DSpace 9.4 is now available!
DSpace Technical Support
We are pleased to announce the release of DSpace 9.4! This release provides security fixes and bug fixes to the 9.x platform. No new features are provided. As such, this release should be an easier upgrade for sites already running 9.x.
Security Fixes
Fix for GHSA-4783-qprq-45x8 (high severity) Process DELETE endpoint is unprotected. This means process deletion can be performed by anonymous users via the REST API (if they can determine a process ID). (Donated by 4Science)
Fix for GHSA-fc3c-5p62-2cx7 (high severity) Path traversal vulnerability possible via the “-z” parameter of the “import” script (Batch Import via Zip).
Fix for GHSA-5xvx-grf4-4p7w (high severity) Path traversal vulnerability possible via “export” script (Batch Export via Zip) via a malicious bitstream name. (Donated by 4Science)
Fix for GHSA-4ppv-j692-84v9 (high severity) EPerson registration tokens are not being properly validated. This allows new registrations to potentially be invalidated by anonymous users. An attacker who is a registered user may also be able to “bind” the ORCID of another user who is actively creating an account via ORCID.
Fix for GHSA-758x-q228-3vqp (moderate severity) Restricted bitstream information (size, md5, filename) can be retrieved anonymously via a bypass of the request a copy “accessToken”. This does not allow access to bitstream file contents. (Donated by 4Science)
Fix for GHSA-qff6-8wrh-2frw (moderate severity) A malicious OAI-ORE remote service can trick DSpace into “harvesting” internal data available via HTTP. This only impacts OAI-ORE harvesting and not OAI-PMH harvesting. (Donated by 4Science)
Breaking Changes
We include a “Breaking Changes” section to the Release Notes to notify you of major changes which may impact your upgrade. Please visit the Release Notes for the full details.
A few key breaking changes to be aware of in DSpace 9.4:
Migration from SHERPA/RoMEO API to Jisc Open Policy Finder API. If you are using the SHERPA/RoMEO integration for submission forms, DSpace has been updated to use the new Jisc Open Policy Finder API because the Sherpa API has been retired. This means that the older "sherpa.romeo.*" settings (in dspace.cfg) have been replaced by "openpolicyfinder.*" settings (in external-providers.cfg). #12005
License and Text extraction bundles/files are now admin-only by default. Previously, license files and extracted text would inherit the permissions of the Item itself. Specific bundles (LICENSE, TEXT, SWORD) of files are now access-restricted by default. You can control which bundles are access restricted via the new "core.authorization.restricted-bundle" configuration in dspace.cfg. #12306
After upgrading you may wish to regenerate all extracted text in the TEXT bundle to ensure they are access restricted. See the Release Notes for details.
Major Bug fixes / improvements include:
Fixed bug where DOI Organiser batch processing could run into an infinite loop or send large volumes of email. #12728 (Donated by engsterhold)
Fixed bug where users were missing edit permissions on automatically claimed researcher profiles. #12106 (Donated by Eric Penneçot)
Fixed several errors that occurred when running the healthcheck command. #10805 (Donated by Nicholas Woodward)
Integration fixes
Fixed an issue with XML encoding in the OAI-PMH interface. #12409 (Donated by Atmire)
Fixed "Unknown metadata format" errors occurring on OAI-PMH interface due to hard-coded oai_dc prefix. #9770, #10106 (Donated by Acervos Digitais)
Added secure methods related to TransformerFactory to protect against XXE style attacks, especially in OAI-PMH. #12681, #12721.
Added basic sanitization to the experimental IIIF Search API feature. #13072
Administrative fixes
REST API fixes
Improved the external sources REST endpoints by restricting them to authenticated users only. #12660
Improved item versioning REST endpoint by adding PreAuthorize annotation. #13048
Added JSON payload and URL parameter validation to registration REST API endpoints. #12695 (Donated by Sascha Szott)
Fixed bug where unauthorized users could access a collection's Item Template metadata. #12979 (Donated by jjj-n)
Updated several regular expressions applied to user-supplied values to improve performance and security. #13089 (Donated by Atmire)
Search Engine Optimization (SEO) fixes
Fixed an issue where Health actuator would return DOWN status for missing SEO configuration. #12672 (Donated by 4Science)
Added warnings to SSR-related configuration about the risk of SEO impacts. #6075; See also updated documentation for SEO.
Fixed other small bugs. See Changes in 9.x for a list of all changes.
A total of 19 individuals contributed to 9.4. For a full list of changes and contributors in 9.4, see our Release Notes.
Would you like to contribute to a future DSpace release?
DSpace is built and supported by community volunteers. We have no centralized development team. Therefore, we welcome contributions from anyone! Contributions may take the form of:
Contributing money to our DSpace Development Fund - All funds go directly towards development in the next release(s), and you will be acknowledged on our DSpace Development Fund page.
Contributing code - As a volunteer developer you can determine which issue ticket you’d like to work on. Join our weekly developer meetings or get in touch with Tim Donohue if you have any questions.
If you’d like more information on ongoing development, please consider joining our weekly developer meetings, or follow along by reading the public notes of past meetings.