Skip to content

Release v1.13.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 09:54
· 5 commits to main since this release
v1.13.0
26d4529

v1.13.0

Changelog

Security: the admin UI refuses to compile without form CSRF protection (CsrfProtectionPass, fail closed). See UPGRADING.

Security

  • CSRF fails closed also when only form CSRF is disabled: new CsrfProtectionPass makes the container refuse to compile while the panel (web_ui.enabled: true) is registered and security.csrf.token_manager or form.type_extension.csrf is missing, or framework.form.csrf_protection is false. The controller already denied mutations without a token manager, but with framework.form.csrf_protection: false the token manager exists while the panel forms (AbstractMaintenanceFormType declares its own CSRF options) skipped validation, so enable / disable / schedule accepted tokenless cross-site POSTs. See UPGRADING and SECURITY.

What's Changed

  • fix(security): panel refuses to compile without form CSRF protection by @HecFranco in #22

Full Changelog: v1.12.0...v1.13.0

Contributors

HecFranco
Assets 2
Loading