v2.0.15

4 days ago

1. • A plugin's blueprints can use the data providers that plugin ships again, instead of having every one of them refused by a check that only recognised the providers core itself registers (getgrav/grav-plugin-email#193). Fields defined in page frontmatter are held to the stricter rule instead, which is where the risk actually was.
   • [security] A configuration admin can no longer reach an unvetted built-in routine by writing a blueprint field's data provider as a plain function name, a spelling that was still being checked against a list of known-bad names rather than the list of approved ones (GHSA-f8wv-xp27-6gq7).
   • [security] The content security scan now reads an unpaired quote inside an unquoted attribute value the way a browser does, closing another way a page editor could hide a script from it (GHSA-vfmf-q6x9-cw96).
   • [security] The media URL in an audio or video tag is now escaped, so a filename carrying markup can no longer add its own attributes to the player (GHSA-6qw9-4vv5-jr97).
   • JSON responses no longer fail outright when the data contains invalid UTF-8. json_encode() returns false on malformed bytes, and the PSR-7 response body is type-hinted string|resource|StreamInterface, so that false came back out as an unhandled TypeError from inside the vendor stream rather than as a response. Affected createJsonResponse() and both JSON error responses in ControllerResponseTrait, where an exception message carrying a bad byte would take out the error handler itself, plus the Clockwork data endpoint in Debugger. Bad bytes are now substituted, and the remaining structural failures (recursion depth, INF/NAN) raise a catchable JsonException instead of a silent false. Output for valid data is unchanged.
   • [security] The fast static asset server now keeps a request inside the directory the site published, instead of also allowing any neighbouring directory whose name starts with the same letters (GHSA-4v9q-p283-qc2m).
   • [security] File uploads now reject a few more extensions that browsers run script from, or that a server may hand to PHP: xhtml, xht, svgz, php7, php8, pht, phtm and phps (GHSA-66xf-ggf4-6hmc).
   • [security] The bundled Caddyfile protections did nothing. They were written as nginx-style regexes, which Caddy reads as literal paths that never match, and the respond they redirected to ran after the catch-all rewrite had already claimed the request. A site served with this config handed out user/accounts/, user/config/, logs/, composer.lock, page files, and the system/ and vendor/ folders to anyone who asked. The rules are now named path_regexp matchers answering 403 directly, inside a route block so they run before the rewrite, and they were checked request by request against the .htaccess behaviour.

v2.0.14

1 week ago

1. • Removed old JQuery 2.1.4. However 2.2.4 and 3.7.1 remain for legacy support
2. • [security] An administrator with account-management rights can no longer grant themselves super-admin access by saving it into a user group's permissions, a protection the account form already had (GHSA-xhfv-7758-r9hx).
   • [security] The content security scan no longer reports a page as clean when it was unable to examine it, closing two ways a page editor could hide a script from it: a single invalid character anywhere in the content, and padding a tag out to several thousand characters (GHSA-q2j8-x8hf-63ch).

v2.0.13

2 weeks ago

1. • Added an array_group_by Twig filter and function for grouping a list of items by one of their values (#4218).
2. • [security] A configuration admin can no longer run code on the server by pointing a dynamic field's data provider at a built-in routine named as a class-and-method pair, a form that slipped past the safety check because it only inspected the single-string spelling; both forms are now vetted the same way (GHSA-r94f-hx44-8jqf).
   • [security] A page editor without super-admin rights can no longer store an event-handler script that runs for site visitors by hiding it behind a > placed inside a quoted HTML attribute; the content security scan now reads quoted attribute values the same way a browser does (GHSA-269c-h76q-8cxw).
   • [security] A backup profile's location is now confined to the site folder, so a profile pointing outside the Grav root can no longer pull external directories into the backup archive (GHSA-fch7-cpv4-w7hg).
   • [security] Uploaded filenames may no longer contain the HTML characters <, >, or ", so a stored filename cannot carry markup that could run if it were later shown unescaped.
   • [security] The find and sort Twig filters now reject a dangerous function name given as their callback, matching the protection already applied to map, filter, and reduce, so template values cannot use them to run code (GHSA-xx48-97m4-h7qm).
   • The bundled nginx.conf security rules are now anchored to the start of the path like the .htaccess rules already are, so the admin's Tools → Logs viewer works on nginx instead of being blocked (#4223).
   • On non-FastCGI setups Grav no longer sends an invalid Content-Encoding: none header, which some strict HTTP clients rejected outright; it now closes the connection cleanly without the bogus value (#2619).

