Omeka Classic 3.2.2 is a bugfix update that contains several important security-related fixes and improvements. All users should upgrade.
Security
- Password-reset and account activation tokens were generated in a predictable way
- The URL in password reset emails could depend on the URL used to access the site when requesting a reset
- Authenticated users could delete other users' API keys
- REST API requests did not apply HTML Purifier to HTML element texts
- The makePublic and makeFeatured permissions for items were not applied for REST API requests
- Theme and plugin names were not always correctly validated before performing actions
- The /redirector action could be used for external redirects
The above security issues were reported by Andrew Gonzalez.
Fixes
- The FileMarkup helper could emit a notice about using null as an array offset
- Spurious notices could be fired when trying to load some files on servers using PHP's open_basedir setting
- Accessibility fixes:
- Textareas could be resized horizontally in a way that did not work well with the page layout
- The default homepage lacked an h1 heading
- The example image for the tag admin page lacked alt text
- Icons could improperly read as text for screenreaders
- z-index issues between dialogs and some other elements
- Improved contrast on the arrows for selects on the admin
- Button focus was indicated by color only
- Theme buttons were not accessibly grouped with the theme they relate to
Changes
- Omeka now serves its fonts locally rather than using Google Fonts
- Account activation and password-reset tokens are now only valid for 24 hours
- Calls to PHP is_ functions using obsolete type names that will be deprecated in PHP 8.6 are updated to their canonical versions
- The server URL used for creating absolute links is now settable as "Server URL" in General Settings. A default value for this setting will be set upon upgrading to 3.2.2. The previous behavior of auto-detecting the server URL is available by setting a blank value, but this should only be done if the server is configured to only accept requests with proper Host headers.
Bundled Add-ons
- Exhibit Builder is updated to version 3.10.2