2.0.19-ls269

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.19-ls269/index.html

LinuxServer Changes:

replace sed awk with jq by @thelamer in #57

New Contributors

@thelamer made their first contribution in #57

Full Changelog: 2.0.19-ls268...2.0.19-ls269

Remote Changes:

New

You can now tighten the Twig content sandbox below its built-in defaults with new denied_* settings in security.yaml.
The "Twig in Content" report can show the effective sandbox policy, so you can see exactly what page content is allowed to do.

Improved

A theme or plugin that ships its own .htaccess can no longer switch off the protection on its own folder, which used to leave its configuration and template files downloadable #4236
Twig in page content now renders on new installs by default, instead of appearing as raw text until the setting was turned on.
The long Twig sandbox allowlists now ship built into Grav, so security.yaml only records your own additions and future security updates to the defaults reach every site.
Existing sites that had trimmed those allowlists to tighten them keep exactly that policy after upgrading, now recorded as explicit denied_* entries.
Removed two rarely-used Twig sandbox switches (logging and admin_hint); both behaviours are now always on.

Bugfix

The content cross-site scripting check no longer objects to harmless <option> and <select> markup, whose original issue is fixed in the form field that actually rendered it.
Sites running with the Twig 2 compatibility setting no longer crash with a server error on every page once an update clears the template cache #4235

2.0.19-ls268

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.19-ls268/index.html

LinuxServer Changes:

Full Changelog: 2.0.18-ls267...2.0.19-ls268

Remote Changes:

New

You can now tighten the Twig content sandbox below its built-in defaults with new denied_* settings in security.yaml.
The "Twig in Content" report can show the effective sandbox policy, so you can see exactly what page content is allowed to do.

Improved

A theme or plugin that ships its own .htaccess can no longer switch off the protection on its own folder, which used to leave its configuration and template files downloadable #4236
Twig in page content now renders on new installs by default, instead of appearing as raw text until the setting was turned on.
The long Twig sandbox allowlists now ship built into Grav, so security.yaml only records your own additions and future security updates to the defaults reach every site.
Existing sites that had trimmed those allowlists to tighten them keep exactly that policy after upgrading, now recorded as explicit denied_* entries.
Removed two rarely-used Twig sandbox switches (logging and admin_hint); both behaviours are now always on.

Bugfix

The content cross-site scripting check no longer objects to harmless <option> and <select> markup, whose original issue is fixed in the form field that actually rendered it.
Sites running with the Twig 2 compatibility setting no longer crash with a server error on every page once an update clears the template cache #4235

2.0.18-ls267

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.18-ls267/index.html

LinuxServer Changes:

Full Changelog: 2.0.17-ls266...2.0.18-ls267

Remote Changes:

Bugfix

[security] Updated the bundled DOM sanitizer to 1.0.14, which closes two further ways a crafted stylesheet could hide an external image reference from the checks added in the previous release (GHSA-ww22-4mqv-x5w3).
[security] Modular pages are now checked for cross-site scripting when they are saved, closing a way for a page editor to store a script that ran for every visitor (GHSA-fg8g-663r-f366).
[security] The Twig sort and find filters no longer run a plain function name as a callable inside the content sandbox, closing a way for a page editor to execute arbitrary PHP (GHSA-p6qj-p5m7-f62h).
A blueprint that builds on another one can again fill dropdowns from its own PHP, which mostly affected themes because their page blueprints nearly always extend the default one (getgrav/grav-plugin-email#193).
The Scheduler no longer fails outright on hosts that disable PHP's proc_open, so scheduled jobs can still be viewed and edited there (getgrav/grav-admin-next#16).
A scheduled job that cannot be started on such a host is now reported as failed with an explanation, instead of stopping the whole scheduler run.
Grav now works out who the site runs as without starting a shell, so that detail still appears when external commands are unavailable.
The record of when the scheduler last ran is now written to a fixed location rather than one relative to wherever the trigger happened to run from.

Improved

Grav now decides whether the scheduler is being triggered by checking that each job has run when its own schedule says it should have, instead of requiring a run in the last two minutes, so a sparse crontab, a webhook or a scheduled task on Windows all count.

2.0.17-ls266

2.0.16-ls265

2.0.15-ls264

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.15-ls264/index.html

LinuxServer Changes:

Update default.conf.sample by @santacruz-usa in #56

New Contributors

@santacruz-usa made their first contribution in #56

Full Changelog: 2.0.12-ls263...2.0.15-ls264

Remote Changes:

Bugfix

A plugin's blueprints can use the data providers that plugin ships again, instead of having every one of them refused by a check that only recognised the providers core itself registers (getgrav/grav-plugin-email#193). Fields defined in page frontmatter are held to the stricter rule instead, which is where the risk actually was.
[security] A configuration admin can no longer reach an unvetted built-in routine by writing a blueprint field's data provider as a plain function name, a spelling that was still being checked against a list of known-bad names rather than the list of approved ones (GHSA-f8wv-xp27-6gq7).
[security] The content security scan now reads an unpaired quote inside an unquoted attribute value the way a browser does, closing another way a page editor could hide a script from it (GHSA-vfmf-q6x9-cw96).
[security] The media URL in an audio or video tag is now escaped, so a filename carrying markup can no longer add its own attributes to the player (GHSA-6qw9-4vv5-jr97).
JSON responses no longer fail outright when the data contains invalid UTF-8. json_encode() returns false on malformed bytes, and the PSR-7 response body is type-hinted string|resource|StreamInterface, so that false came back out as an unhandled TypeError from inside the vendor stream rather than as a response. Bad bytes are now substituted, and the remaining structural failures raise a catchable JsonException instead of a silent false. Output for valid data is unchanged.
[security] The fast static asset server now keeps a request inside the directory the site published, instead of also allowing any neighbouring directory whose name starts with the same letters (GHSA-4v9q-p283-qc2m).
[security] File uploads now reject a few more extensions that browsers run script from, or that a server may hand to PHP: xhtml, xht, svgz, php7, php8, pht, phtm and phps (GHSA-66xf-ggf4-6hmc).
[security] The bundled Caddyfile protections did nothing. They were written as nginx-style regexes, which Caddy reads as literal paths that never match, and the respond they redirected to ran after the catch-all rewrite had already claimed the request. The rules are now named path_regexp matchers answering 403 directly, inside a route block so they run before the rewrite.

