Improved
- Updated the bundled Twig fork to the current 3.x, picking up the correctness and sandbox improvements from the 3.27 and 3.28 releases.
- Grav now runs on Twig 3.28 and newer, which tightened the escaping method that Grav's compatibility shim replaces and would otherwise stop the site with a server error.
- The Twig content sandbox now accepts the list of tests a template uses, which newer Twig versions hand to it and will require from Twig 4.
- The bundled Nginx configuration now sets caching headers for images, fonts, stylesheets and scripts, so visitors stop re-downloading them on every page.
- Script and style files whose name already contains a version, such as those the Admin panel ships, are cached permanently in that same configuration, because a change always produces a new name.
Bugfix
- [security] Page content can no longer register a script or stylesheet through the Twig content sandbox, and asset URLs are now escaped where the tag is built, closing a way to inject markup into a rendered page.
- [security] The
read_filecapability no longer includes the user data folder by default, so page content can no longer be used to publish form submissions and other stored data. - [security] A proxy address that carries a username and password is now hidden from sandboxed page content, matching the other credentials already redacted there.
- [security] Custom Twig sandbox denial rules now take effect regardless of how the class name is capitalised, and can no longer be silently bypassed through a parent class or interface.
- A damaged page cache file is now rebuilt from the original page instead of stopping the site with a server error (#4239).
- Images and links in page content now work when the file name contains a colon, such as a screenshot named after a timestamp (#3933).
- A page that sets a full web address as its canonical route now uses that address on its own, instead of joining it onto the site's own address and breaking sitemaps and canonical links (#4023).
- Turning on asset timestamps now gives each stylesheet and script its own marker taken from when that file last changed, so editing one file no longer waits on an unrelated change before visitors see it (#4049).
- A canonical route set through the Flex pages API is now saved as written, instead of being stored in a form it could never be read back from.
- Flex directory blueprints no longer lose the fields the Flex Objects plugin adds when something reads the directory early in a request (#160).
- The scheduler's generated cron command now names the site's environment when that environment has its own configuration, and each run records which environment it used, so custom jobs defined in
user/env/<host>/no longer fail silently from cron (#4248). - Audio and video players generated by
media.html()no longer carry analtattribute, which isn't valid on those elements; any alternative text is kept as an accessible label instead, so the markup passes validation (#3540).