Skip to content

2.7.3

Choose a tag to compare

View all tags
@floatytheastronaut floatytheastronaut released this 18 Sep 18:31
· 37 commits to develop since this release
v2.7.3
727a2c4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • Security: On some sites, a request to the download URL that carried no security key returned a form's entries to a visitor who was not logged in. Thanks to Ashish Agarwal for the report.
  • Security: Disabling a form's download URL did not always stop downloads, because a request that carried no security key was still served.
  • Security: When an export failed, the error page showed server file paths, a stack trace and the plugin, Gravity Forms, PHP and WordPress versions to visitors.
  • Fixed: A download URL could return "not found" when another add-on's settings happened to contain the same security key.
  • Fixed: A file extension added to the end of a download URL was used as-is, so an export could be returned in a file format the plugin does not offer. Unsupported extensions now fall back to the file type configured for the form.
  • Fixed: A malformed download URL could trigger a PHP fatal error on the site. Malformed URLs are now rejected.
Assets 3
Loading