Skip to content

Release v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 10:15
· 50 commits to master since this release
v1.3.0
4e924c9

Release v1.3.0: security - file upload size/type limits by default, access checker wired with an optional authorization checker.

Changelog

Security

  • File fields now carry a File constraint: max size 5M and a document/image MIME allow-list by default (PDF, text, Word/ODT, JPEG/PNG/GIF/WebP; SVG/HTML excluded). Configurable via file_upload.max_size / file_upload.mime_types and per field via options.max_size / options.mime_types. Previously any file type and size reached the upload handler.

Fixed

  • Default admin access checker: security.authorization_checker is now injected through an optional reference instead of a hasDefinition() check in load() (always false in real apps, so the checker relied on autowiring and, with allow_unauthenticated: true, became allow-all even when SecurityBundle was installed). Without SecurityBundle the role checker denies (fail-closed); the allow-all checker is now selected in ContactFormSecurityPass only when allow_unauthenticated: true and SecurityBundle is absent.

Full Changelog: v1.2.0...v1.3.0

Assets 2
Loading