Changes 07/05/2026 (v3.21.0)
release(v3.21.0): authentication and public config hardening
Commit message
release(v3.21.0): authentication and public config hardening
- security(auth): enforce disabled login methods server-side
- security(auth): add source-wide failed-login throttling
- security(config): sanitize public footer branding HTML server-side
Fixed
-
Login method policy hardening
- Form login, Basic Auth login, and OIDC login now enforce the configured disabled-login-method flags on the server.
- Direct requests to disabled login endpoints now return
403 Forbiddenbefore credential validation or OIDC flow setup.
-
Login throttling hardening
- Login throttling now keeps the existing per-source-and-username limit and also applies a source-wide failed-attempt limit.
- Rotating usernames from the same source no longer grants unlimited fresh login-attempt budgets.
-
Public branding config hardening
- Public site configuration now sanitizes footer branding HTML server-side before returning it to clients.
- Existing safe footer text, inline formatting, and safe links are preserved.
Upgrade notes
- Deployments that intentionally disabled a login method in the Admin Panel must now re-enable it before direct API use of that method will work.
- Deployments behind reverse proxies should verify trusted proxy/IP header settings so login throttling uses the real client IP instead of the proxy address.
- Footer branding now permits safe text, inline formatting, and safe links; unsupported active or embedded HTML is stripped.
v3.21.0
Full Changelog
SHA-256 (zip)
453fea2c671916366d9517547833a6f39bcd3f3bab7bc1f8a579b63c930d6e92 FileRise-v3.21.0.zip