v2.0.12

3 weeks ago

1. • Added per-language fallbacks for unsupported browser languages during HTTP_ACCEPT_LANGUAGE negotiation, allowing them to resolve to supported languages without exposing additional language routes.
2. • The read_file() Twig function can now read .css files by default, so inline stylesheets can be embedded in a template without adjusting the security config (#4215).
   • Documented that the site-wide media object resolves lazily, so its inherited collection query methods need media_directory() to filter or sort site media (#4210).
3. • Browser language codes are now matched case-insensitively during HTTP_ACCEPT_LANGUAGE fallback negotiation.

v2.0.11

4 weeks ago

1. • You can now filter, sort, and group a page's media by the values in their .meta.yaml metafiles directly in Twig, with new filterBy, where, findBy, sortBy, groupBy, and withMeta methods on page.media. Fixes getgrav/grav#4200.
2. • [security] A page editor can no longer read arbitrary files from the server by pointing an image watermark at a traversal path such as carrier.png?watermark=../secret.png; an editor-supplied watermark path is now confined to the site's media, while operator-configured watermarks and stream URIs are unaffected (GHSA-w3f4-8pj2-599w).
   • [security] A page-edit account can no longer reach file-disclosure or secret-read functions by naming an arbitrary Class::method as a dynamic field's data provider; qualified providers are now limited to a known-safe allowlist, closing a bypass of the guard added in 2.0.7 and 2.0.9 (GHSA-7pgq-cr25-xvc8, GHSA-cxv3-5jj3-cpgr).
   • A page is no longer blanked when viewed just because a trusted plugin or shortcode on it outputs markup the content security scan flags, such as an embed, form, or icon; the check that guards against dangerous editor content now runs once when the page is saved rather than every time it is rendered (GHSA-2c4f-86xc-cr74).
3. • [security] Page content that uses Twig to assemble disallowed markup at render time, such as building an event handler or a <script> tag from separate pieces, is now refused when you save the page instead of being allowed through to visitors.
   • The raw Twig filter is no longer allowed inside editor-authored page content, so page content can no longer output unescaped dynamic values past the content security check; trusted theme templates are unaffected.

v2.0.10

4 weeks ago

1. • A partial system.pages.process override in user/config/system.yaml (for example setting only twig: false) no longer silently turns off Markdown and leaves every page rendering its raw source. Because pages.process is a single field in the blueprint, a partial override replaced the whole map and dropped the default markdown: true; core now re-applies that default, so an affected site recovers on update with no change to its config. An explicit markdown: false is still honored.

v2.0.9

4 weeks ago

1. • [security] A callable directive hidden in a Flex directory's blueprint field can no longer run commands on the server; dynamic field data on Flex types (Flex Pages, Flex Users, Flex Objects) now refuses dangerous functions, closing a path that bypassed the same guard added for page forms in 2.0.7 (GHSA-c4wf-2xxc-68qm).
   • [security] The scheduler webhook trigger now fails closed when no token is configured, so an enabled webhook left without a token can no longer run scheduled jobs for anonymous callers (GHSA-xwv3-2mv2-w33x).
   • Images and links whose filename contains spaces now render when the path is wrapped in angle brackets, for example ![](<My image.jpg>). Fixes getgrav/grav#4197.

v2.0.8

1 month ago

1. • An email or www. URL used as the visible text of a Markdown link is no longer turned into a second, nested link when GFM autolinks are enabled. Fixes getgrav/grav#4191.
   • md5() can once again be called as a Twig function, not just as the |md5 filter, so themes and plugins that generate an id or cache-busting hash with md5(...) keep working instead of failing with an "Unknown function" error. Fixes getgrav/grav-theme-quark2#12.
   • Replacing an image in place, such as swapping the image in a Flex object field, now shows the new image on the site instead of the previously cached version (updated getgrav/image to v4.1.3, which includes the source file's modification time and size in the derivative cache key). Fixes getgrav/grav#4195.

