New in this release:
- Fixed multiple security vulnerabilities:
- Improved SSRF protection in
get_remote()(reported by @tonghuaroot) – see README for details. - Fixed blind SQL injection vulnerability when doing searches (reported by @emancypage).
- Fixed privilege escalation issues when adding/editing users (reported by @LastTrainKing).
- Fixed account takeover vulnerability in password reset flow (reported by @emancypage).
- Updated cacert.pem file to remove compromised eMudhra intermediate TLS certificates.
- Comments module: fixed a bulk processing security vulnerability (reported by @orionhridoy).
- Password Protection module: impede brute force and spraying attacks (reported by @jbressers-vc).
- Improved SSRF protection in
- Caches can be deleted in the admin console (requires Manage Caches permission).
- Blog themes: added support for easier CSS customisation using CSS layers and custom.inc.css file.
- Blog themes: added ability for themes to define custom Twig filters and functions using PHP includes.
- Highlighter module: updated highlight.js to 11.12.0.
- Updated Twig to 3.30.0.
- Various other bug fixes and refinements.