Flarum 1.6.3 awareness. Unfortunately can't tell it apart from 1.6.2

Author: clarkwinkelmann

app/FlarumVersion.php

@@ -34,6 +34,7 @@ class FlarumVersion
     const V1_6_0 = "1.6.0";
     const V1_6_1 = "1.6.1";
     const V1_6_2 = "1.6.2";
+    const V1_6_3 = "1.6.3";
 
     // MD5 hash of the javascript of Flarum core, excluding the sourcemap declaration
     // Obtained through the GetCoreJavascriptHash command
@@ -60,7 +61,7 @@ class FlarumVersion
         '903356c565c82e0d3c6a44e550c425b4' => self::V1_5_0,
         '4135a73e3ffe1b9d0e7116a3e5bca4a3' => self::V1_6_0,
         '702cd2efea1b34a8d7faa0a3bfd00ffc' => self::V1_6_1,
-        '65ca188696b18e8dae09bde8c4153c9a' => self::V1_6_2,
+        '65ca188696b18e8dae09bde8c4153c9a' => [self::V1_6_2, self::V1_6_3],
     ];
 
     public array $adminJavascriptHashes = [
@@ -86,7 +87,7 @@ class FlarumVersion
         'c3f70117d274b204fba315ed6d0d74cf' => self::V1_5_0,
         '230a43eaea321ec606294148f5d1fd5e' => self::V1_6_0,
         '0db372f871bdbb3ad775b47b5ff20125' => self::V1_6_1,
-        '57370588974a1e187c656a3497f78dee' => self::V1_6_2,
+        '57370588974a1e187c656a3497f78dee' => [self::V1_6_2, self::V1_6_3],
     ];
 
     public static function isBeta7(array $versions): bool

app/FlarumVersionGuesser.php

@@ -20,6 +20,7 @@ public function guess(string $html, string $bootScript): array
                 FlarumVersion::V1_6_0,
                 FlarumVersion::V1_6_1,
                 FlarumVersion::V1_6_2,
+                FlarumVersion::V1_6_3,
             ];
         }
 

app/Report/RatingAgent.php

@@ -40,21 +40,53 @@ public function rate()
                     // If we're unsure, we won't mark vulnerable
                     // If the list of guest versions is empty, we skip this test, this will happen for forums running a custom build
                     if (count($versions) && count(array_diff($versions, [
+                            // I remember there was a major fix in beta 13 but can't find details
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
                             FlarumVersion::BETA_7,
                             FlarumVersion::BETA_8,
+
+                            // I remember there was a major fix in beta 13 but can't find details
+                            // https://github.com/flarum/framework/security/advisories/GHSA-3wjh-93gr-chh6 Missing CSRF
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
                             FlarumVersion::BETA_9,
                             FlarumVersion::BETA_10,
                             FlarumVersion::BETA_11,
                             FlarumVersion::BETA_12,
-                        ])) === 0) {
-                        return true;
-                    }
 
-                    // https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854x
-                    if (count($versions) && count(array_diff($versions, [
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
+                            FlarumVersion::BETA_13,
+                            FlarumVersion::BETA_14,
+                            FlarumVersion::BETA_14_1,
+                            FlarumVersion::BETA_15,
+                            FlarumVersion::BETA_16,
+
+                            // https://github.com/flarum/framework/security/advisories/GHSA-5qjq-69w6-fg57 XSS translator
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
+                            FlarumVersion::V1_0_0,
+                            FlarumVersion::V1_0_1,
+
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
+                            FlarumVersion::V1_0_2,
+                            FlarumVersion::V1_0_3,
+                            FlarumVersion::V1_0_4,
+                            FlarumVersion::V1_1_0,
+                            FlarumVersion::V1_1_1,
+                            FlarumVersion::V1_2_0,
+                            FlarumVersion::V1_2_1,
+                            FlarumVersion::V1_3_0,
+                            FlarumVersion::V1_3_1,
+                            FlarumVersion::V1_4_0,
+
+                            // https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854x XSS discussion title
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
                             FlarumVersion::V1_5_0,
                             FlarumVersion::V1_6_0,
                             FlarumVersion::V1_6_1,
+
+                            // https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 Mentions REST
+                            // https://github.com/flarum/framework/security/advisories/GHSA-8gcg-vwmw-rxj4 Notifications leak
+                            // https://github.com/flarum/framework/security/advisories/GHSA-hph3-hv3c-7725 First post deleted
+                            FlarumVersion::V1_6_2,
                         ])) === 0) {
                         return true;
                     }

tests/Unit/FlarumVersionGuesserTest.php

@@ -540,6 +540,7 @@ function testV140Typical()
             FlarumVersion::V1_6_0,
             FlarumVersion::V1_6_1,
             FlarumVersion::V1_6_2,
+            FlarumVersion::V1_6_3,
         ], $this->guesser->guess($html, $html));
     }
 
@@ -553,6 +554,7 @@ function testV150Typical()
             FlarumVersion::V1_6_0,
             FlarumVersion::V1_6_1,
             FlarumVersion::V1_6_2,
+            FlarumVersion::V1_6_3,
         ], $this->guesser->guess($html, $html));
     }
 
@@ -566,6 +568,7 @@ function testV162Typical()
             FlarumVersion::V1_6_0,
             FlarumVersion::V1_6_1,
             FlarumVersion::V1_6_2,
+            FlarumVersion::V1_6_3,
         ], $this->guesser->guess($html, $html));
     }
 }