What's New
Bug Fixes
- fix(security): restrict avatar, logo and cover uploads to curated mime types (#653)
The account avatar and the store logo and cover fields used Filament's generic ->image() uploader instead of the curated shopper.media.accepts_mime_types allowlist that every other media collection in the panel already enforces. ->image() only sets acceptedFileTypes(['image/*']), and Laravel's mimetypes rule matches that wildcard against image/svg+xml, so an SVG carrying a script payload could be uploaded and served same origin from /storage/<ulid>.svg. All three fields now go through acceptedFileTypes(config('shopper.media.accepts_mime_types')), so uploading an SVG store logo or avatar is no longer possible. Existing files are untouched. Anyone who needs SVG support can restore it through the publishable shopper.media.accepts_mime_types config, with the same risk that implies.
- fix(security): prevent privilege escalation through team settings (#654)
Settings/Team write actions were gated on access_setting, the general purpose permission also used for currencies, taxes, zones and legal pages. Holding it was enough to create arbitrary permissions and have them auto assigned to your own role, open and edit the administrator role, toggle any permission onto yourself, or create a team member and assign them the administrator role. Permissions::removePermission() also only checked can_be_removed in the Blade view, so a crafted Livewire request could delete access_setting or access_dashboard and lock every user out of the panel. A new Shopper\Traits\AuthorizesTeamManagement trait now enforces three rules: a non administrator can no longer target the administrator role, a permission can only be granted if the acting user already holds it, and creating or deleting a permission definition is administrator only. removePermission() now also checks can_be_removed on the server. No new permission was introduced and no migration is required. Administrators are unaffected, since they hold every permission and every rule short circuits for them.
Dependencies
- Raised minimum versions:
filament/filamentandfilament/spatie-laravel-media-library-pluginto^4.12,spatie/laravel-medialibraryto^11.23.3,livewire/blazeto^1.0.14,codewithdennis/filament-select-treeto^4.2. Runcomposer updateto pick up the new minimums, no code changes needed.
Contributors
Full Changelog: v2.11.1...v2.11.2