Update Testresult

SECURITY.md

@@ -32,8 +32,12 @@ To receive fixes for security vulnerabilities it is required to always upgrade t
 | V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                   ||
 | V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                               ||
 | V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @nhiephon             ||
+| V 0.6.16      | It's prevented to get the name of a private shelfs. Thanks to @nhiephon                                            ||
 | V 0.6.17      | The SSRF Protection can no longer be bypassed via an HTTP redirect. Thanks to @416e6e61                            ||
 | V 0.6.17      | The SSRF Protection can no longer be bypassed via 0.0.0.0 and it's ipv6 equivalent. Thanks to @r0hanSH             ||
+| V 0.6.18      | Possible SQL Injection is prevented in user table  Thanks to Iman Sharafaldin (Forward Security)                   ||
+| V 0.6.18      | The SSRF protection no longer can be bypassed by IPV6/IPV4 embedding. Thanks to  @416e6e61                         ||
+| V 0.6.18      | The SSRF protection no longer can be bypassed to connect to other servers in the local network. Thanks to @michaellrowley ||
 
 
 ## Statement regarding Log4j (CVE-2021-44228 and related)

cps/constants.py

@@ -154,7 +154,7 @@ def selected_roles(dictionary):
 BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, '
                                   'series_id, languages, publisher')
 
-STABLE_VERSION = {'version': '0.6.18 Beta'}
+STABLE_VERSION = {'version': '0.6.18'}
 
 NIGHTLY_VERSION = dict()
 NIGHTLY_VERSION[0] = '$Format:%H$'

setup.cfg

@@ -38,6 +38,7 @@ console_scripts =
 [options]
 include_package_data = True
 install_requires = 
+	werkzeug<2.1.0
 	Babel>=1.3,<3.0
 	Flask-Babel>=0.11.1,<2.1.0
 	Flask-Login>=0.3.2,<0.5.1
@@ -52,9 +53,10 @@ install_requires =
 	tornado>=4.1,<6.2
 	Wand>=0.4.4,<0.7.0
 	unidecode>=0.04.19,<1.4.0
-	lxml>=3.8.0,<4.8.0
+	lxml>=3.8.0,<4.9.0
 	flask-wtf>=0.14.2,<1.1.0
 	chardet>=3.0.0,<4.1.0
+	advocate>=1.0.0,<1.1.0
 	
 
 [options.extras_require]
@@ -71,7 +73,7 @@ gdrive =
 	PyYAML>=3.12
 	rsa>=3.4.2,<4.9.0
 gmail = 
-	google-auth-oauthlib>=0.4.3,<0.5.0
+	google-auth-oauthlib>=0.4.3,<0.6.0
 	google-api-python-client>=1.7.11,<2.43.0
 goodreads = 
 	goodreads>=0.3.2,<0.4.0
@@ -84,7 +86,7 @@ oauth =
 	SQLAlchemy-Utils>=0.33.5,<0.39.0
 metadata = 
 	rarfile>=3.2
-	scholarly>=1.2.0,<1.6
+	scholarly>=1.2.0,<1.7
 	markdown2>=2.0.0,<2.5.0
 	html2text>=2020.1.16,<2022.1.1
 	python-dateutil>=2.1,<2.9.0

test/Calibre-Web TestSummary_Linux.html

@@ -37,20 +37,20 @@
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3" style="margin-top:50px;">
             
-            <p class='text-justify attribute'><strong>Start Time: </strong>2022-03-28 21:45:14</p>
+            <p class='text-justify attribute'><strong>Start Time: </strong>2022-04-03 07:19:10</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
             
-            <p class='text-justify attribute'><strong>Stop Time: </strong>2022-03-29 03:21:52</p>
+            <p class='text-justify attribute'><strong>Stop Time: </strong>2022-04-03 12:55:38</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
-           <p class='text-justify attribute'><strong>Duration: </strong>4h 46 min</p>
+           <p class='text-justify attribute'><strong>Duration: </strong>4h 47 min</p>
         </div>
       </div>
       </div>
@@ -1593,9 +1593,11 @@
                     </div>
                     <div class="text-left pull-left">
                         <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_metadata.py&#34;, line 167, in test_load_metadata
+  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_metadata.py&#34;, line 235, in test_load_metadata
-    self.assertGreaterEqual(diff(BytesIO(cover), BytesIO(original_cover), delete_diff_file=True), 0.05)
+    self.assertEqual(&#34;奇想西遊記1&#34;, results[3][&#39;title&#39;])
-AssertionError: 0.0 not greater than or equal to 0.05</pre>
+AssertionError: &#39;奇想西遊記1&#39; != &#39;巧讀西遊記&#39;
+- 奇想西遊記1
++ 巧讀西遊記</pre>
                     </div>
                     <div class="clearfix"></div>
                 </div>
@@ -4599,7 +4601,7 @@ AssertionError: 0.0 not greater than or equal to 0.05</pre>
           
             <tr>
               <th>Platform</th>
-              <td>Linux 5.13.0-37-generic #42~20.04.1-Ubuntu SMP Tue Mar 15 15:44:28 UTC 2022 x86_64 x86_64</td>
+              <td>Linux 5.13.0-39-generic #44~20.04.1-Ubuntu SMP Thu Mar 24 16:43:35 UTC 2022 x86_64 x86_64</td>
               <td>Basic</td>
             </tr>
           
@@ -4659,13 +4661,7 @@ AssertionError: 0.0 not greater than or equal to 0.05</pre>
           
             <tr>
               <th>Flask-WTF</th>
-              <td>1.0.0</td>
+              <td>1.0.1</td>
-              <td>Basic</td>
-            </tr>
-          
-            <tr>
-              <th>gevent</th>
-              <td>21.12.0</td>
               <td>Basic</td>
             </tr>
           
@@ -4719,7 +4715,13 @@ AssertionError: 0.0 not greater than or equal to 0.05</pre>
           
             <tr>
               <th>SQLAlchemy</th>
-              <td>1.4.32</td>
+              <td>1.4.34</td>
+              <td>Basic</td>
+            </tr>
+          
+            <tr>
+              <th>tornado</th>
+              <td>6.1</td>
               <td>Basic</td>
             </tr>