Skip to content

v0.19.1

Choose a tag to compare

View all tags
@adnaan adnaan released this 19 Jul 22:03
· 13 commits to main since this release
v0.19.1
565ddf3

Changed

  • BREAKING feat(upload): form fields travel with a Proxied upload only when marked lvt-upload-with, replacing the previous serialize-everything-except-type="password" denylist (#150, livetemplate/livetemplate#452).

A Proxied upload auto-fires on file selection, so the old default silently POSTed every co-located field — CSRF tokens, hidden secrets, autocomplete="current-password" text inputs — to the upload endpoint with no submit-time moment for the user to notice. A denylist fails open; this fails closed.

Migration: add lvt-upload-with to each field an OnUpload handler reads (typically a record id):

<form>
  <input type="hidden" name="id" value="{{.Record.ID}}" lvt-upload-with />
  <input type="hidden" name="csrf" value="{{.CSRFToken}}" />
  <input type="file" lvt-upload="scan" />
</form>

id reaches OnUpload; csrf does not. An unmarked field now surfaces as a missing value in the handler rather than as a silent leak.

Version jump: this release goes 0.18.2 → 0.19.1 to re-sync the client's major.minor with the core library (livetemplate v0.19.1), which scripts/release.sh enforces.

Docs: livetemplate/docs#120. Known follow-up: livetemplate/livetemplate#508 (marked fields reach OnUpload on the multipart path but not the chunked one).

Assets 2
Loading