Skip to content

Release v1.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 07:52
· 43 commits to main since this release
v1.6.0
d00791b

Release v1.6.0: security fixes (see CHANGELOG/UPGRADING).

Changelog

Security

  • Admin access (behaviour change): security.access_roles: [] now denies everyone (fail-closed) instead of opening /admin/qr-code-profiles to all users. Use security.allow_unauthenticated: true (demo/dev only) or a custom access_checker to open it.
  • URL allowlist (behaviour change): patterns containing / are matched against the parsed URL (host exact/subdomain, optional scheme/port, path prefix) instead of a substring of the whole URL, closing bypasses such as https://evil.tld/?r=good.com/path. Path-only patterns (/wallet/) are now path prefixes; paths with dot segments never match.

Fixed

  • Admin CRUD: QrCodeProfileConfig declares #[UniqueEntity('name')], so a duplicate profile name shows a form error instead of a 500 (unique constraint violation).
Assets 2
Loading