Skip to content

v4.4.4

Choose a tag to compare

View all tags
@sampoyigi sampoyigi released this 21 Sep 23:17
· 7 commits to 4.x since this release
v4.4.4
54388c5
This commit was signed with the committer’s verified signature.
sampoyigi Sam Poyigi
SSH Key Fingerprint: bDhX5ooK2At0WL9cc4zVhFdyAH3dpRx3IfmKgUCdQJY
Verified
Learn about vigilant mode.

This release includes security fixes for template sandbox escapes and ZIP path traversal, along with a permissions and API cleanup.

Added

  • New installs now grant the Admin.StaffRoles permission to the default manager role, ensuring staff roles remain manageable after being split from the Admin.Staffs permission.

Fixed

  • Blocked config() calls inside Pagic template sandboxes, preventing mail and theme templates from reading application secrets (similar to the existing env/getenv restrictions).
  • Fixed a path traversal vulnerability in extension ZIP extraction: every entry in the archive is now inspected before extraction, and archives containing .. segments, absolute paths, or null bytes are rejected outright.

Breaking Changes

  • Removed the addFromUrl method and its associated tests from the Media class.
Assets 2
Loading