Improved
- A package that ships its own
.htaccesscan no longer opt out of the protections arounduser/. Those rules are pushed down into every folder beneathuser/and run first, which is what stops a plugin or theme from replacing them. A folder can still ask Apache to run them last and then stop before they are reached. That takes a deliberate line in the package's own file rather than the accidental case this guards against, but the protection Grav shipped before 2.1.4 held against it, so this restores that. A second set of rules now backs up the first using a different Apache module, one that a folder underneath cannot switch off. #4236
Bugfix
- The compiled cache is written in one piece, so a busy site no longer logs
Corrupt compiled cachewarnings after an install or a cache clear. Every request includes the compiled copy of a YAML or markdown file without taking a lock, while the process rebuilding it truncated the file first and filled it afterwards. A request landing in between saw a syntax error, and since 2.0.20 each one wrote a warning tograv.log, which on a cold cache with the admin's parallel requests meant a burst of them for a problem that had already healed itself. The compiled file is now written next to its target and renamed over it, so a reader only ever sees a complete file. The warning stays for a file that really is broken, but no longer fires when another process is in the middle of writing it, and a corrupt file is reported once per request rather than once per read path. A compiled file that cannot be written is now a cache miss instead of a server error. user/dataanswers correctly on a restricted host too, on sites an earlier update had put beyond the reach of 2.1.5's repair. An update in June widened that folder's file in place rather than replacing it, which produced two versions that exist only on disk — in no release and in no checkout — so the sweep behind 2.1.5 could not find them to list. A site carrying either one kept the directive that returns a server error for the whole folder on a host with a restrictedAllowOverride, which is every image and file uploaded touser/data. Both are now recognised and replaced. #4311- A number field accepts every value that sits on its step, instead of refusing some of them. Checking a value against a step was done in binary floating point, where a decimal like
0.0000001has no exact representation, so a perfectly valid entry could be rejected with no way for the person filling the form to tell why — a latitude of81.96on a field stepping by0.0000001was refused. The check is now done on the digits as typed, which has an exact answer. Thanks @TheoAcker12 #3585 - A number, range or select field no longer takes the site down when its step is
any, zero, or not a number.anyis the standard way to say a field has no step at all, and it was being read as zero and then divided by, which is a fatal error rather than a failed validation — the same for a step left empty or set to something that is not a number. Multi-value select and checkbox fields had the same fault a few lines away. All of them now treat a step that is not a positive number as no step, which is what browsers do. Thanks @sridharkalaibala #4308 - The last folder under
user/that could answer with a server error on a host with a restrictedAllowOverridenow answers correctly. 2.1.5 fixed the four files Grav ships, but a site with auser/envfolder also has a file there that an earlier update wrote, and Grav has never shipped that one — so it kept the directive the rest were moved off. Nothing is served from that folder, so no site was broken by it; it is a stray error page where a "forbidden" belongs. An upgrade replaces the file if it is the one Grav wrote, and leaves a file you edited alone. #4311