dbFront 1.4.2, Bug Bounty, Performance and ProcedureAPI

Last year we started a Bug Bounty for dbFront. The Bug Bounty received a number of responses with most reports pointing at server configuration issues, and two reports pointing at the need to secure the application Javascript in the browser.

In response, we updated dbFront to enforce server file integrity checks and automatically block any unrecognized or injected JavaScript. Because dbFront version 1.4.1 and earlier lacked these JavaScript restrictions, they are susceptible to the Cross-Site Scripting (XSS) attack uncovered during the bounty program.  The patch released for dbFront 1.4.1 targets only the specific exploit demonstrated in the Bug Bounty. To permanently close the underlying attack vector, users should upgrade to dbFront 1.4.2.

Every dbFront installation is unique, and needs to be secured separately. In response to the configuration issues uncovered by the bug bounty program, we integrated a simple scanner directly into dbFront. This allows each administrator to proactively detect and resolve potential configuration & security issues in their own environment. For more details see: Security Scan

The security changes took longer to settle out because we were forced to rebuild our testing environment to work within the new security restrictions.

dbFront 1.4.2 - Security, Performance, Procedure API

dbFront 1.4.2 is now in the stable position on the download page. The security changes triggered by the bug bounty are the most significant new features. Beyond that, dbFront 1.4.2 also includes cleaner and faster selection and filtering queries. The ProcedureAPI was also extended and stabilized.

Along with the list of features, dbFront 1.4.2 also contains 48 bug fixes to various areas including security, record locking and more.

Below is the detailed feature list. A number of the features were requested via the Q&A.

• Attachments: Allow "Camera Only" uploads
• Expressions:
  • Added the [Can See Table] security expression (formerly Row Security) Q&A
  • Added IsGroupMemberNetwork() and IsGroupMemberSSO() for use in security expressions. Q&A
• Form: Optionally preload the top record.
• Layout: Added table CSS higher to allow more layout control.
• ProcedureAPI:
  • Add the Debug Info to dialogs even if no form or buttons.
  • Allow direct BLOB/VarBinary (e.g. PDF) results. (Display/Download)
  • Limit recursion to level explicitly permitted by 'MaxRecursion', Default = 0.
  • OpenObject(%objectdata%, %filename%), See: ProcedureAPI
  • OpenTable() allow record and field selection (e.g. Attachment).
  • SendEmail() allow imbedded tables {%Table_1%}, {%Table_2%}
• QuickSearch:
  • Improved search performance and index use on all join types.
  • Optionally limit the columns searched. Q&A
• SSO
  • Allow testing Database(procedure) security on LocalHost while SSO is enabled.
  • Added optional Login Redirect Url. Often required by a LoadBalancer or Proxy.
  • Make the use of the Microsoft Graph API optional with Azure.
• Security:
  • Add/Enforce Integrity Checks on all scripts.
  • Enforce use of secure cookies on secure connections.
  • Lock down embedded scripts to prevent injection attacks.
• SystemMonitor:
  • Added Active Sessions list to the System Monitor
  • Added Security Scan to the System Monitor to help secure local installs.
• WebRequest: On error, parse response JSON to show error detail provided by some APIs.

The full release history for the 1.4.2 branch can be found at dbFront.com/releasehistory

More to come...

• A near future post will cover the new 1.4.5 version of dbFront which includes performance updates for large Excel/CSV imports and new SSO support for Windows Identities and Server Headers.
   
• Work has also begun on PostgreSQL support!  Because this involves much more than simply adding a new database driver, it is currently targeted for dbFront version 1.5.0.
   
• AI integration is under consideration for dbFront!  This could become an early-access investment opportunity, with special savings and priority access for participating investors.
   
• and one more ...  I know a user who is currently developing a web store for dbFront-based database applications. It might be a good idea to polish up any projects you think would be a good fit.

Summary

We have been doing a lot of work to secure and enhance dbFront and to update the supporting documentation. If you have time, please consider creating or updating a review of dbFront.

Please see Submit Review for more details. The less effort we spend on sales and advertising, the more effort we can spend on improving and stabilizing dbFront.

Thanks - The Team at dbFront

Image from Melani Marfeld - Pixabay