adding november newsletter

[nbush]

No description provided.

[netlify]

✅ Deploy Preview for grist-help-preview ready!

Name	Link
🔨 Latest commit	9275ed7
🔍 Latest deploy log	https://app.netlify.com/sites/grist-help-preview/deploys/6568d1fac3096500084a6742
😎 Deploy Preview	https://deploy-preview-291--grist-help-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[paulfitz]

@dsagal would it be worth sneaking in a quick note about forward authentication changes?

Something like "For those using forward authentication with Grist, you may need to review your settings - please read gristlabs/grist-core#750 (comment)"

It has been hitting a series of users.

(this is very late to bring this up, so please don't hold newsletter on account of this).

[anaisconce]

@nbush How about making the Discord invite link a button so it's more inviting? You can see a button in the May newsletter https://support.getgrist.com/newsletters/2023-05/

[dsagal]

@dsagal would it be worth sneaking in a quick note about forward authentication changes?

Something like "For those using forward authentication with Grist, you may need to review your settings - please read gristlabs/grist-core#750 (comment)"

It has been hitting a series of users.

(this is very late to bring this up, so please don't hold newsletter on account of this).

I agree, this is important. Maybe alert "Self-hosters" in the heading of this item, and the explanation and instructions are here: https://community.getgrist.com/t/a-template-for-self-hosting-grist-with-traefik-and-docker-compose/856/24?u=dmitry-grist. The fix is basically to update grist-core or grist-omnibus.

[nbush]

@dsagal would it be worth sneaking in a quick note about forward authentication changes?
Something like "For those using forward authentication with Grist, you may need to review your settings - please read gristlabs/grist-core#750 (comment)"
It has been hitting a series of users.
(this is very late to bring this up, so please don't hold newsletter on account of this).

I agree, this is important. Maybe alert "Self-hosters" in the heading of this item, and the explanation and instructions are here: https://community.getgrist.com/t/a-template-for-self-hosting-grist-with-traefik-and-docker-compose/856/24?u=dmitry-grist. The fix is basically to update grist-core or grist-omnibus.

This is mentioned in the current page, but I've added some of @paulfitz 's context:

Security update for self-hosters

We released a security fix earlier this month related to the suggested configuration of grist-core with traefik. For those using forward authentication with Grist, you may need to review your settings. See Dmitry’s Community post for more details.

Let me know if that tracks.

[paulfitz]

Maybe @dsagal you could edit your community post to cover the information in gristlabs/grist-core#750 (comment), so that the newsletter snippet doesn't have to cover both? Users who have Grist completely wrapped by something forwarding a header will have a tough time figuring out what to do otherwise. With that change, @nbush's text works for me.

[dsagal]

How about this edit to Nick's version, that includes both links. The two issues affect different users, so this seems easier than editing the responses there.

Security update for self-hosters

We released a security fix earlier this month related to the suggested configuration of grist-core with traefik, as well as for grist-omnibus. For those using forward authentication with Grist, you may need to review your settings. See this Community update for more details.

The fix also affects those who do Grist authentication by forwarding a header for all endpoints (e.g. behind HTTP Basic Auth), as it makes a previously optional flag required. See this issue for details.

[nbush]

Small edit, but otherwise this looks good. Thanks everyone!

Security update for self-hosters

We released a security fix earlier this month related to the suggested configuration of grist-core with traefik, as well as for grist-omnibus. See this Community update for more details.

The fix also affects those who do Grist authentication by forwarding a header for all endpoints (e.g. behind HTTP Basic Auth), as it makes a previously optional flag required. You may need to review your settings – see this issue for details.

[anaisconce]

Looks good, thank you!