Improved
- The debugger's Clockwork data endpoint now answers only requests coming from the server itself, or requests presenting the secret set in the new
debugger.tokenoption. Cookies and API tokens are no longer recorded in profiler data whatever thecensoredoption is set to - A field that is rejected only for being too long or too short now says so, and gives both the length submitted and the limit, instead of the same "Invalid input" any other bad value gets
- Multiline fields no longer carry a length limit low enough to affect real writing. Set
max: 0on a field to remove the limit altogether
Bugfix
- [security] Form security tokens are now compared with a routine that takes the same amount of time whichever characters differ, so the check can no longer hint at how much of a guess was right (GHSA-38p6-h87p-r4cg).
- A long page can be saved from the admin again. Page content was capped at 65,536 characters, so anything longer than roughly twenty pages of text was refused, and the only way to edit it was to write the file directly #3643