1.0.13

Bugfix

• [security] A scoped API key created on a super-admin account is now held to its declared scopes when writing groups, account settings, site preferences, and the shared dashboard layout, so a limited or read-only key can no longer be used to grant itself or others super-admin access (GHSA-jqgq-v53x-x99g).
• [security] A scoped API key can no longer create another key with broader scopes than its own, closing a way a limited key on a super-admin account could mint itself an unrestricted key (GHSA-95v9-4fcj-96gh).
• [security] That same scope limit now also applies when creating or updating users, sending invitations, removing a user's two-factor authentication, enabling Twig in page content, changing the report sandbox allowlist, writing privileged configuration such as the scheduler, and using the demo controls, so a limited key on a super-admin account cannot use any of these to act beyond its granted scopes (GHSA-jrm3-jpp7-3gmx, GHSA-wvpj-fg8h-843q, GHSA-2x29-3mjq-2pvx, GHSA-96xv-p87j-58mx, GHSA-v5ph-7v92-wqm6, GHSA-22p9-6fh4-mmf2, GHSA-vq9w-jwj5-wfjg).
• Custom fields added to the account form by extending the account blueprint are now saved instead of being silently dropped (getgrav/grav-plugin-admin2#138).