It has been a while that we had to publish a security release. But this is one. After the 2.6.0 release, multiple security reports were submitted via Github's system. Not all of them were valid according to our criteria, but some turned out to be legitimate reports. These security reports will be released soon, but boil down to:
- A critical bug in the username logic, allowing existing usernames to be duplicated and to capture the rights of existing accounts (@DevVaibhav07)
- A XSS injection vector on the search page, the search term was not properly (or rather, twice) escaped (@hutsbotnet)
- An outdated blacklist for downloads into the media library, making network resources available that ought to be blocked. (@riodrwn)
- An open redirect in exit.php when the trackexit plugin was installed and the blog used for URL redirects via an option in the plugin (@DevVaibhav07)
These four security bugs are fixed in this release. Thanks to the reporters.
Regular Changes
We had already prepared smaller fixes for 2.6.0. They are included in this release as well:
- Fix 404 on cached page loads from plugins (i.e. staticpages) by @fasterit in #969
- Bypass the cache when comments are previewed or submitted otherwise by @fasterit in #971
- Update comments.inc.php for compatibility with PHP 8.3 by @qbi in #968
- Bypass cache for entry/staticpage preview, don't poison cache when we can easily avoid it by checking bypass_cache by @fasterit in #972
- Add cleanCache() calls where they were missing by @fasterit in #973
- Fix plugin backend page (its Javascript) on new installations
Thanks to the contributors.
New Contributors
Full Changelog: 2.6.0...2.6.1
(MD5: b521205a1e2d9c17ddfdfe2a64942c09)
Contributors
qbi, fasterit, and 3 other contributors