v5.1.0 (2026-06-07)
Bug Fixes
-
harden-email-templates: Reject path traversal in template name (
cb9b7ad) -
harden-rich-text: Sanitize announcement and resource output (
7ed2b9c) -
harden-rich-text: Sanitize announcement email rich text (
cc30b15) -
harden-rich-text: Sanitize rich text in admin views (
688e6aa) -
harden-url2link: Only linkify safe http(s) URLs and valid emails (
fa75dba) -
reservations: Prevent attachment filename stored XSS (
51a9ffc)
Build System
- composer: Add Symfony HTML sanitizer dependency (
ee27dd0)
Documentation
-
agents: Document rich text sanitization guidance (
6d7b554) -
agents: Update guidance from recent project patterns (
e48f2f5) -
security: Clarify trust boundary for admin-authored content (
437e3c8)
Features
-
security: Add rich text HTML sanitizer (
c1a59b5) -
security: Add sanitize_rich_text Smarty modifier (
b510537)
Detailed Changes: v5.0.3...v5.1.0