Skip to content

Release v2.13.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 09:53
· 31 commits to main since this release
v2.13.0
fdc8d37

v2.13.0

Changelog

Security: the admin UI refuses to compile without form CSRF protection (CsrfProtectionPass, fail closed). See UPGRADING.

Security

  • CSRF fails closed: new CsrfProtectionPass makes the container refuse to compile when the dashboard (web_ui.enabled: true) is on and form CSRF protection is unavailable (security.csrf.token_manager or form.type_extension.csrf missing, or framework.form.csrf_protection: false). Before, the menu / item delete, move up/down, reindex, cycle check and copy actions (DashboardActionType declares its own CSRF options, checked by assertSubmittedValidActionForm()) and the CRUD / import forms accepted tokenless cross-site POSTs in that configuration. See UPGRADING and SECURITY.

What's Changed

  • fix(security): dashboard refuses to compile without form CSRF protection by @HecFranco in #90

Full Changelog: v2.12.0...v2.13.0

Contributors

HecFranco
Assets 2
Loading