Munkireport 5.3.0

5.3.0 (March 09, 2020)

This release contains some major security fixes. Please upgrade to this version as soon as possible.
To help mitigate the vulnerabilities, all modules got a security update.
Special thanks to Edouard Schweisguth from Datadog who wrote the security report and helped us resolve these issues.
Also thanks @joncrain, @tuxudo, @poundbangbash and @rickheil for helping out.

SECURITY UPDATES

• XSS vulnerability
• Authenticated Comment XSS
• Authenticated SQL injection

FIXES

• Harden datatables
• Harden sessions
• Harden handling of reports
• Updating applications to latest version (#1319)
• Add removehandler to .htaccess

FEATURES

• New widget template for developers

MODULE UPDATES

• munkireport/reportdata (v2.4 => v2.6)
• munkireport/event (v3.1 => v3.2)
• munkireport/warranty (v2.2 => v2.3)
• munkireport/applications (v1.1 => v2.2)
• munkireport/backup2go (v1.1 => v1.2)
• munkireport/bluetooth (v1.2 => v1.3)
• munkireport/caching (v1.3 => v1.4)
• munkireport/certificate (v1.2 => v1.3)
• munkireport/comment (v2.1 => v2.2)
• munkireport/crashplan (V1.6 => v1.7)
• munkireport/deploystudio (v1.2 => v1.3)
• munkireport/devtools (v1.1 => v1.2)
• munkireport/directory_service (v1.1 => v1.2)
• munkireport/extensions (v1.1 => v1.2)
• munkireport/fan_temps (V1.6 => v1.7)
• munkireport/filevault_status (V1.2 => v1.3)
• munkireport/findmymac (v1.3 => v1.4)
• munkireport/firmware_escrow (v1.1 => v1.2)
• munkireport/fonts (v1.1 => v1.2)
• munkireport/gpu (v1.1 => v1.2)
• munkireport/gsx (v2.0 => v2.1)
• munkireport/homebrew (v1.1 => v1.2)
• munkireport/homebrew_info (v1.1 => v1.2)
• munkireport/ibridge (v1.4 => v1.5)
• munkireport/location (V1.2 => v1.3)
• munkireport/mbbr_status (v1.1 => v1.2)
• munkireport/mdm_status (v1.11 => v1.12)
• munkireport/munki_facts (v1.3 => v1.4)
• munkireport/munkiinfo (v1.1 => v1.2)
• munkireport/munkireportinfo (v1.3 => v1.4)
• munkireport/network_shares (v1.1 => v1.2)
• munkireport/power (v1.1 => v1.2)
• munkireport/printer (v1.1 => v1.2)
• munkireport/sccm_status (v1.1 => v1.2)
• munkireport/security (v1.6 => v1.7)
• munkireport/sentinelone (v1.1 => v1.2)
• munkireport/sentinelonequarantine (v1.1 => v1.2)
• munkireport/smart_stats (v1.1 => v1.2)
• munkireport/softwareupdate (v1.2.1 => v1.3)
• munkireport/sophos (v1.2 => v1.3)
• munkireport/supported_os (V1.8 => v1.9)
• munkireport/tag (v2.1 => v2.2)
• munkireport/timemachine (v1.4 => v1.5)
• munkireport/usage_stats (v1.1 => v1.2)
• munkireport/usb (V1.2 => v1.4)
• munkireport/user_sessions (V1.4 => v1.5)
• munkireport/wifi (v1.1 => v1.2)
• munkireport/machine (v2.5 => v3.0)

DEPENDENCY UPDATES

• league/flysystem (1.0.64 => 1.0.65)
• doctrine/dbal (v2.9.3 => v2.10.1)
• vlucas/phpdotenv (v4.1.0 => v4.1.1)
• symfony/yaml (v3.4.37 => v3.4.38)
• symfony/var-dumper (v4.4.4 => v5.0.5)
• tightenco/collect (v6.15.0 => v7.0.5)
• adldap2/adldap2 (v10.2.2 => v10.2.3)
• symfony/service-contracts (v1.1.8 => v2.0.1)
• symfony/console (v4.4.4 => v4.4.5)
• symfony/process (v4.4.4 => v4.4.5)
• symfony/translation-contracts (v1.1.7 => v2.0.1)
• symfony/translation (v4.4.4 => v4.4.5)
• nesbot/carbon (2.30.0 => 2.31.0)
• symfony/finder (v4.4.4 => v4.4.5)

Munkireport 5.2.0

5.2.0 (February 13, 2020)

Some module updates and fixes. Inventory now has single app widget support: see https://github.com/munkireport/inventory/blob/master/README.md#single-app-widget
There's a fix for SAML groups that have commas in the name.

