Skip to content

Release v0.3.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Mar 10:35
v0.3.7
9400c6d

v0.3.7

Changelog

Added

  • Security: CSRF validation in deleteMenu() and deleteItem(); invalid or missing token returns 403.
  • Security: Move up/down actions now use POST (no longer GET) with CSRF tokens; dashboard forms updated accordingly.
  • Security: Import size limit: config dashboard.import_max_bytes (default 2 MiB); controller rejects larger uploads before reading. Clearer JSON errors via JSON_THROW_ON_ERROR and dashboard.import_json_error / dashboard.import_file_too_large messages.
  • Security (sensitive environments): Optional dashboard.required_role (e.g. ROLE_ADMIN) so all dashboard routes require that role (requires SecurityBundle). Optional dashboard.import_export_rate_limit with limit and interval to rate-limit import/export per user or IP (returns 429 when exceeded). See SECURITY and CONFIGURATION.
  • Event subscriber: DashboardAccessSubscriber enforces required_role when set.
  • Service: ImportExportRateLimiter (cache-based, fixed window) for import/export actions.
  • Translations: dashboard.import_json_error, dashboard.import_file_too_large (en, es).

Changed

  • Dashboard: Move up/down buttons in show.html.twig are now POST forms with hidden _token instead of links.
  • Docs: CONFIGURATION documents import_max_bytes, required_role, import_export_rate_limit. SECURITY explains dashboard hardening for production.

Full Changelog: v0.3.6...v0.3.7

Assets 2
Loading