5.10.6

• Forward slashes in query strings are now encoded. (#19057)
• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Updated Axios to 1.17.0. (#19053)
• Fixed a bug where no-cache and X-Robots-Tag: none headers weren’t always being sent for requests with x-craft-preview or x-craft-live-preview query string params. (#19060)
• Fixed a bug where the “Delete” element edit page action wasn’t working properly when editing a provisional draft.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t returning boolean values for environment variable names that resolved to true/false values. (#19029)
• Fixed a bug where the submit button within Live Preview was labelled “Submit” rather than “Save”. (#19056)
• Fixed a bug where the selected site wasn’t being remembered after saving an element. (#19054)
• Fixed a bug where transformed SVG images could have two sets of width and height attributes. (#1902w7)
• Fixed an infinite recursion bug. (#19063)
• Fixed a JavaScript error that could occur if there was an error rendering an element condition rule’s Twig template.
• Fixed a bug where relational fields’ element selector modals weren’t showing any results if they were configured to only relate to elements in a specific site, and the author didn’t have permission to access that site. (#19078)
• Fixed a bug where element cards were showing preview values for conditionally-hidden fields. (#19064)
• Fixed a bug where some bulk element actions could exhaust the memory limit on large selections. (#19070)
• Fixed a SQL error that could occur when uploading an asset, if it contained non-UTF-8 alt text in its metadata. (#19069)
• Fixed an error that could occur when editing an entry if a soft-deleted user had recently edited the same entry. (#19081)
• Fixed a PHP error that occurred when setting general config settings via config/general.console.php or config/general.web.php. (#19083)
• Fixed a bug where address cards would show “0, 0” for Longitude/Latitude values when neither field had been populated. (#19093)
• Fixed a bug where field conditions within Matrix blocks weren’t always working when editing the owner element in a slideout. (#19084)
• Fixed a bug where verification code inputs weren’t always getting autofilled by password managers. (#19094)
• Fixed a bug where the “Use defaults” button in element index view menus wasn’t being shown automatically after a column header was pressed on. (#19101)
• Fixed a styling issue.
• Fixed high-severity RCE vulnerabilities.
• Fixed a high-severity information disclosure vulnerability.
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity potential path traversal vulnerability.