Skip to content

3.14.1

Latest
Latest

Choose a tag to compare

View all tags
@dereuromark dereuromark released this 11 Nov 12:30
· 1 commit to master since this release
3.14.1
0f7b481
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes

  • ObfuscateHelper::encodeEmailUrl() HTML-escapes link attributes by default and writes every chunk into the inline script as an encoded JavaScript string, so attribute values such as a title can no longer inject markup or script. Mailto query keys are URL-encoded like the values. #356
  • ObfuscateHelper::encodeText() escapes characters it leaves unencoded, so < no longer reaches the page raw, and multibyte characters produce correct entities. #356
  • The pagination element and the ObfuscateHelper scripts carry the CSP nonce. They read cspScriptNonce, set by CakePHP's CspMiddleware, and fall back to cspNonce. #353

Upgrade notes

  • encodeEmailUrl() no longer defaults to 'escape' => false. If you passed pre-encoded HTML entities in attributes, pass 'escape' => false explicitly.

Full Changelog: 3.14.0...3.14.1

Assets 2
Loading