FEATURES

• Hide the empty blank "Group 0" machine group (#1130)

MODULE UPDATES

• munkireport/inventory (v3.0 => v3.1)
• munkireport/crashplan (V1.5 => V1.6)
• munkireport/findmymac (v1.2 => v1.3)
• munkireport/mdm_status (v1.9 => v1.11)
• munkireport/power (v1.0 => v1.1)

DEPENDENCY UPDATES

• symfony/translation-contracts (v1.1.7 => v2.0.1)
• symfony/polyfill-mbstring (v1.13.1 => v1.14.0)
• nesbot/carbon (2.29.1 => 2.30.0)
• symfony/polyfill-php73 (v1.13.1 => v1.14.0)
• symfony/service-contracts (v1.1.8 => v2.0.1)
• league/flysystem (1.0.63 => 1.0.64)
• doctrine/dbal (v2.9.3 => v2.10.1)
• symfony/polyfill-ctype (v1.13.1 => v1.14.0)
• vlucas/phpdotenv (v3.6.0 => v4.1.0)
• symfony/var-dumper (v4.4.4 => v5.0.4)
• tightenco/collect (v6.13.0 => v6.15.0)

Munkireport 5.1.5

5.1.5 (February 02, 2020)

Mostly module updates, and a small fix for apache servers.
Security module now reports on Secure Boot and External Boot thanks to @poundbangbash Note that this change needs a database migration.

MODULE UPDATES

• munkireport/reportdata (v2.3 => v2.4)
• munkireport/location (v1.1 => V1.2)
• munkireport/mdm_status (v1.7 => v1.9)
• munkireport/security (V1.5 => v1.6)
• munkireport/supported_os (v1.7 => V1.8)
• munkireport/user_sessions (v1.3 => V1.4)

DEPENDENCY UPDATES

• symfony/yaml (v3.4.36 => v3.4.37)
• symfony/var-dumper (v4.4.2 => v4.4.4)
• tightenco/collect (v6.11.0 => v6.13.0)
• symfony/console (v4.4.2 => v4.4.4)
• symfony/process (v4.4.2 => v4.4.4)
• symfony/translation (v4.4.2 => v4.4.4)
• nesbot/carbon (2.28.0 => 2.29.1)
• symfony/finder (v4.4.2 => v4.4.4)

Munkireport 5.1.4

5.1.4 (January 20, 2020)

This is a bug fix release. Most notable change: the model lookup now happens in the machine module and not in the warranty module anymore.

FIXES

• Remove deprecated get_magic_quotes_gps()
• XSS fix in debug mode
• Clean exit when server is unavailable

MODULE UPDATES

• munkireport/machine (v2.3 => v2.5)
• munkireport/warranty (v2.1 => v2.2)
• munkireport/fan_temps (v1.5 => V1.6)

DEPENDENCY UPDATES

• guzzlehttp/guzzle (6.4.1 => 6.5.2)
• symfony/process (v4.3.7 => v4.4.2)
• symfony/polyfill-php73 (v1.12.0 => v1.13.1)
• symfony/polyfill-mbstring (v1.12.0 => v1.13.1)
• symfony/console (v4.3.7 => v4.4.2)
• symfony/translation (v4.3.7 => v4.4.2)
• nesbot/carbon (2.26.0 => 2.28.0)
• illuminate/contracts (v5.8.35 => v5.8.36)
• illuminate/support (v5.8.35 => v5.8.36)
• illuminate/console (v5.8.35 => v5.8.36)
• illuminate/container (v5.8.35 => v5.8.36)
• illuminate/database (v5.8.35 => v5.8.36)
• symfony/finder (v4.3.7 => v4.4.2)
• illuminate/filesystem (v5.8.35 => v5.8.36)
• league/flysystem (1.0.57 => 1.0.63)
• symfony/polyfill-ctype (v1.12.0 => v1.13.1)
• symfony/yaml (v3.4.34 => v3.4.36)
• symfony/polyfill-php72 (v1.12.0 => v1.13.1)
• symfony/var-dumper (v4.3.7 => v4.4.2)
• tightenco/collect (v6.4.1 => v6.11.0)
• adldap2/adldap2 (v10.2.0 => v10.2.2)
• onelogin/php-saml (3.3.1 => 3.4.1)
• monolog/monolog (1.25.1 => 1.25.3)
• doctrine/cache (1.9.0 => 1.10.0)
• phpoption/phpoption (1.5.2 => 1.7.2)

