 +88,13 @@ jobs:
           echo ${{ steps.vars.outputs.tag }}
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           push: true
           file: ./Dockerfile-frontend
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set output
         id: vars
@@ -119,13 +119,13 @@ jobs:
           echo ${{ steps.vars.outputs.tag }}
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           push: true
           file: ./Dockerfile-core

.github/workflows/main.yml

@@ -26,7 +26,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Copy code
         shell: bash
@@ -96,7 +96,7 @@ jobs:
         COUNTLY_CONFIG_API_PREVENT_JOBS: true
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Copy code
         shell: bash
@@ -157,7 +157,7 @@ jobs:
         COUNTLY_CONFIG_API_PREVENT_JOBS: true
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Prepare tests
         shell: bash
@@ -209,7 +209,7 @@ jobs:
         COUNTLY_CONFIG_API_PREVENT_JOBS: true
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Copy code
         shell: bash
@@ -273,7 +273,7 @@ jobs:
         COUNTLY_CONFIG_API_PREVENT_JOBS: true
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Chrome
         shell: bash

.github/workflows/stable-je-deploy.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Deploy server
         shell: bash

CHANGELOG.md

@@ -1,4 +1,39 @@
+## Version 25.03.XX
+Fixes:
+- [journey_engine] Added user merge handling: running journeys are remapped to the surviving user, keeping the furthest-progressed instance and stopping duplicates
+- [views] Refresh drawer on app change
+
+
+## Version 25.03.48
+Fixes:
+- [core] Don't show the "no access" or initial-setup page to users who already have app access — redirect them to their default app instead
+
+Enterprise Fixes:
+- [journey_engine] Avoid throwing on duplicate events and prevent overwriting existing event map entries during event creation
+- [journey_engine] Fixed incoming-data journeys double-entering a user when a single request carried multiple events (e.g. a custom event together with begin_session's session event)
+
+Enterprise Features:
+- [block] Allow using regex for event filter
+- [journey_engine] Added an end-to-end API test suite covering every trigger type (event/session/crash incoming-data, profile-update, journey-exit, profile-group entry/exit) that delivers in-app content through the queue
+
+## Version 25.03.47
+Fixes:
+- [content] Bugfixes for content showing
+- [core] Improved validation for user passed queries.
+- [journey_engine] resut tab made available for running journeys
 
+Enterprise Features:
+-[data-manager] Improved user propertly value table to allow filtering all values.
+
+## Version 25.03.46
+Fixes:
+ - Overall security Fixes
+ - Ensuring Countly working from a network subdirectory
+
+Enterprise Features:
+ - [active_directory] Journey approver group added
+ - [ldap] Journey approver group added
+
 ## Version 25.03.45
 Fixes:
 - [core] Accept numeric color in saveNote schema so graph note create/edit no longer fails validation

CLAUDE.md

@@ -50,6 +50,27 @@ countly shellcheck           # Validate shell scripts
 
 5. **Never use v-html with user data** in Vue templates.
 
+6. **Validate user-supplied Mongo queries — reject, never strip**. Any query/filter that comes from a request and reaches `find`/`aggregate`/`update`/`delete` must be checked with the `common` helpers at the endpoint where it is first parsed (NOT inside deep helpers or the `/drill/preprocess_query` hook). The query is run exactly as submitted or the request is rejected with `400` — it is never modified.
+   ```javascript
+   // raw query STRING from a request param → parse + validate in one step
+   var parsed = common.parseUserQuery(params.qstring.query); // accepts string OR object
+   if (parsed.error) {
+       log.d("Rejected user query" + common.reqInfo(params) + ": " + parsed.error);
+       return common.returnMessage(params, 400, parsed.error);
+   }
+   var query = parsed.query; // safe to run as-is
+
+   // ALREADY-parsed object — e.g. dbviewer parses with EJSON, or the query is
+   // nested in a larger saved payload. Validate that parsed object directly:
+   var parsedQuery = EJSON.parse(params.qstring.filter); // example: already parsed (EJSON / stored doc)
+   var badOp = common.findUnsafeMongoOperator(parsedQuery);
+   if (badOp) {
+       log.d("Rejected user query" + common.reqInfo(params) + ": Query contains disallowed operator: " + badOp);
+       return common.returnMessage(params, 400, "Query contains disallowed operator: " + badOp);
+   }
+   ```
+   `$expr` is allowed; `$where`/`$function`/`$accumulator` are rejected at any depth (including nested inside `$expr`). Log the rejection at the call site using the file's `log` and `common.reqInfo(params)` (which adds the endpoint path/method, without the api_key). Do NOT pass `params` into `parseUserQuery` and do NOT log inside it.
+
 ## File Locations
 
 | What | Where |

SECURITY.md

@@ -13,7 +13,28 @@ All software related security bugs with severity of medium and higher will be aw
 
 **Low** - no bounty rewards, does not directly lead to vulnerability, but provides a possibility (like exposing software version, which can be mapped to specific vulnerabilities), old dependencies, server misconfiguration
 
