Skip to content

v3.3.1

Choose a tag to compare

View all tags
@njoubert-cleverage njoubert-cleverage released this 22 Oct 09:19
· 23 commits to main since this release
v3.3.1
a920a42
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes

  • GHSA-hrcr-p9pc-8vfr AbstractDoctrineQueryTask (doctrine_reader): the order_by keys must be a field name or path (letters, digits, _ and .) and its directions asc or desc (case-insensitive) or null, otherwise an UnexpectedValueException is thrown: they were inserted as is in the DQL, which allowed DQL injection when order_by comes from the context or the input.
Assets 2
Loading