Skip to content

v26.9.5

Choose a tag to compare

View all tags
@yomybaby yomybaby released this 30 Oct 14:16
· 5 commits to 26.9 since this release
v26.9.5
068389b

What's Changed (v26.9.4 -> v26.9.5)

🐛 Bug Fixes

Interactive Login Hardening

Closes a cross-site scripting and open-redirect vector on the /interactive-login page: the callback query parameter is now validated and only absolute http(s) URLs are followed (the Login button stays disabled otherwise). The same change redacts the request body from login-failure errors, sets Secure; SameSite=Lax on the FastTrack token cookie, and clears the app-proxy permit key on logout.

  • validate interactive-login callback and harden credential handling by @yomybaby in #10742

📝 Documentation

User Manual Backports

Brings the user manual on the 26.9 line up to date with features already shipped there: the PENDING session ring icon, the session notification layout, the inline RBAC permission grid and Presets tab, the domain-scoped admin Model Store, and the translated session type label in the session detail screenshots.

  • cherry-pick manual updates for features already on 26.9 by @yomybaby in #10252

Full Changelog: v26.9.4...v26.9.5

Contributors

yomybaby
Assets 21
Loading