Skip to content

Release 26.11.06-03

Choose a tag to compare

View all tags
@dotCMS-Machine-User dotCMS-Machine-User released this 06 Nov 17:05
v26.11.06-03
2831393

dotCMS 26.11.06-03 tightens the default security posture, disabling anonymous API access and username/password Basic authentication by default and adding account lockout after repeated failed logins. It also removes Edit Mode Anywhere and delivers a broad set of security, push publishing and content variant fixes.

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

  • Authentication / Language Bundles: Changes how versioned language bundles are requested and loaded after login, so a rollback can leave browsers and the server disagreeing about the cached translation bundles. [#38463]

Features

  • Accounts are now locked out after repeated failed logins, counted per account and client address (with WebDAV tracked separately) and with an optional account-wide limit. [#38066]
  • Tomcat's RemoteIpValve now accepts trusted proxies via the new CMS_REMOTEIP_TRUSTEDPROXIES variable, so deployments with a CDN in front of their load balancer can resolve the real client address. [#38432]

Enhancements & Adjustments

  • The X-DotCMS-Version, X-DotCMS-Min-SDK and x-dot-server response headers are now sent only to requests with valid credentials, with a feature flag to restore the previous behavior. [#38266]
  • The legacy content type delete dialog now lists dependent containers through the containers REST API, which returns 403/404 instead of 500 for unreadable or missing content types. [#38409]
  • The Next.js, Astro and Vue SDK examples are upgraded to their latest framework releases; the Astro example now requires Node 22.23.4 or later. [#38425]

Fixes

  • Users now see translated labels immediately after login instead of raw language keys. [#38463]
  • Velocity templates can no longer unwrap the request or response, reach container internals, or call methods on servlet context, CDI, EL, JSP and Weld runtime objects. [#38405] [#38087]
  • Velocity SQL tools now accept only local data source names and consistently apply ALLOW_VELOCITY_SQL_ACCESS_TO_DOTCMS_DB whatever name a template uses. [#38445]
  • Login-protected back-end paths are now matched against the normalized path the container dispatches to, so encoded or dot-segment URLs can no longer bypass the login check. [#38431]
  • POST /api/v1/forgotpassword now responds in constant time, with the account lookup and reset email handled in the background. [#38264]
  • The workflow task screen and CSV content import now verify the caller's permissions on the target before writing to it. [#38443]
  • Stored workflow and field names are now HTML-encoded in legacy Content Search and the workflow step dialog, closing stored XSS vectors. [#38454]
  • Push publishing bundles are now deserialized only for types in the XStream trusted list, and refused types are reported with a clear error message. [#38402]
  • The Page Scanner (Page Health and Accessibility Studio) now only uses a service URL that is absolute https and does not point to a private or internal host. [#38384]
  • Content queries, binary asset requests and inode-based lookups now resolve on the default variant for callers without back-end access (SDK breaking change). [#38408] [#38462]
  • Scheduled content import jobs now run as the user who saved the job, respecting that user's content type permissions instead of the system user's. [#38411]
  • Static push publishing now publishes every live language of URL-mapped content and no longer writes stale default-language duplicates. [#36729]
  • Category removals now sync to receivers when pushing with a relationships: false filter. [#38429]
  • Reading content with depth no longer alters the cached contentlet, so later reads and saves of the same content behave correctly. [#38419]
  • Saving a content type with publish or expire date fields now schedules identifier date updates with the saved type, so auto-unpublish uses the correct dates. [#38413]
  • The upgrade task that removes the legacy Containers portlet from layouts now runs on installs already upgraded through 26.10.29-01. [#38406]
  • The starter export no longer includes the company key, which the starter import never used. [#38435]
  • Content Search now shows a clearly open padlock for unlocked content. [#38436]

Deprecations, End of Life & Reminders

  • Edit Mode Anywhere (EMA) is removed, including its page interceptor, proxy, App and the FEATURE_FLAG_UVE_LEGACY_SCRIPT_INJECTION flag; the Universal Visual Editor is unaffected. [#38423]

Infrastructure & Security

  • Breaking: anonymous API access and username/password Basic authentication are now disabled by default (ALLOW_BASIC_AUTH defaults to JWT_TOKEN), and both can be re-enabled from Maintenance > System Info. [#38090]
  • graphql-java is upgraded from 17.5 to 19.11 to fix CVE-2024-40094 and earlier GraphQL CVEs. [#37980]
  • java.awt.Desktop is added to the types Velocity templates are not allowed to use. [#38438]
  • Frontend and tooling dependencies, including handlebars, next, dompurify, webpack and vitest, are upgraded to clear all open critical Dependabot alerts. [#38449] [#38455]
Assets 2
Loading