5.22.2 20260826 - #3231
Open
FrankApiyo wants to merge 7 commits into
Open
Conversation
The $or branch interpolated an attacker-controlled JSON key directly into the raw SQL WHERE fragment via an f-string when the key's value was null, while every sibling branch binds it with %s. Bind the key as a parameter, matching the existing IS NULL handling in _parse_where.
…ers, stats alias) (#48)
fix: parameterize DataView filter SQL and allow-list query columns Bind DataView filter column and value as query parameters instead of interpolating them into SQL, removing the %s-shift injection that bypassed the prior single-quote escaping. _additional_data_view_filters returns (fragment, params), the _postgres_* builders thread params through a %(additional_filters)s placeholder, and _execute_query binds them via cursor.execute(query, params). As an independent second layer, validate query[].column in DataViewSerializer against the form's field XPaths plus the metadata columns filtering treats as first-class (adds _date_modified, _submitted_by, _duration). Reject unknown columns, non-strings, and the Django lookup separator __; get_filter_kwargs drops the same unsafe columns at the consumption boundary so DataViews created directly or already stored cannot reach filter(**kwargs) with a column that escapes the json key boundary.
…3197) Creating a merged dataset from forms that use a trigger column failed with a PyXFormError because the processed trigger tuple is stored as a list in the form JSON and pyxform rejected the list when rebuilding the survey.
…LSForm (#3191) * Managed encryption and updating the public key via the API injects the public key into a form's stored json after publishing; the XLSForm file has no record of it. When parsing stale pre-pyxform-4.1.0 json fails and _get_survey falls back to rebuilding from the XLSForm, the rebuilt survey lost the key and a full save recomputed encrypted field as False. Re-inject the form's public_key into the rebuilt survey and workbook json * Data migration logger.0039_restore_flipped_encryption restoring already-flipped forms
… off (#3206) Encrypted envelopes received while a managed form's encrypted flag is False - flipped by the stale-json bug repaired in logger.0039, or after encryption is disabled while devices still hold an encrypted version - were not recognised by get_expected_media, so the attachment sweep soft-deleted their ciphertext right after creation and decryption failed with no files. Recognise encrypted envelopes whenever the form is or was under managed encryption, parse lone media nodes as lists under the same predicate, mark such submissions pending decryption, and add a data migration that restores swept ciphertext and decrypts the affected submissions.
#3232) * Updates all pinned Python dependencies to their latest minor and patch releases * Closes the known security advisories in the previous pins: Django: CVE-2026-48588, CVE-2026-53877, CVE-2026-53878 cryptography: CVE-2026-69247 Pillow: CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379 and others sqlparse: CVE-2026-54284, CVE-2026-59893, CVE-2026-59894, CVE-2026-71491 pyasn1: CVE-2026-59884, CVE-2026-59885, CVE-2026-59886 httplib2: CVE-2026-59939
FrankApiyo
force-pushed
the
5.22.2-20260826
branch
from
August 26, 2026 04:45
d360e12 to
37cadaf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes / Features implemented
Release branch for 5.22.2 (2026-08-26). Contains seven commits: SQL injection hardening in DataView chart/stats filters and related raw-SQL sinks (widget group_by, data view filters, stats alias,
$ornull-value handling inget_where_clause), three encryption fixes (preserving managed encryption status and encrypted submission ciphertext when rebuilding or reconfiguring forms, and trigger-list coercion when rebuilding surveys from JSON), and the pinned-dependency minor bumps also proposed in #3230.Steps taken to verify this change does what is intended
Full CI (unit tests, static analysis, security scans) passes on this branch content, and the Docker image builds successfully for amd64 and arm64.
Side effects of implementing this change
The dependency bump commit overlaps with #3230; merging either first leaves the other a trivial rebase.
Before submitting this PR for review, please make sure you have:
Closes #
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.