Skip to content

Release 26.11.03-01

Choose a tag to compare

View all tags
@dotCMS-Machine-User dotCMS-Machine-User released this 03 Nov 22:07
v26.11.03-01
00c210b

dotCMS 26.11.03-01 tightens access control across several REST endpoints and sets stricter default password rules. It also fixes concurrency and push-publishing bugs, and hardens upload validation, HSTS and log output.

Enhancements & Adjustments

  • The default password policy now requires 15 to 64 printable characters with at least one uppercase letter, one lowercase letter, one digit and one special character, and the related error messages now state this rule. Installations that set their own passwords.regexptoolkit.pattern are not affected. [#38375]

Fixes

  • Contentlets referenced in Story Block fields are now read with the requesting user's permissions instead of the system user's, so references the reader cannot see return only their identifier and languageId. [#38222]
  • The container content endpoints under /api/v1/containers now resolve a contentlet given by identifier with the caller's permissions, serving the working or live version as appropriate. [#38321]
  • The container form endpoints now require a back-end user who can read the form. GET only returns an existing widget and no longer creates one, and a new POST on the same paths creates and publishes the widget as the caller. [#38395]
  • The job endpoints (/api/v1/jobs/** and /api/v1/content/_import/**) now answer only to the user who created the job or to a CMS Administrator, and job listings show only the caller's own jobs. [#38383]
  • The integrity checker endpoints behind Publishing Environments > Check Integrity now require access to the Configuration portlet, and they return 404 or 400 instead of 500 for an unknown endpoint id or an invalid parameter. [#38346]
  • Blocked file extensions are now matched case-insensitively and checked on every upload route, including the JSON content API, fetch-by-URL, content import, bulk upload and WebDAV. .jspx and .jspf are now blocked by default. [#38247]
  • Registering or unregistering an OSGi actionlet no longer causes intermittent HTTP 500 errors or missing built-in actionlets in requests that run during the refresh. [#38354]
  • Incremental push publishing now compares file modification times at one-second precision, so unchanged files are no longer republished and changed files are no longer skipped. [#38300]
  • A reindex batch that fails before its rows are acknowledged no longer leaves those rows stuck in the reindex queue, and saving a list of site variables now processes them in the order given. [#38351]

Infrastructure & Security

  • The default Strict-Transport-Security max-age rises from one hour to one year and can now be set with HSTS_MAX_AGE_SECONDS (or DOT_HSTS_MAX_AGE_SECONDS); a change takes effect after a restart. [#38267]
  • Each log message now stays on one line, with newlines written as \n, and errors for malformed request input are logged without the submitted value or a stack trace. Custom CMS_LOG4J_*_PATTERN settings are unchanged. [#38388]
Assets 2
Loading