Security fix - please update ASAP
This release contains two security fixes.
- [!!!] Fluid viewhelper injection in FE
It was possible to use arbitrary viewhelpers in frontend files, like sender name or sender email. This is now prevented via a whitelist in the extension configuration. If you use other viewhelpers, you need to whitelist them in the extension configuration.
- Enforce page access in the backend module
With non numeric uid values, it was possible to gain access to mails on pages where an editor had no access to. This is now mitigated via an additional access check.