This release brings another round of security hardening and bug fixes, most of them backported from work that will be part of Formwork 2.4.0.

As we keep testing the codebase systematically, we keep finding issues that had gone unnoticed, mostly in the less obvious corners: the sanitizer, the command line tools and the panel. As usual, there are no new features and no breaking changes, so updating from any 2.3 release is safe. Updating is recommended for everyone.

Full Changelog: 2.3.17...2.3.18

Security 🔒

• The SVG sanitizer is stricter: markup hidden in SVG comments, CDATA sections and style elements is now detected and removed, both for uploaded SVG files and for SVG embedded in HTML.
• External URIs are now properly disallowed also inside embedded SVG, and the detection of URLs in srcset and meta refresh attributes is more reliable.
• The panel no longer serves user images from outside their directory, and the action now requires the appropriate permission.
• Files of unpublished pages, or pages that cannot be reached by a route, are no longer served.
• Request paths are normalized before routing, and ETag values are properly quoted.

Bug fixes 🐛

• The updates, backup, cache and serve commands behave correctly in edge cases: options are read from the given arguments, backup failures are reported with the real error, and missing directories no longer cause failures.
• The panel now handles invalid requests gracefully instead of throwing errors (reordering pages, uploading files, invalid cookies), and every notification of a request is shown.
• Renaming and deleting files in the panel now keeps their metadata, and failed uploads report their actual error instead of "no file".
• Files are written more safely, and OPcache is invalidated when a PHP file is rewritten.
• Statistics no longer rewrite registries that haven't changed.
• Fixed route generation for encoded values, the length validation of textareas, parsing of byte units like 2M, and a few PHP 8.5 warnings.
• Fixed some missing translation strings in the panel.

This release is a big round of bug fixes, most of them backported from work that will be part of Formwork 2.4.0.

Since we started systematically testing the codebase, we have been uncovering issues that had gone unnoticed for a long time. Rather than make everyone wait for 2.4.0, we are bringing those fixes to the 2.3 series, without adding new features or introducing breaking changes.

Full Changelog: 2.3.16...2.3.17

Security 🔒

• Several controllers could be tricked into serving files outside their intended directory (panel files, assets and plugin assets).
• Log entries are now properly escaped, preventing log injection, and more output is escaped in the debug tools and generated avatars.
• Authentication is stricter: sessions are validated against existing users, unexpected errors during login are handled safely, and passwords exceeding bcrypt's 72-byte limit are rejected instead of being silently truncated.
• Routing, redirects and view rendering are more robust against crafted input.

Bug fixes 🐛

• Dates, slugs, pagination, cookies, URIs and MIME types now handle edge cases correctly (invalid dates are no longer silently "rolled over", slugs deal with multibyte characters, multiple cookies can be sent, and so on).
• Plugin loading and configuration are more reliable, and invalid plugins no longer get in the way.
• Saving options and plugin settings in the panel now replaces data instead of merging it with the old values.
• Fixed Page::isEmpty(), which was returning the opposite of what it should.

Full Changelog: 2.3.15...2.3.16

Full Changelog: 2.3.14...2.3.15

Full Changelog: 2.3.13...2.3.14

Full Changelog: 2.3.12...2.3.13

What's Changed

• Validate request host in Request::host() by @giuscris in #925

Full Changelog: 2.3.11...2.3.12

What's Changed

• Correctly ensure platform requirements in the codebase by @giuscris in #922
• Validate statistics visitor source by @giuscris in #923

Full Changelog: 2.3.10...2.3.11

Full Changelog: 2.3.9...2.3.10

What's Changed

• Enforce explicit actor-target checks for profile/password updates by @giuscris in #910
• Enforce escaping for dynamic content in views and templates by @giuscris in #920
• Drop unsafe SMIL attributeName values in SVG sanitization by @giuscris in #911

Full Changelog: 2.3.8...2.3.9