Mica 7.0 Released
We are pleased to announce that Mica 7.0 is now available. Mica is OBiBa’s data web portal for epidemiological studies and harmonization initiatives.
This is a security-focused major release, with the following key changes:
- Two-factor authentication feedback: a wrong 2FA code keeps the 2FA step open and shows “Invalid or expired code”, instead of returning to the credentials form with a generic failure.
- Open redirect closed: the
redirectparameter of the sign-in, sign-up and/checkpages only accepts a path on the Mica server or a URL on the Agate server. - Credentials kept out of logs: remote credentials for the study import are sent in request headers instead of query parameters, and session IDs no longer appear in logs.
- XSS hardening: security response headers, Markdown sanitized with DOMPurify, safe custom page names, and uploaded files displayed inline only for PDF, raster images, plain text, CSV and TSV.
- Authorization on administration endpoints: changing log levels and custom translations requires the
mica-administratorrole. - Roles mapping applied everywhere: the Agate groups mapped through the
roles.<role>settings are now used for notifications, user lists, sign-up and contact, not only at sign-in. - Clean deletions: deleting a data access request or an entity removes all of its permissions, comments, collaborators and files.
It also brings a few new features:
- Editors and reviewers are notified when an entity or a file is published or unpublished; readers of private comments on data access requests (e.g. a data access committee) are notified of these comments.
- Files attached to a data access form can be downloaded as a ZIP archive.
- Research project files can be browsed from the published project page.
This release contains breaking changes and requires some attention from the system administrator (Agate 5.1 or later is required). Please read the Mica upgrade notes before upgrading.
See also the Mica documentation for installation and operation instructions.