Security
- RSS widget: the feed address is fetched through the same guard as the REST widget. It was fetched as given, so a feed address could point the server at itself, at a device on the local network, at a cloud metadata address or at a local file. Only public http(s) addresses are fetched now, each redirect is checked, and the browser fallback used for bot-protected feeds checks its redirects too. A feed served from the local network (a self-hosted reader at a 192.168 address, say) is refused and its cell says so. Reported and fixed by Peter Wilfahrt (p-w).
- Widgets: a widget's dynamic editor choices (
choices()) run inside its declared network allowlist, like its data fetch. They ran with no limit before.
Added
- Home Assistant, Dashboard widget: Dashboard hides its own header skips the header crop for dashboards that have no header (kiosk-mode, or a theme that hides it), so their top row is no longer cut off.
Fixed
- Widgets that declare
plugin:ha_corecan reach Home Assistant again. The delegate granted no host, so an entity picker or a data fetch in such a widget failed with a host permission error. The grant is the hostname in the current Home Assistant URL only, and follows the setting when it changes.