Skip to content

XMF 1.2.32.1

Choose a tag to compare

View all tags
@mambax7 mambax7 released this 06 Oct 11:42
· 10 commits to 1.2 since this release
v1.2.32.1
c763ba9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

Security release for the 1.2.x line. All 1.2.x users should upgrade; the same fixes are in 1.3.2.

  • Request filtering no longer loops forever on certain input (GHSA-8j4x-8r8r-5jgw).
    A value containing <> followed by more text made remove() grow the string until
    PHP ran out of memory. Filtering now always finishes, with a hard cap of 10 passes.
  • Tighter tag and attribute filtering (GHSA-pf53-59r5-mhjv): name checks anchored
    with \z, attribute names must start with a letter, on* handlers matched
    case-insensitively, URL schemes checked entity-decoded, and stripped text keeps no
    tag opener.

Maintenance

Full Changelog: v1.2.32...v1.2.32.1

Assets 2
Loading