1.0.15

New

• Added a DELETE /system/logs endpoint so a log file can be emptied out from the admin, restricted to super admins.
• A cleared log keeps a single entry naming who cleared it, and the clear is recorded in the audit trail.

Bugfix

• [security] An uploaded image is now checked for SVG markup by its contents rather than by being named .svg, so the same script payload can no longer be stored untouched under another name such as .svgz (GHSA-66xf-ggf4-6hmc). Requires Grav 2.0.15 for the matching upload rules.
• A plugin, theme or configuration screen whose fields are generated in code now shows them, instead of rendering an empty box (getgrav/grav-plugin-api#21).
• Fixed responses failing outright when the data contained invalid UTF-8. json_encode() returns false on malformed bytes, which then hit the PSR-7 stream's string type hint and raised an unhandled TypeError instead of returning a response. Most visibly this broke the system log viewer, since grav.log collects whatever third-party content gets logged, bad byte sequences included. Invalid bytes are now substituted rather than fataling. The same fix covers the RFC 7807 error responses, where an exception message carrying a bad byte previously took out the error handler itself and turned a clean 4xx into a fatal.