Security Fixes
- IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS - reported by @rac-fckscty
- IDOR make user can read e-mail log sent by other events - reported by @lujiefsi
- User sessions are not properly terminated - reported by @lujiefsi
- Cross-Site Scripting (XSS) via File Upload - reported by @PinkDraconian
What's Changed
- Build published on Docker for arm64
- Fix spring-session <-> spring security integration + session removal on user deletion/disable by @syjer in #1214
- Google Wallet integration by @cbellone and @yanaga in #1215
- case insensitive qr code by @cbellone in #1218
- Payments list by @cbellone in #1240
- Configuration API by @cbellone in #1249
- Purchase context level config by @cbellone in #1251
- #1269 Resolved the bug to show correct {{eventName}} on compose message page by @ved-asole in #1275
- Manage additional service quantity by @cbellone in #1308
- unify access resource check in a service by @syjer in #1310
- Date of birth field + additional fields for subscriptions by @cbellone in #1312
New Contributors
- @ved-asole made their first contribution in #1275
- @yanaga made their first contribution in #1215
Full Changelog: 2.0-M4-2304...2.0-M4-2402