Skip to content

Release 26.10.28-02

Choose a tag to compare

View all tags
@dotCMS-Machine-User dotCMS-Machine-User released this 28 Oct 16:31
v26.10.28-02
c81fea4

dotCMS 26.10.28-02 tightens what Velocity templates, widgets, user listings, and JavaScript modules can reach, and fixes push publishing of new related content, the TinyMCE license warning in the SDKs, and bundle delete responses.

Enhancements & Adjustments

  • Breaking change: Velocity typed into widget field values and rendered through REST (/api/widget/... and /api/content/...?render=true) is now evaluated only when the widget was last modified by a Scripting Developer, and is otherwise shown as plain text; set FEATURE_FLAG_WIDGET_FIELD_VELOCITY_RENDER=false to show it as text for every widget (pages are unaffected). [#38108]

Fixes

  • New content pushed with a filter that excludes relationships (such as "Only Selected Items") now keeps the relationships carried in the bundle, instead of arriving on the receiver with none. [#38172]
  • The React and Vue SDK DotCMSEditableText components no longer run TinyMCE in evaluation mode, because the GPL license key is now set once in the shared editor config for all three SDKs. [#38254]
  • DELETE /api/bundle/ids no longer sometimes reports that existing bundles were not deleted because they don't exist when the background delete finishes first. [#38262]

Infrastructure & Security

  • Velocity viewtools now give templates less: $cmsuser lookups return a read-only user profile instead of the full user record, controlled by the FEATURE_FLAG_CMSUSER_READ_ONLY_PROFILES flag (on by default), and CMSUsersWebAPI is deprecated for Java callers. [#38100]
  • Logout As now restores the original user only from an active Login As session and returns a 400 otherwise, and Velocity's $request and $session can no longer write the session attributes that track Login As. [#38110]
  • The user list endpoint returns the full user profile only to CMS Administrators and users with access to the Users portlet; other back-end users get only the fields needed to identify and display a user. [#38145]
  • When the @dotcms/ai runtime downloads a remote file, it now checks the addresses the host name actually resolves to, blocks non-public ranges, and connects only to the addresses it checked. [#38156]
  • The JavaScript engine now loads modules only from /application/ and /javascript/ paths, and reads them through the content repository. [#38178]
  • The legacy content preview opened from the workflow task page now encodes content values as text instead of rendering them as HTML. [#38219]
Assets 2
Loading