Skip to content

3.9.2

Choose a tag to compare

View all tags
@rhukster rhukster released this 07 Aug 15:57
· 7 commits to master since this release
3.9.2
e051306
This commit was signed with the committer’s verified signature.
rhukster Andy Miller
GPG key ID: 9F2CF38AEBDB0AE0
Verified
Learn about vigilant mode.

Bugfix

  • [security] Invitation emails now honour the Site Host setting like the other login emails do, so an invitation link can no longer be pointed at a spoofed host by the address the request arrived on (GHSA-69vf-mjxw-x79j).
  • [security] With Require Trusted Host enabled, activation, magic login and invitation emails are now held back as well, where previously only password reset emails were (GHSA-69vf-mjxw-x79j).
  • [security] An account that can manage users but is not a super admin can no longer clear a super admin's login lockout from the Users list (GHSA-985r-mpj8-5rqw).
  • The Site Host and Require Trusted Host settings now describe every kind of email they affect, rather than naming only password reset and activation.
Assets 2
Loading