Skip to content

v4.6.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 15:02
· 2 commits to v4.6 since this release
v4.6.4
7a3b879
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Users with UserManagement permissions can assign themselves the admin role or change an admin's password (GHSA-rw5f-4cm4-pc4m)
  • Stored cross-site scripting in Solidus product descriptions (GHSA-x943-j5hw-mr2w)
  • Missing authorization check on return item inventory units allows cancelling other customers' returns (GHSA-6p7r-vx57-9gw3)
  • Checkout state skip via unvalidated state parameter (GHSA-qwqm-3jx5-rr8m)
  • Customers can attach another user's stored gateway payment profile to their own payment (GHSA-vgwx-9pm9-8qvj)

Solidus Core

  • [v4.6] Skip VAT price generation without a valid price by @solidus-bot[bot] in #6622
  • Get CI passing again for v4.6 by @jarednorman in #6624
  • [v4.6] Touch taxons one at a time in id order by @jarednorman in #6635

Solidus Backend

Solidus API

Solidus Promotions

  • [v4.6] Remove adjustments from cart orders when promotion is discarded by @mamhoff in #6562

Full Changelog: v4.6.3...v4.6.4

Contributors

jarednorman and mamhoff
Assets 2
Loading