DSpace 10.1 is now available!
DSpace Technical Support
We are pleased to announce the release of DSpace 10.1! This release provides security fixes and bug fixes to the 10.x platform. No new features are provided. As such, this release should be an easier upgrade for sites already running 10.x.
Security Fixes
Fix for GHSA-4783-qprq-45x8 (high severity) Process DELETE endpoint is unprotected. This means process deletion can be performed by anonymous users via the REST API (if they can determine a process ID). (Donated by 4Science)
Fix for GHSA-fc3c-5p62-2cx7 (high severity) Path traversal vulnerability possible via the “-z” parameter of the “import” script (Batch Import via Zip).
Fix for GHSA-5xvx-grf4-4p7w (high severity) Path traversal vulnerability possible via “export” script (Batch Export via Zip) via a malicious bitstream name. (Donated by 4Science)
Fix for GHSA-4ppv-j692-84v9 (high severity) EPerson registration tokens are not being properly validated. This allows new registrations to potentially be invalidated by anonymous users. An attacker who is a registered user may also be able to “bind” the ORCID of another user who is actively creating an account via ORCID.
Fix for GHSA-758x-q228-3vqp (moderate severity) Restricted bitstream information (size, md5, filename) can be retrieved anonymously via a bypass of the request a copy “accessToken”. This does not allow access to bitstream file contents. (Donated by 4Science)
Fix for GHSA-qff6-8wrh-2frw (moderate severity) A malicious OAI-ORE remote service can trick DSpace into “harvesting” internal data available via HTTP. This only impacts OAI-ORE harvesting and not OAI-PMH harvesting. (Donated by 4Science)
Fix for GHSA-vrvf-x356-9vhv (moderate severity) Cross-site scripting (XSS) attacks are possible via the “dc.description.abstract” field in 10.0 only. (Donated by Atmire)
Breaking Changes
No breaking changes are included in this minor release.
Major Bug fixes / improvements include:
Fixed bug where DOI Organiser batch processing could run into an infinite loop or send large volumes of email. #12728 (Donated by engsterhold)
Fixed bug where users were missing edit permissions on automatically claimed researcher profiles. #12106 (Donated by Eric Penneçot)
Fixed several errors that occurred when running the healthcheck command. #10805 (Donated by Nicholas Woodward)
Integration fixes
Fixed an issue with XML encoding in the OAI-PMH interface. #12409 (Donated by Atmire)
Fixed "Unknown metadata format" errors occurring on OAI-PMH interface due to hard-coded oai_dc prefix. #9770, #10106 (Donated by Acervos Digitais)
Fixed bug where DOI was not mapped into DSpace when importing from Pubmed records. #11961 (Donated by D-Consultores)
Added secure methods related to TransformerFactory to protect against XXE style attacks, especially in OAI-PMH. #12681, #12721.
Hardened Crossref deposit response parsing to protect against unsecured responses from Crossref API. #12679 (Donated by TonghuaRoot)
Added basic sanitization to the experimental IIIF Search API feature. #13072
Administrative fixes
REST API fixes
Improved the external sources REST endpoints by restricting them to authenticated users only. #12660
Improved item versioning REST endpoint by adding PreAuthorize annotation. #13048
Added JSON payload and URL parameter validation to registration REST API endpoints. #12695 (Donated by Sascha Szott)
Fixed bug where unauthorized users could access a collection's Item Template metadata. #12979 (Donated by jjj-n)
Updated several regular expressions applied to user-supplied values to improve performance and security. #13089 (Donated by Atmire)
Search Engine Optimization (SEO) fixes
Fixed an issue where Health actuator would return DOWN status for missing SEO configuration. #12672 (Donated by 4Science)
Added warnings to SSR-related configuration about the risk of SEO impacts. #6075; See also updated documentation for SEO.
Fixed other small bugs. See Changes in 10.x for a list of all changes.
New and improved Language support
German (Deutsch) language updates donated by Sascha Szott (saschaszott)
A total of 23 individuals contributed to 10.1. For a full list of changes and contributors in 10.1, see our Release Notes.
Would you like to contribute to a future DSpace release?
DSpace is built and supported by community volunteers. We have no centralized development team. Therefore, we welcome contributions from anyone! Contributions may take the form of:
Contributing money to our DSpace Development Fund - All funds go directly towards development in the next release(s), and you will be acknowledged on our DSpace Development Fund page.
Contributing code - As a volunteer developer you can determine which issue ticket you’d like to work on. Join our weekly developer meetings or get in touch with Tim Donohue if you have any questions.
If you’d like more information on ongoing development, please consider joining our weekly developer meetings, or follow along by reading the public notes of past meetings.