Munkireport 5.1.3

5.1.3 (November 12, 2019)

FEATURES

• Added an upgrade script (@lcsees)
• Added a docker compose example (@b-reich)

FIXES

• MySQL port is now correctly used in admin panel
• Server timeout is now 60 seconds for slow servers
• Filter scripts for @ sign (Synology issue)
• LaunchDaemon changed to use KeepAlive instead of WatchPaths - should prevent the runner from starting twice

MODULE UPDATES

• munkireport/crashplan (v1.4 => V1.5)
• munkireport/managedinstalls (v2.2 => V2.3)

DEPENDENCY UPDATES

• guzzlehttp/guzzle (6.3.3 => 6.4.1)
• doctrine/event-manager (v1.0.0 => 1.1.0)
• doctrine/cache (v1.8.0 => 1.9.0)
• doctrine/dbal (v2.9.2 => v2.10.0)
• symfony/yaml (v3.4.32 => v3.4.33)
• symfony/var-dumper (v4.3.5 => v4.3.6)
• tightenco/collect (v6.3.0 => v6.4.1)
• psr/log (1.1.0 => 1.1.2)
• adldap2/adldap2 (v10.1.1 => v10.2.0)
• robrichards/xmlseclibs (3.0.3 => 3.0.4)
• onelogin/php-saml (3.3.0 => 3.3.1)
• symfony/service-contracts (v1.1.7 => v1.1.8)
• symfony/console (v4.3.5 => v4.3.6)
• symfony/process (v4.3.5 => v4.3.6)
• doctrine/inflector (v1.3.0 => 1.3.1)
• symfony/translation (v4.3.5 => v4.3.6)
• nesbot/carbon (2.25.2 => 2.26.0)
• symfony/finder (v4.3.5 => v4.3.6)
• phpoption/phpoption (1.5.0 => 1.5.2)

Munkireport 5.1.2

5.1.2 (October 19, 2019)

Increase default script timeout to 30 seconds

MODULE UPDATES

• munkireport/security (v1.4 => V1.5)

DEPENDENCY UPDATES

• nesbot/carbon (2.25.1 => 2.25.2)
• league/flysystem (1.0.55 => 1.0.57)
• tightenco/collect (v6.2.0 => v6.3.0

Munkireport 5.1.1

5.1.1 (October 09, 2019)

Notable changes: XSS patch, Catalina support for Storage report (@rickheil)
filevault status rewrite (@tuxudo), mdm_status detail widget (@poundbangbash)

FIXES

• Prevent Cross Site Scripting attack (XSS) on login form

MODULE UPDATES

• munkireport/disk_report (v2.4 => v2.7)
• munkireport/filevault_status (v1.1 => V1.2)
• munkireport/localadmin (v2.1 => v2.2)
• munkireport/mdm_status (v1.6 => v1.7)
• munkireport/network (v2.3 => v2.4)

DEPENDENCY UPDATES

• symfony/yaml (v3.4.31 => v3.4.32)
• symfony/var-dumper (v4.3.4 => v4.3.5)
• tightenco/collect (v6.0.3 => v6.2.0)
• symfony/service-contracts (v1.1.6 => v1.1.7)
• symfony/console (v4.3.4 => v4.3.5)
• symfony/process (v4.3.4 => v4.3.5)
• symfony/translation-contracts (v1.1.6 => v1.1.7)
• symfony/translation (v4.3.4 => v4.3.5)
• nesbot/carbon (2.24.0 => 2.25.1)
• symfony/finder (v4.3.4 => v4.3.5)

Munkireport 5.1.0

5.1.0 (September 24, 2019)

Some bugfixes and a change on how the client summary tab is rendered. Removed legacy modules.

