New
- A new
pages.media_route_urlssetting insystem.yaml, off by default, links a page's media by its page route instead of its path on disk, so plugins can apply the page'saccessrules to media requests. Resized images keep serving from the image cache - Every web server config now carries a commented rule for denying direct access to
user/pages, which only becomes safe to enable oncepages.media_route_urlsis on
Improved
- Now depends on a released
rockettheme/toolbox2.0 rather than tracking its development branch, so a build always resolves to the same code - An operator who manages users can no longer give themselves full admin rights. Permission fields that only a super admin may write were guarded by name, and writing the same field under its flattened name slipped past that guard. Thanks to @movon-ava
- Twig in page content can no longer read the site's configuration through the
arrayfilter. The|arraycast was the one conversion that never asked the sandbox whether it was allowed, so it could turn Grav's internal service registry into a plain list and read the settings the sandbox exists to keep out of page content, including plugin passwords and API keys. Thanks to @1diot9 and @AlpetGexha - A page can no longer capture the session of an administrator who views it. Page content could read the visitor's cookies, and the finished page was stored in a cache shared by everyone, so an administrator's session could be handed to the next visitor. Cookie reading is no longer available to page content, and pages that run editor-written code are no longer cached after that code runs. Thanks to @canhieu
- The bundled IIS and lighttpd configs now block sensitive files whatever the capitalisation of the request. Only the Apache and PHP rules were corrected when this was last fixed. Anyone serving Grav with the bundled
web.configorlighttpd.confshould re-copy the sample, as the updater only heals.htaccess. Thanks to @movon-ava - Uploaded files are now checked for embedded scripts based on the file itself rather than the type the browser claims it is. Thanks to @AlpetGexha
- A disabled account is now refused permissions even when its rights are checked outside of a login session, and an account permission check no longer matches any permission whose name merely contains the word "login". Thanks to @AlpetGexha
Bugfix
onShutdownnow fires after a request that ended throughclose()orredirect(), not only after a rendered page. Those requests echoed their response and exited before the shutdown handler was registered, so a plugin doing slow work after the response (sending queued mail, warming a cache) never ran on a form submit that redirected. The non-FastCGI fallback also stops trying to set headers once they have been sent- Fixed the Flex user ACL treating an unsaved account and an anonymous visitor as the same person. Thanks to @AlpetGexha
- Corrected the
security.yamlcomment claiming Twig in page content is off by default. It has shipped on since 2.0.19 - A page dated with an unquoted
date: 2022-01-06header no longer lands in the year 7200. The YAML parser reads an unquoted date as a date and hands over a timestamp rather than a string, which the date parsing then misread. Thanks to @wakqasahmed #3812 - A relative path handed to the resource locator can no longer resolve outside the site folder. Making file paths absolute meant a
..climbed out through the base instead of being refused. Stream paths such asuser://were never affected, and Grav addresses its own resources that way - Page content is now validated against the rules its blueprint declares. The Content field and the Content tab that holds it share the name
content, and the tab was overwriting the field, so every rule set on a page body was quietly unused. Thanks to @wakqasahmed #4271