v2.2.0
tagged this
22 Aug 00:14
SocialMedia.Channels returned the stored channel entity from GetChannels and AddChannel, so every connected account's AccessToken and RefreshToken were serialised into the browser. They now return a summary that says whether a token exists and whether it has expired, and nothing more. JsonRpc returned a newly created API key smuggled inside the entity's Name as "name||RAW:key". Only the hash was ever persisted, but the shape was one accidental re-save away from writing a live key into the database in plain text. It now returns a dedicated result, shown once. All three plugins — these two and DictionaryManager — had dashboards that made no requests at all, so nothing behind them could be reached. DictionaryManager's Umbraco 13 controller reported "Settings saved successfully" from a setTimeout that saved nothing.