2.0.16

Improved

• Updated vendor libs to latest versions
• The list of groups on the account form is now read through the current user groups system, retiring a routine deprecated since Grav 1.7.

Bugfix

• [security] The site, system and theme settings offered to Twig written inside page content are now filtered by the same denied-paths list that already covered config, so a page editor can no longer read secrets such as a Redis password straight out of them (GHSA-p597-crqc-m349).
• [security] Twig written into a form's email settings now runs under the same restrictions as Twig written into page content, closing a route that let someone with only page-editing rights run commands on the server (GHSA-gh8j-q67c-j53f).
• [security] Form security tokens are now compared with a routine that takes the same amount of time whichever characters differ, so the check can no longer hint at how much of a guess was right (GHSA-38p6-h87p-r4cg).
• [security] The check for whether a visitor arrived from your own site now requires a full address match, so another site whose domain merely begins with yours no longer counts as your own (GHSA-9ccq-2jfg-qw33).
• [security] Scheduler job locks are now kept inside your site rather than in the shared system temp folder, so another account on the same server can no longer redirect a lock write to a file of its choosing (GHSA-q8w8-6cq5-j4h2).
• A scheduled job set to run only one at a time now refuses to start when its lock cannot be written, instead of running unprotected. Note that bin/grav clear removes these locks along with the rest of the temporary folder.
• [security] Deleting, renaming and copying a media file now check the whole path rather than just the file's own name, so a plugin calling those routines directly cannot reach a file outside the media folder (GHSA-jq29-c7v8-rg55).
• [security] The media_directory() Twig function now only accepts folders inside your site, so Twig written into page content can no longer list files or republish images from elsewhere on the server (GHSA-47ch-6w46-6xm7).
• Deleting a media file no longer also removes the retina copies and metadata belonging to a different file whose name merely ends with the same text, so deleting banner.jpg leaves my-banner@2x.jpg alone.
• A fallback page handed to Uri::referrer() is now returned as given, instead of being trimmed away to nothing whenever the visitor did not arrive from your site.
• Pages::referrerRoute() was comparing a full web address against a site path, so it never recognised a match and always reported that the visitor came from somewhere else.