New
- Added an
array_group_byTwig filter and function for grouping a list of items by one of their values (#4218).
Bugfix
- [security] A configuration admin can no longer run code on the server by pointing a dynamic field's data provider at a built-in routine named as a class-and-method pair, a form that slipped past the safety check because it only inspected the single-string spelling; both forms are now vetted the same way (GHSA-r94f-hx44-8jqf).
- [security] A page editor without super-admin rights can no longer store an event-handler script that runs for site visitors by hiding it behind a
>placed inside a quoted HTML attribute; the content security scan now reads quoted attribute values the same way a browser does (GHSA-269c-h76q-8cxw). - [security] A backup profile's location is now confined to the site folder, so a profile pointing outside the Grav root can no longer pull external directories into the backup archive (GHSA-fch7-cpv4-w7hg).
- [security] Uploaded filenames may no longer contain the HTML characters
<,>, or", so a stored filename cannot carry markup that could run if it were later shown unescaped. - [security] The
findandsortTwig filters now reject a dangerous function name given as their callback, matching the protection already applied tomap,filter, andreduce, so template values cannot use them to run code (GHSA-xx48-97m4-h7qm). - The bundled
nginx.confsecurity rules are now anchored to the start of the path like the.htaccessrules already are, so the admin's Tools → Logs viewer works on nginx instead of being blocked (#4223). - On non-FastCGI setups Grav no longer sends an invalid
Content-Encoding: noneheader, which some strict HTTP clients rejected outright; it now closes the connection cleanly without the bogus value (#2619).