Skip to content

1.7.53.7

Choose a tag to compare

View all tags
@rhukster rhukster released this 31 Oct 21:04
· 14 commits to 1.7 since this release
1.7.53.7
0059dfb
This commit was signed with the committer’s verified signature.
rhukster Andy Miller
GPG key ID: 9F2CF38AEBDB0AE0
Verified
Learn about vigilant mode.

Bugfix

  • [security] The security fixes below were found by Anthropic's OSS Scanner
  • [security] Image conversions now accept only supported image formats and keep cached files in their intended folder. Backport of the Grav 2.2.18 fix
  • [security] Responses that set cookies now stay private even when pages or plugins set their own cache headers. Backport of the Grav 2.2.18 fix
  • [security] Existing accounts are now counted correctly when the installation folder contains special characters. Backport of the Grav 2.2.18 fix
  • [security] Request URLs now respect the site's protocol forwarding setting. Backport of the Grav 2.2.18 fix
  • [security] A media .meta.yaml file can no longer change which file a medium points to or where it is served from, and only files ending in .meta.yaml are read as media metadata. Backport of the Grav 2.2.18 fix
Assets 5
Loading