Skip to content

Release v3.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 09:34
· 69 commits to main since this release
v3.6.0
7fb654f

Release v3.6.0: security and fixes - same-host redirects, JS-escaped confirms, correct sub-request metrics, complete locales.

Changelog

Security

  • Dashboard POST actions (clear, delete, review, purge) no longer redirect to a foreign Referer (open redirect, e.g. from the invalid-CSRF branch): only same-host http(s) referers are followed, anything else falls back to the dashboard.
  • POST /clear now requires dashboard.enable_record_management: true like the other destructive actions (403 otherwise); the Clear all records button is hidden when it is disabled.
  • Confirmation dialogs are JS-escaped (|e('js')): translations containing an apostrophe (fr "d'accès") broke the onsubmit handler and the purge / delete ran without confirmation.

Fixed

  • Sub-requests (render(controller()), ESI, the ErrorListener error page) no longer overwrite the main request's route and disable the collector: main requests that run sub-requests were never recorded, and with track_sub_requests the metrics went to the wrong route. Tracked sub-requests are now measured and recorded separately.
  • The query counters are no longer reset by sub-requests, so the main request's query count includes every query.
  • PerformanceMetricsSubscriber implements ResetInterface (kernel.reset) so per-request state never leaks between requests in long-running workers.
  • Translations: added the 17 missing keys to ca, cs, pl, ru and tr; a test now enforces key parity across locales and that every template key exists.

Changed

  • query_tracking_threshold is deprecated and ignored: it never had any effect. Setting it triggers a deprecation notice; remove it from your configuration.
  • Removed the unused Performance/access_statistics_disabled.html.twig template (never rendered; it referenced non-existent translation keys).

Commits

  • Release v3.6.0: security and fixes - same-host redirects, JS-escaped confirms, correct sub-request metrics, complete locales. (7fb654f)
  • chore(config): date the query_tracking_threshold deprecation to 3.6.0 (ec29a88)
  • fix(security): same-host redirects, JS-escaped confirms, isolate sub-request metrics (f621b58)
  • ci(code-style): only commit PHP CS Fixer changes to tracked PHP files (5450f02)
Assets 2
Loading