NEW FEATURES

• Customizable client summary tab https://github.com/munkireport/munkireport-php/wiki/Client-Summary-Tab

FIXES

• Fix issue with extra slashes in URL. Some web servers can't handle the double slash and fail. (#1275) @poundbangbash
• Fix munkireport-runner: Add long_username and uid

MODULE UPDATES

• Removed munkireport/service (v1.1)
• Removed munkireport/servermetrics (v1.1)
• munkireport/ard (v2.0 => 2.1)
• munkireport/machine (v2.2 => v2.3)
• munkireport/disk_report (v2.3 => v2.4)
• munkireport/warranty (v2.0 => v2.1)
• munkireport/appusage (v2.1 => v2.2)
• munkireport/bluetooth (v1.1 => v1.2)
• munkireport/caching (v1.2 => v1.3)
• munkireport/comment (v2.0 => v2.1)
• munkireport/crashplan (v1.2 => v1.4)
• munkireport/detectx (v2.1 => v2.2)
• munkireport/fan_temps (V1.4 => v1.5)
• munkireport/localadmin (v2.0 => v2.1)
• munkireport/network (v2.2 => v2.3)
• munkireport/security (v1.3 => v1.4)
• munkireport/timemachine (v1.3 => v1.4)
• munkireport/user_sessions (v1.2 => v1.3)

DEPENDENCY UPDATES

• adldap2/adldap2 (v10.1.0 => v10.1.1)

Munkireport 5.0.1

5.0.1 (September 19, 2019)

Small bugfix release which incorporates updated modules.

MODULE_UPDATES

• munkireport/disk_report (v2.1 => v2.3)
• munkireport/certificate (v1.1 => v1.2)

Munkireport 5.0.0

5.0.0 (September 18, 2019)

This release changes the way MunkiReport runs on the client. MunkiReport now has it's own launchDaemon, which means that it will no longer take up time when munki runs it's pre- and postflight scripts.
The MunkiReport scripts have moved to /usr/local/munkireport
MunkiReport log files are now found in /Library/MunkiReport/Logs/

To take advantage of the new scripts, create a new client package and distribute to your munki clients.

IMPORTANT
MunkiReport does not run scripts in /usr/local/munki/preflight.d, /usr/local/munki/postlight.d and /usr/local/munki/preflight_abort.d anymore! If you depended on these locations, please consider creating your own implementation for these. Also note that MunkiReport will not clean up the legacy directories.

MODULE UPDATES

• munkireport/profile (v1.2 => v2.0)
• munkireport/machine (v2.1 => v2.2)
• munkireport/munkireport (3.0 => 3.1)

DEPENDENCY UPDATES

• symfony/process (v4.3.4)
• symfony/service-contracts (v1.1.6)
• symfony/polyfill-php73 (v1.12.0)
• symfony/polyfill-mbstring (v1.11.0 => v1.12.0)
• symfony/console (v3.4.29 => v4.3.4)
• symfony/translation-contracts (v1.1.6)
• symfony/translation (v3.4.29 => v4.3.4)
• nesbot/carbon (1.39.0 => 2.24.0)
• illuminate/contracts (v5.5.44 => v5.8.35)
• doctrine/inflector (v1.2.0 => v1.3.0)
• illuminate/support (v5.5.44 => v5.8.35)
• illuminate/console (v5.5.44 => v5.8.35)
• illuminate/container (v5.5.44 => v5.8.35)
• illuminate/database (v5.5.44 => v5.8.35)
• symfony/finder (v3.4.29 => v4.3.4)
• illuminate/filesystem (v5.5.44 => v5.8.35)
• league/flysystem (1.0.53 => 1.0.55)
• doctrine/event-manager (v1.0.0)
• doctrine/cache (v1.6.2 => v1.8.0)
• doctrine/dbal (v2.5.13 => v2.9.2)
• symfony/polyfill-ctype (v1.11.0 => v1.12.0)
• vlucas/phpdotenv (v3.4.0 => v3.6.0)
• symfony/yaml (v3.4.29 => v3.4.31)
• symfony/polyfill-php72 (v1.12.0)
• symfony/var-dumper (v4.3.4)
• tightenco/collect (v6.0.3)
• adldap2/adldap2 (v10.0.11 => v10.1.0)
• onelogin/php-saml (3.2.1 => 3.3.0)
• monolog/monolog (1.24.0 => 1.25.1)