Kaleta 3.31.2

Kaleta 3.31.2 is a security release. Please update. No database change.

Security

• A class name in the builder could run script in an administrator's browser (high). A person with editing rights, or a Claude connection limited to drafts, could give an element one of Kaleta's own class names; the site's script then loaded a page from another address into the draft preview. The list script now loads only from its own page, and class names starting with ka- are reserved for Kaleta – they are refused when saved and left out of builds saved earlier.
• Two-step sign-in asks for your password when you turn it on. An account that already has a second factor keeps it until it is turned off with the password. Backup codes and the administrator's reset work as before.
• A personal token asks for your password, and a password change revokes that account's personal tokens unless you untick the box. The update itself revokes nothing: existing tokens and Claude connections keep working.
• Users: the same rules as My account. An administrator can no longer reset their own second factor, password or e-mail in Users – that is done in My account with the current password. Setting another person's password or turning off their second factor asks for the administrator's own password.
• A wrong current password counts like a wrong sign-in. Ten in a row lock the account for 15 minutes; you stay signed in.
• Texts in news and collections no longer keep Kaleta's own ka- class names either.
• A site in maintenance mode can be updated. The check after an update and the cron address now work in maintenance mode, so an update is no longer rolled back there and background tasks keep running.
• A failed automatic update is tried again after one hour and after twelve hours, instead of never. The site e-mail hears of the first and the last failure.

Upgrade notes

• Update from the admin as usual.
• A class of your own whose name starts with ka- is no longer applied. Rename it (for example to my-…) before or after the update.
• Scripts that create personal tokens through My account must send the current password.
• A site that failed to install 3.31.1 automatically is offered 3.31.2 afresh.

Found by the security audit of 10 November 2026. The remaining findings of that audit are lower and are scheduled for the following releases.