2.0.15-ls263

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.15-ls263/index.html

LinuxServer Changes:

No changes

Remote Changes:

Bugfix

A plugin's blueprints can use the data providers that plugin ships again, instead of having every one of them refused by a check that only recognised the providers core itself registers (getgrav/grav-plugin-email#193). Fields defined in page frontmatter are held to the stricter rule instead, which is where the risk actually was.
[security] A configuration admin can no longer reach an unvetted built-in routine by writing a blueprint field's data provider as a plain function name, a spelling that was still being checked against a list of known-bad names rather than the list of approved ones (GHSA-f8wv-xp27-6gq7).
[security] The content security scan now reads an unpaired quote inside an unquoted attribute value the way a browser does, closing another way a page editor could hide a script from it (GHSA-vfmf-q6x9-cw96).
[security] The media URL in an audio or video tag is now escaped, so a filename carrying markup can no longer add its own attributes to the player (GHSA-6qw9-4vv5-jr97).
JSON responses no longer fail outright when the data contains invalid UTF-8. json_encode() returns false on malformed bytes, and the PSR-7 response body is type-hinted string|resource|StreamInterface, so that false came back out as an unhandled TypeError from inside the vendor stream rather than as a response. Bad bytes are now substituted, and the remaining structural failures raise a catchable JsonException instead of a silent false. Output for valid data is unchanged.
[security] The fast static asset server now keeps a request inside the directory the site published, instead of also allowing any neighbouring directory whose name starts with the same letters (GHSA-4v9q-p283-qc2m).
[security] File uploads now reject a few more extensions that browsers run script from, or that a server may hand to PHP: xhtml, xht, svgz, php7, php8, pht, phtm and phps (GHSA-66xf-ggf4-6hmc).
[security] The bundled Caddyfile protections did nothing. They were written as nginx-style regexes, which Caddy reads as literal paths that never match, and the respond they redirected to ran after the catch-all rewrite had already claimed the request. The rules are now named path_regexp matchers answering 403 directly, inside a route block so they run before the rewrite.

2.0.14-ls263

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.14-ls263/index.html

LinuxServer Changes:

No changes

Remote Changes:

Improved

Removed old JQuery 2.1.4. However 2.2.4 and 3.7.1 remain for legacy support

Bugfix

[security] An administrator with account-management rights can no longer grant themselves super-admin access by saving it into a user group's permissions, a protection the account form already had (GHSA-xhfv-7758-r9hx).
[security] The content security scan no longer reports a page as clean when it was unable to examine it, closing two ways a page editor could hide a script from it: a single invalid character anywhere in the content, and padding a tag out to several thousand characters (GHSA-q2j8-x8hf-63ch).

2.0.13-ls263

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.13-ls263/index.html

LinuxServer Changes:

No changes

Remote Changes:

New

Added an array_group_by Twig filter and function for grouping a list of items by one of their values (#4218).

Bugfix

[security] A configuration admin can no longer run code on the server by pointing a dynamic field's data provider at a built-in routine named as a class-and-method pair, a form that slipped past the safety check because it only inspected the single-string spelling; both forms are now vetted the same way (GHSA-r94f-hx44-8jqf).
[security] A page editor without super-admin rights can no longer store an event-handler script that runs for site visitors by hiding it behind a > placed inside a quoted HTML attribute; the content security scan now reads quoted attribute values the same way a browser does (GHSA-269c-h76q-8cxw).
[security] A backup profile's location is now confined to the site folder, so a profile pointing outside the Grav root can no longer pull external directories into the backup archive (GHSA-fch7-cpv4-w7hg).
[security] Uploaded filenames may no longer contain the HTML characters <, >, or ", so a stored filename cannot carry markup that could run if it were later shown unescaped.
[security] The find and sort Twig filters now reject a dangerous function name given as their callback, matching the protection already applied to map, filter, and reduce, so template values cannot use them to run code (GHSA-xx48-97m4-h7qm).
The bundled nginx.conf security rules are now anchored to the start of the path like the .htaccess rules already are, so the admin's Tools → Logs viewer works on nginx instead of being blocked (#4223).
On non-FastCGI setups Grav no longer sends an invalid Content-Encoding: none header, which some strict HTTP clients rejected outright; it now closes the connection cleanly without the bogus value (#2619).

2.0.12-ls263

CI Report:

https://ci-tests.linuxserver.io/linuxserver/grav/2.0.12-ls263/index.html

LinuxServer Changes:

Full Changelog: 2.0.12-ls262...2.0.12-ls263

Remote Changes:

New

Added per-language fallbacks for unsupported browser languages during HTTP_ACCEPT_LANGUAGE negotiation, allowing them to resolve to supported languages without exposing additional language routes.

Improved

The read_file() Twig function can now read .css files by default, so inline stylesheets can be embedded in a template without adjusting the security config (#4215).
Documented that the site-wide media object resolves lazily, so its inherited collection query methods need media_directory() to filter or sort site media (#4210).

Bugfix

Browser language codes are now matched case-insensitively during HTTP_ACCEPT_LANGUAGE fallback negotiation.