Improved
- Updated vendor libs to latest versions
- The list of groups on the account form is now read through the current user groups system, retiring a routine deprecated since Grav 1.7.
Bugfix
- [security] The site, system and theme settings offered to Twig written inside page content are now filtered by the same denied-paths list that already covered
config, so a page editor can no longer read secrets such as a Redis password straight out of them (GHSA-p597-crqc-m349). - [security] Twig written into a form's email settings now runs under the same restrictions as Twig written into page content, closing a route that let someone with only page-editing rights run commands on the server (GHSA-gh8j-q67c-j53f).
- [security] Form security tokens are now compared with a routine that takes the same amount of time whichever characters differ, so the check can no longer hint at how much of a guess was right (GHSA-38p6-h87p-r4cg).
- [security] The check for whether a visitor arrived from your own site now requires a full address match, so another site whose domain merely begins with yours no longer counts as your own (GHSA-9ccq-2jfg-qw33).
- [security] Scheduler job locks are now kept inside your site rather than in the shared system temp folder, so another account on the same server can no longer redirect a lock write to a file of its choosing (GHSA-q8w8-6cq5-j4h2).
- A scheduled job set to run only one at a time now refuses to start when its lock cannot be written, instead of running unprotected. Note that
bin/grav clearremoves these locks along with the rest of the temporary folder. - [security] Deleting, renaming and copying a media file now check the whole path rather than just the file's own name, so a plugin calling those routines directly cannot reach a file outside the media folder (GHSA-jq29-c7v8-rg55).
- [security] The
media_directory()Twig function now only accepts folders inside your site, so Twig written into page content can no longer list files or republish images from elsewhere on the server (GHSA-47ch-6w46-6xm7). - Deleting a media file no longer also removes the retina copies and metadata belonging to a different file whose name merely ends with the same text, so deleting
banner.jpgleavesmy-banner@2x.jpgalone. - A fallback page handed to
Uri::referrer()is now returned as given, instead of being trimmed away to nothing whenever the visitor did not arrive from your site. Pages::referrerRoute()was comparing a full web address against a site path, so it never recognised a match and always reported that the visitor came from somewhere else.