🔒 Security Release for Mautic 3.0-3.2.2 versions

This is a security hotfix release to resolve two vulnerabilities reported in Mautic. This is the same release as 3.2.3, but with an important fix in the update script. More details below.

We recommend updating your Mautic instance as soon as possible.

For more information and CVE numbers please refer to the release announcement: https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-3

⚠️ Important note for users who are currently running 3.2.0 or later

Are you currently using Mautic 3.2.0 or later and do you update through the CLI (Command Line Interface)? Then the message below applies to you! This does not apply if you're updating through the UI (graphical interface).

When you're trying to update through the CLI, you might run into the following error:

Notice: Undefined index: message in /var/www/html/app/bundles/CoreBundle/Update/Step/InstallNewFilesStep.php on line 131

Failed to execute command php bin/console mautic:update:apply: exit status 1

This bug was introduced in Mautic 3.2.0 and fixed in 3.2.4. Please use the following workaround:

wget https://github.com/mautic/mautic/releases/download/3.2.4/3.2.4-update.zip
php bin/console mautic:update:apply --update-package=3.2.4-update.zip
php bin/console mautic:update:apply --finish

Note for developers

SHA1(3.2.4.zip)= 291ebabd2f12a0d8eced65a0adaa597db8371a39
SHA1(3.2.4-update.zip)= 33492b549e9f999fe3803cddde7eaa176e57e30b

🔒 Security Release for Mautic 3.0-3.2.2 versions

This is a security hotfix release to resolve two vulnerabilities reported in Mautic.

We recommend updating your Mautic instance as soon as possible.

For more information and CVE numbers please refer to the release announcement: https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-3

Security fix
SHA1(3.2.3.zip)= 3c732ad6f9419887c6fbde80dd8f3548b0981c71
SHA1(3.2.3-update.zip)= 3cf60d0c340bd538e64fec0729b57d4fa38ea995

🔒 Security Release for Mautic 2.16.4 and below

This is a security hotfix release to resolve two vulnerabilities reported in Mautic.

We recommend updating your Mautic instance as soon as possible.

For more information and CVE numbers please refer to the release announcement: https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-3

SHA1(2.16.5.zip) = 57de325ea95a890ffd0eed18ac37fe747d4a9cab
SHA1(2.16.5-update.zip) = cb4d18f0a9c8db8efd9ccb97f9be82fa2bf2e61b

Change Log

Enhancements

• #9521 Check if tag name matches version in metadata (@dennisameling)
• #9498 Adding functional test to ensure a multiselect field can be created (@escopecz)
• #9489 Implement stalebot (@RCheesley)
• #9424 Update pull request template (@dennisameling)

Bugs

• #9529 Campaign action bug (@alanhartless)
• #9511 Fix long tag name (@kuzmany)
• #9509 Placeholder shown for Timezone field is improper (@ts-navghane)
• #9499 Bugfix: incorrect check for HTTPS connection when behind reverse proxy (@christopheg)
• #9496 Bugfix: incorrect check for HTTPS connection when behind reverse proxy (@christopheg)
• #9480 Fix migration 20191017140848, run PHPSTAN on migration files (@dennisameling)
• #9467 Fix numeric reports table colums (@kuzmany)
• #9463 Upgrade filemanager (@hluchas)
• #9436 Fix gated video showing play button above form (Issue #9431) (@gabepri)
• #9389 Fix display Google Analytics code in landing page (@kuzmany)
• #9380 Fix campaign builder detach exception (@patrykgruszka)
• #9348 Fix campaign form conditions selectbox value (@kuzmany)
• #9313 Cache required fields to memory (@escopecz)
• #9307 Revert back SlimScroll library to Version: 1.3.2 - fix scroll issue (@kuzmany)
• #9271 Fix filemanager absolute url (@kuzmany)
• #9216 fix contact merging issue when mutliple unique identifiers are being used (@cahaynes)
• #9080 Prevent embedding the same image multiple times in an email when image embedding is enabled (@ramandi)
• #7129 Fix scheduled jump to event campaign action (@kuzmany)

A big thank you to the following community members for contributing to this release either by code or bug report: @cahaynes, @christopheg, @dennisameling, @directpromo, @escopecz, @gabepri, @hluchas, @kuzmany, @masonhensley, @patrykgruszka, @ramandi, @RCheesley, @ts-navghane

Note for developers

SHA1(3.2.2.zip)= 3fbadc7e6696c34ed658b028653b825951fb0b3f
SHA1(3.2.2-update.zip)= 7ab47e63d945fae56c33a35b048b2bcd4a41100a

⚠️ This is the last patch release for Mautic 2 (branch 2.16) ⚠️

Note that security support and bug fixes support for this major version are now ended.

Security fixes

• Update oneup/uploader-bundle to 1.9.4 (security fix) #9025 (@bytehead)

Bug fixes

• Fix V3 Upgrade to detect that its already in CLI #9184 (@jacobshilitz)
• Downgrade Composer to v1 on 2.16 branch #9359 (@dennisameling)
• Update DB server version for Mautic 2 > 3 upgrade #9455 (@dennisameling)

A big thank you to the following community members for contributing to this release either by code or bug report: @dennisameling, @jacobshilitz & @bytehead.

