security: migrate Redis session serialization from pickle to standard json - #4570
Open
james7132 wants to merge 47 commits into
Open
security: migrate Redis session serialization from pickle to standard json#4570james7132 wants to merge 47 commits into
james7132 wants to merge 47 commits into
Conversation
Rolling back a change from MFF that breaks our existing servers.
Rename emergency procedures for West/Stock
Fix shifts item on volunteer checklist (West and Stock)
Update West/Stock from MFF
This helps us display extra add-ons in plugins.
This is what is need to make the printable schedule for MAGStock. Also fixes a long-standing bug in the XML schedule file where the start time wouldn't print.
Requested via Slack.
This was also affecting all other automated receipt changes... yikes.
Requested via Slack.
Requested via Slack.
I realized that the last change would prevent attendees from saving their own forms, AND that admins can override attendee staff status during at-con mode anyway, so we're taking it out.
Requested via Slack.
Using multi-platform docker builds
There was a bug where, even if a group didn't have Rock Island enabled in the system config, the server would tell them they needed to select whether or not they wanted a Rock Island Meet N Greet. This fixse that and also fixes a couple minor display issues with other steps on the band checklist.
Group leaders could be in a phantom state where they weren't shown as leaders, and if you moved someone out of a group they could still be the leader. This meant that, if you moved the only badge in a group to another group and then deleted the group, the badge would also get deleted. This commit is also for our older servers, so lacks an alpine integration -- that'll be in the next commit.
There's a breaking change that I Do Not Want To Deal With right now
haha whoops
We were asserting that no email were registered twice, but... that shouldn't actually do anything bad, and in fact should let us override emails in event plugins. So it's gone now.
Fixes an infinite recursion error in presave adjustments (whoops)
Requested via Slack. We won't need to bring this into the main plugin because of other changes we made for Panels.
I missed that all PanelAppEmail fixtures were excluding guests, and not just the one email I saw doing it separately.
We were still displaying panel events with 30-minute increments, leading to emails claiming that panels were 30+ hours long.
Somehow, we did not have this??
because they cannot
Due to an issue with parentheses we were accidentally passing a kwarg to session.add, rather than create_receipt_item. This should fix that.
Yum, race conditions
Enable all placeholder emails at the con
This should now filter out attendees that don't qualify for a volunteer-based refund at all.
- Remove fork restriction and allow pushes on branch updates and workflow dispatches - Add OCI image source and description labels for GitHub Packages repository linking
james7132
force-pushed
the
feat/json-redis-session
branch
from
July 20, 2026 04:14
04ebc38 to
1773b7c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pickleis essentially serialized Python bytecode, and can be used as an arbitrary code execution (ACE) vector. While everything touching Redis is controlled by Ubersystem and the risk of remote code, it's ideal ifpicklewas replaced with a more standard serialization format to minimize that risk.This PR changes
pickleout forjson. This cannot be deployed to an existing Ubersystem instance without breaking existing user sessions.