-**Exclusion**
+**Exclusions (out of scope — not eligible for bounty)**
 
-Server specific configurations and deployment specific configurations due to on premise nature of our software.
-All server configuration related issues will be reported to related departments/parties/companies, but we cannot guarantee any bounty rewards for them.
+The following are out of scope. They may still be reported, and configuration issues will be forwarded to the relevant parties, but they do not qualify for a bounty reward:
+
+1. **Deployment & server configuration.** Server-specific and deployment-specific configuration issues, due to the on-premises nature of our software (TLS setup, reverse-proxy/CORS/header configuration, exposed ports, OS/database hardening, rate-limiting tuning, etc.). These are forwarded to the relevant departments/parties/companies but carry no bounty guarantee.
+
+2. **Privileged / admin-only endpoints behaving as designed.** Endpoints intended to be used only by authenticated global administrators or trusted server operators — for example `/mobile-login` and other operator/management endpoints — are not vulnerabilities when they require the privileges they are designed to require. "A global admin can do X across the system" is by design; global admin is a fully trusted role.
+
+3. **By-design cross-app access for global admins.** Plugins and features whose documented purpose is to aggregate or operate on data across multiple applications for global administrators are working as intended. Accessing cross-app data while holding global-admin rights is not a privilege escalation.
+
+4. **Findings that require code already fixed in the current codebase.** Reports reproduced only against an outdated or unpatched running server, demo, or hosted instance — where the issue is already fixed in the current source — are not eligible. Bounty assessment is made against the current code in this repository.
+
+5. **Excluded plugins.** Plugins that are not enabled by default — i.e. not listed in `plugins/plugins.default.json` — are out of scope, since they may be experimental, uncommonly used, or deprecated. In addition, the `consolidate` and `errorlogs` plugins are out of scope even though they are enabled by default.
+
+6. **Reliance on already-privileged access.** Issues that require the attacker to already hold rights equal to or greater than the access obtained (e.g. needing global admin to reach data a global admin already sees), or that depend on knowing a non-enumerable identifier of another tenant that is only ever exposed to authorized users.
+
+7. **Duplicates and already-known issues.** Reports duplicating an already-reported or already-fixed issue; only the first actionable report is eligible.
+
+8. **Theoretical, self-inflicted, or hardening-only issues.** Issues without a working proof of concept, self-inflicted issues (self-XSS, pasting attacker scripts into one's own console/session), and missing best-practice hardening that does not itself lead to an exploit (covered under "Low" above).
+
+9. **Hooks custom-code effects.** The Hooks plugin's custom-code effect runs operator-supplied JavaScript and is being migrated to a stronger isolation model (`isolated-vm`) in an upcoming release, which removes the existing execution surface entirely. Issues that depend on the behaviour of the current custom-code sandbox (for example escaping or abusing the bundled sandbox's built-in helpers) are out of scope. Note that the Hooks plugin already requires an authenticated account with the relevant per-app hooks permission, and the custom-code effect executes code the operator themselves configured.
+
+10. **Instances of a vulnerability class already under active remediation.** Findings that are additional instances of a vulnerability class we are already remediating — including work visible in an open or in-progress pull request, a public branch, or another not-yet-released fix — are considered part of that known, ongoing effort and are not separately eligible. Enumerating sibling occurrences of an issue from our published or in-progress remediation is not an independent discovery. Independently discovered issues remain welcome.
+
+11. **Cross-site scripting (XSS) without a working proof of concept.** XSS reports that do not demonstrate actual script execution in an authenticated dashboard session are out of scope. Pointing at a potential sink (for example a `v-html` binding or a DOM write) is not sufficient on its own, since the value reaching a sink may already be neutralized elsewhere in the request handling or rendering pipeline. XSS with a working end-to-end proof of concept — including DOM-based XSS that originates from the URL or other client-controlled input — is in scope and welcome.

api/api.js

@@ -441,6 +441,17 @@ plugins.connectToAllDatabases().then(function() {
                 key: fs.readFileSync(common.config.api.ssl.key),
                 cert: fs.readFileSync(common.config.api.ssl.cert)
             };
+            // Optional: let operators pin the negotiated TLS protocol range
+            // (e.g. minVersion "TLSv1.2"). Left unset by default so Node keeps
+            // its built-in defaults — deployments that still require older
+            // protocols, or that terminate TLS at nginx/their webserver, are
+            // unaffected.
+            if (common.config.api.ssl.minVersion) {
+                sslOptions.minVersion = common.config.api.ssl.minVersion;
+            }
+            if (common.config.api.ssl.maxVersion) {
+                sslOptions.maxVersion = common.config.api.ssl.maxVersion;
+            }
             if (common.config.api.ssl.ca) {
                 sslOptions.ca = fs.readFileSync(common.config.api.ssl.ca);
             }

api/config.sample.js

@@ -74,6 +74,8 @@ var countlyConfig = {
             key: "/path/to/ssl/private.key",
             cert: "/path/to/ssl/certificate.crt",
             // ca: "/path/to/ssl/ca_bundle.crt" // Optional: for client certificate verification, uncomment to activate
+            // minVersion: "TLSv1.2", // Optional: pin the lowest allowed TLS protocol (e.g. "TLSv1.2"). Unset = Node defaults
+            // maxVersion: "TLSv1.3", // Optional: pin the highest allowed TLS protocol. Unset = Node defaults
         }
     },
     /**

api/parts/data/events.js

@@ -329,6 +329,10 @@ function processEvents(appEvents, appSegments, appSgValues, params, omitted_segm
                 if (segKey === "") {
                     continue;
                 }
+                //skip keys that map to object prototype members when used as field names
+                if (segKey === "__proto__" || segKey === "constructor" || segKey === "prototype") {
+                    continue;
+                }
 
                 if (pluginsGetConfig.event_segmentation_limit &&
                         appSegments[currEvent.key] &&