–––––––––––––––

Note for developers

SHA1(2.16.4.zip)= 5a1ce99af96065b295a12146b3aed5b94bc8548d
SHA1(2.16.4-update.zip)= b3fd4cfb4a0e89a34035482555e4dbb0e6b3180b

This is a security hotfix release to resolve a vulnerability reported in ELFinder present in all versions of Mautic from 3.0.

We recommend updating your Mautic instance as soon as possible.

Security fix

#9463 Upgrade filemanager (@hluchas)

SHA1(3.2.1.zip)= 35d406607909f5a8b6f3c17a93253a6afc354092
SHA1(3.2.1-update.zip)= 29e9bfb4d319612beacfe822e56b682f1b880591

Change Log

Features

• #9026 Adding a new boolean option system setting to transliterate p… (@Mohammad-Fayoumi)

Enhancements

• #9423 Allow 0% coverage on Codecov patch (@dennisameling)
• #9422 Add "Export to Excel" functionality for contacts (@dennisameling)
• #9387 Functional test performance improvement (@fedys)
• #9371 Enabling company tokens in webhook campaign action (@mabumusa1)
• #9367 Add thumbnails to file manager (@kuzmany)
• #9355 CI: move from Travis to GitHub Actions (@dennisameling)
• #9344 Email attachment tooltip with info about tracking added (@escopecz)
• #9342 Adding missing campaign action add/remove DNC description (@escopecz)
• #9341 Add composer.json and composer.lock to release zip archive (@dmitryuk)
• #9283 Fix user icon position (@LevryKurniawan)
• #9244 Upgrade to PHPUnit 8 🚀 (@dennisameling)
• #9234 Make CI more travis-y and explicit (@szepeviktor)
• #9184 Fix V3 Upgrade to detect that its already in CLI (@jacobshilitz)
• #9135 Update cs-fixer-package to 2.16.4 (@kuzmany)
• #9120 Update Gaufrette packages to resolve deprecates in the old version (@mabumusa1)
• #9101 Add post-checkout hook for deleting cache 🧹✨ (@dennisameling)
• #9096 Add link to profile for integration (@kuzmany)
• #8647 Fetch the list of IP's from Maxmind that should not be tracked due to CCPA requests (@lukassykora)
• #8447 Add support for PHP 7.4 (@escopecz)
• #8238 Segment public name property for preference center (@patrykgruszka)
• #7879 Sms send by segments (@kuzmany)
• #7511 Custom contacts columns (@kuzmany)
• #7444 Adds support for defining Sparkpost's campaign ID (@alanhartless)
• #6183 Email Stat Limit: limit number of Stat 'openDetails' (@maxlawton)
• #6126 Add support for relative dates to campaign action - update contact (@kuzmany)

Bugs

• #9437 Bump minimum MySQL version to 5.7 (@dennisameling)
• #9418 Fix this in campaign action (@kuzmany)
• #9417 Adding the Connection: Close response header only when the request is made using HTTP/1.1. (@nfakhour)
• #9415 Fix international phone number validation (@kuzmany)
• #9403 Page and Email language as required (@kuzmany)
• #9390 Add more mime types to import csv validation (@kuzmany)
• #9376 Fix: Quote regular expression characters for multiselect segment filter (@kuzmany)
• #9372 Improve query performance (@hluchas)
• #9346 Fix typo on EmailModel and a null notice on segments (@rwrz)
• #9343 Fixing the search for columns composed of more words (@escopecz)
• #9325 Fix replace image from file manager (@kuzmany)
• #9317 Store company changes on new contact save via UI (@escopecz)
• #9297 Fix data fixture namespace (@hluchas)
• #9290 Fix SES Transport (@mabumusa1)
• #9251 Fix Citrix segment filter (@kuzmany)
• #7747 Fix inability to delete campaign actions with many logs. (@anton-vlasenko)

A big thank you to the following community members for contributing to this release either by code or bug report: @alanhartless, @albanleandri, @alexdhika, @anton-vlasenko, @chendwww, @christian-beckmann, @dennisameling, @dilshadh, @dmitryuk, @escopecz, @fedys, @hluchas, @jacobshilitz, @javiergas, @jocecu, @johbuch, @kuzmany, @lance-spurgeon, @LevryKurniawan, @lukacsaron, @lukassykora, @mabumusa1, @maxlawton, @mikemathewson, @Mohammad-Fayoumi, @nfakhour, @patrykgruszka, @RCheesley, @rwrz, @stevedrobinson, @szepeviktor

Note for developers

SHA1(3.2.0.zip)= 1a972e1eb1816fcc44c785052aff076659aeacc7
SHA1(3.2.0-update.zip)= 92f5656562a325a61265f1170538ddb1d57f876f