Release v2.0.0.0 · brammo/admin

Require PHP 8.3+
Authentication is part of this plugin. brammo/auth is no longer a dependency
Login, logout, and profile are handled by UsersController. UserController extends it
Auth settings load from config/auth.php under Admin.Auth (legacy Auth is still merged when Admin.Auth is not set)
Breaking: /admin/logout accepts POST only; the header menu uses a post link. Host links to logout must use Form->postLink()
Breaking: default Admin.Auth.Templates.login is Brammo/Admin.Users/login. templates/User/* were removed; hosts that set Brammo/Admin.User/login must use Brammo/Admin.Users/login
SortableComponent: non-integer primary keys (e.g. UUID) are supported instead of being dropped

Users table, entity, migration, and AuthenticationServiceProvider for /admin routes
Bulgarian strings for login errors and logout

File Manager: escape the folder query value in the page <title> and the browse header (reflected XSS)
Login: the redirect query param only accepts local URLs (open redirect)
Profile: only name, email and password can be changed; status and timestamps are ignored
Login: blocked / not-activated messages are shown only when the password is correct, so they no longer reveal which emails exist

File Manager: array query values (folder[]=…, filter[]=…, deleteFile[]=…) are rejected instead of causing a 500
File Manager: an empty folder shows page 1 of 1 instead of page 0
File Manager: image resize is skipped when ext-imagick is not installed instead of a fatal error
File Manager: .jpeg files use the configured jpegQuality
FilterComponent: in / not_in filters with no usable items are skipped (no empty IN ()); array values on scalar filters are ignored
AttachmentsComponent: the uploaded file is removed when its row cannot be saved
Form image element: URLs and the dialog title are JSON-encoded in the inline script

Navigation Menu