Skip to content

Release v1.13.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 07:52
· 177 commits to main since this release
v1.13.2
fbde6a6

Release v1.13.2: security fixes (see CHANGELOG/UPGRADING).

Changelog

Security

  • Row actions: the confirm_message onsubmit handler is now HTML-attribute escaped. Messages containing double quotes previously broke the attribute (the destructive POST was sent without confirmation) and allowed attribute injection / XSS.
  • panel_path_rewrites: a root target ('/admin': '/') no longer produces protocol-relative Location: //host redirects; redirect targets always start with a single /. Config validation now rejects prefixes starting with // or containing backslashes.
Assets 2
Loading