v2.0.7

1 month ago

1. • [security] A page editor can no longer run commands on the server by hiding a callable directive in a form field's settings; dynamic field data now refuses dangerous functions and cannot be tricked into reaching one through a helper (GHSA-fj2p-qj2f-74v5).
   • A page's translatedLanguages() now localizes ancestor slugs too, so a nested translation whose parent folder has a localized slug: produces the fully translated cross-language link instead of leaving parent segments in the current language. Fixes getgrav/grav#4186.
   • Pointing the log stream at environment:// (for example log: environment://logs) no longer crashes the site or bin/grav clear with a "stream must either be a resource or a string" error when the per-environment folder does not exist; logging now falls back to the default logs/ folder instead. Fixes getgrav/grav#4172.
   • The media:// stream now checks the per-environment user/env/<host>/media/ folder before the shared user/media/, so site media stored per environment resolves to the correct URL in the admin and in page content instead of a broken user/media/ link. Fixes getgrav/grav#4188.
   • Large file downloads such as site backups are now streamed to the browser in chunks instead of being loaded into memory all at once, so a download bigger than PHP's memory limit no longer fails with a blank server error. Fixes getgrav/grav-plugin-api#12.
   • Backups initialization no longer runs twice when something that bypasses the normal request middleware (such as the API plugin) also attaches the backup scheduler listener, so the listener is registered only once.
   • Pages accessed with URL parameters such as pagination or taxonomy filters no longer recompile every Twig template on each request, restoring full template caching on exactly the pages that get the most traffic.
   • The per-file compiled cache for YAML and markdown files now loads through its intended opcache fast path, and a source file that has been deleted no longer serves stale cached data.
   • A modular page that outputs trusted theme or plugin markup, such as a form with a reCAPTCHA field, is no longer wrongly blanked by the content security scan, which now checks the editor's own content instead of the finished template output. Fixes getgrav/grav-plugin-form#636.
   • Chaining media actions on page media under the content security scan, such as {{ page.media['x.jpg'].lightbox(1024,768).cropResize(176,176).html() }}, now works instead of being blocked, and the scan's list of allowed media methods stays in step with Grav's documented media actions automatically.
2. • Updating a plugin or theme whose required dependency is held back by a newer Grav or PHP requirement now explains the real fix. Instead of reporting that the needed version is "higher than the latest release" and suggesting a cache refresh, the updater names the newer dependency release and the Grav (or PHP) version it needs, so you know to update Grav first. Relates to getgrav/grav-plugin-admin2#93.
   • Backup profiles now always appear in the scheduler where each can be switched on or off with the Enabled/Disabled toggle, instead of a profile staying hidden until its schedule was turned on; the profile's schedule setting seeds the default state and an explicit toggle takes precedence.
   • Frontend requests are noticeably faster across the board: the scheduler, backups machinery, error page renderer and logger now initialize only when actually used instead of on every page view, cutting over 50 PHP files from a typical request.
   • The filesystem scan that checks pages for changes now reuses its result for a couple of seconds (configurable with cache.check.interval), so busy sites no longer stat every page file on every single request; content edits still show up right away in normal editing workflows and admin saves remain instant.
   • Configuration, blueprint and language file lists honor the same freshness window instead of checking every tracked file's timestamp three times per request, and theme blueprints no longer load at all on normal frontend page views.
   • Class autoloading is faster: source installs get an optimized class map, APCu is suggested so the existing autoloader cache setting can engage, and plugin autoloaders no longer sit in front of the core one where every core class lookup had to pass through them first.
   • Rendering a page with cached content no longer loads its whole media collection up front, the pages index no longer stores pre-computed metadata for every page, and relative markdown links resolve their target page directly instead of building the full page list per link.
   • Assorted hot-path trims: string helpers use fast native functions for the common case, asset rendering skips per-asset integrity work when the feature is off, the site root URL is computed once per request instead of per asset, and debugger timers cost nothing when the debugger is disabled.
   • New experimental opt-in page index (pages.lazy_index: true): pages, routes, children lists, sort orders and the taxonomy map load on demand from a per-page index instead of one large cache blob that has to be fully unserialized on every request, making per-request cost flat as sites grow: a 2,000 page test site renders as fast as a 2 page one and uses a quarter of the memory; SQLite powers the index when available with a pure PHP fallback, and the default behavior is completely unchanged until the flag is enabled.
   • Page collection filters (visible, routable, published, module) now use menu flags recorded in the page index, so building a navigation menu that filters a folder to its visible pages no longer loads every hidden sibling first. On a 500 post blog under the Quark theme this cut the pages built for a page view from all 507 to 7 and roughly halved memory; it helps every site, most of all large ones with the experimental page index enabled.
   • Sorting a page collection by date, title, or another common field now reads that value from the page index instead of loading every page in the collection just to read one field, and on single language sites the automatic translated filter that every collection applies no longer loads any pages at all. With the experimental page index enabled, a blog post showing a related posts grid dropped from loading every post on the site to only the handful it displays.
   • The setting that scans page content for XSS moved to security.content.xss_scan_output, since it applies to all page content rather than only Twig in content; the previous security.twig_content.xss_scan_output location keeps working and is moved to the new one automatically on upgrade.

v2.0.6

1 month ago

1. • [security] Flex user avatars stored under user/accounts/<username>/ (folder storage) are now served too; the 2.0.5 avatar carve-out only covered the flatfile user/accounts/avatars/ layout, so folder-storage avatars kept returning a 403. Existing sites self-heal on upgrade. Fixes getgrav/grav#4185.