In some cases in order to install this release the /vendor and /overrides folders will need to be removed before updating:#5538 (comment)
After installing this release make sure to update modules to the latest version.
Fixed
- Use salt in
tools.phpauth. - Return empty value in
Helper::decrypt()when decryption fails. - Tighten throttling Forgot Password requests (Security: GHSA-jvmv-2qcp-7855)
- Throttle
ResetPasswordControllercontroller. - Escape title in symfony
ExceptionHandler. - Purify mailbox signature HTML on saving.
- Sanitize module alias on activating a license.
- Add hash to lang.zip name when downloading translations.
- Use
hash_equals()when checking attachment token. - Use hash_equals() to compare hashes.
- Fix potential
TypeErrors. - Revert changing
last_reply_atfield update logic (#5501) - Patch "guzzlehttp/psr7: Host Confusion via Weak URI Host Validation" (Security: GHSA-c2w2-prh8-qm98)
- Update Guzzle to the latest version.
- Updade
ezyang/htmlpurifierlibrary. - Sanitize URL in
Customer::setPhotoFromRemoteFile(). - Fix case of items in
Helper::checkUrlIpAndHost(). - Do not allow regular users with PERM_EDIT_USERS edit admin profiles.
- Allow to send a message containing only image.
- Restrict file extensions uploaded by support agents.