Release v2.13.1

v2.13.1

Changelog

Security: menu API context sets are bounded and the request is passed as permission context. See UPGRADING.

Security

• Menu JSON API hardening. /api/menu/{code} accepted an unbounded _context_sets list from the query string:
  each distinct set is a new tree cache key and, when no menu matched, one query in the legacy fallback (an 8 KB URL
  meant 1 000+ queries and cache entries). It now accepts at most 8 sets of at most 16 scalar values and answers
  400 otherwise. The API also passes the Request as the permission context, like the Twig functions, so host
  permission checkers evaluate API and page menus the same way (it was null).
  The API is public by default (api.enabled: true): restrict ^/api/menu with access_control when menus
  contain admin entries — see SECURITY.

What's Changed

• test: explicit instanceof check (Rector 2.8 rule) by @HecFranco in #91
• fix(security): bound menu API context sets and pass the request as permission context by @HecFranco in #92

Full Changelog: v2.13.0...v2.13.1