rconfig/rconfig core-8.2.10

rConfig V8 Core 8.2.10

on GitHub

Security release. Upgrade is recommended for all 8.x installations.

Fixed

• Removed a duplicate Auth::routes() call from the web routes. The second, unqualified call re-registered the default authentication routes and reinstated the registration endpoints that the preceding call had disabled.
• The SSO approval check now also applies to the local login form. An SSO account that an administrator has not approved can no longer sign in through it. Local accounts are unaffected.

Changed

• A user record created without an explicit role now defaults to the User role instead of Admin. Existing users are unchanged.
• Accounts provisioned through SSO are assigned the User role when they are created. Administrators keep their role when signing in.

Removed

• The unused registration controller.