1.16.4

Security release for Backdrop CMS. This release fixes 2 security vulnerabilities:

• Backdrop core - Moderately critical - Cross-site scripting - BACKDROP-SA-CORE-2020-005
• Backdrop core - Moderately critical - Cross-site scripting - BACKDROP-SA-CORE-2020-006

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

Changes since 1.16.3

• BACKDROP-SA-CORE-2020-005: Sanitize AJAX URLs.
• BACKDROP-SA-CORE-2020-006: Sanitize captions used within CKEditor.