Ensures proper checking of page-based visibility, ensuring that the
draft status of the related page is also considered when checking view
ability.
Thanks to Huzaifa Dal for responsibly reporting.
There's only one route that should ignore CSRF, and that's already
marked to not use the CSRF middlware in the routes definition.
Helps prevent potential CSRF based logout from subdomains (same-sites).
Thanks to The Xora team for responsibly reporting.
Refreshes the remember me token on password change, so that existing
remember-me sessions are dropped.
This helps invalidate existing remember-me access in scenarios where
passwords are being changed after unauthorized access.
Added test to cover.
Thanks to Semilore Osofisan for responsibly reporting this scenario.
During validation, added tracking of each time a file reference is used,
so that the total use of files can be validated to help prevent heavy
DoS scenarios.
Thanks to VG for responsibly reporting this scenario
Removes results related to entities which are in the recycle bin.
Removed entity has query from tag repo as that's now covered by this.
Removed extra permission application function as its now redundant.
Added tests to cover.
Thanks to Nicol (waterhunter2000) for responsibly reporting.
When uncompressing file data from a ZIP, limits are now placed on the
amount of bytes read, based on the reported file sizes.
For files, we then check and error if the read size is over the reported
uncompressed file size in the ZIP, instead of relying on the reported
ZIP size from metadata.
Added test to cover.
List endpoint would show attachments for pages which were in the recycle
bin. This adds a deleted_at filter for related pages to the core
permission application query.
Added test to cover.
For #6194
Fixes scenario where page access permissions are changed due to a change
of applied permission scope (where a parent book permissions were
active, but would no longer be post-promotion), but the page visibility
permissions were not being rebuilt.
Added test to cover.
Fixes#6226
Fixed issue where the 'unused' location could be duplicated if a block
is in 'unused' by default, resulting in disappearing block section
options when attempting to configure in the UI.
- Updated examples to ensure they show results of the same page/book.
- Added method to controller to share the same request data logic.
- Tweaked tests.
Updates the content pointer behaviour so it's inserted before/after the
target, instead of just before, depending on selection direction, so it
can stay out of the selection range.
Positioning is absolute relative to a parent content so visually should
be the same result as before.
For #6214
This specifically alters the checkbox label implementation to use the
existing checkbox label instead of always adding an extra label to the
custom checkbox element itself, unless they diverge (like for permission
checkboxes).
Prevents the same IDs from different systems leading to access of other
accounts, and allows registration of same ids under different services.
Thanks to Google and Ada Logics for discovery and reporting.
It now retains existing input where set.
This also updates the modal click handling with an extra click source
check to handle cases where a mousedown event is not emitted, like on
select list dismissals.
Required updating the selection management to ensure they are selected
upon mousedown, for when a drag operation starts.
Also added draggable management, which we have to avoid having there
when open unless a drag is started, otherwise contents are not editable
in chromium browsers.
