Skip to content

Commit 2cec3d8

Browse files
riasvdvriasvdv
committed
Merge branch '5.9' into 6.x
# Conflicts: # CHANGELOG-WIP.md # src/Config/GeneralConfig.php # src/Field/Number.php # src/Support/Html.php # src/User/Elements/User.php # src/base/CpEditable.php # src/config/app.php # src/i18n/Locale.php # src/models/Site.php # src/models/UserGroup.php # yii2-adapter/legacy/base/ElementInterface.php # yii2-adapter/legacy/base/NestedElementInterface.php # yii2-adapter/legacy/base/NestedElementTrait.php # yii2-adapter/legacy/config/twig-sandbox.php # yii2-adapter/legacy/elements/Address.php # yii2-adapter/legacy/elements/Asset.php # yii2-adapter/legacy/elements/Entry.php # yii2-adapter/legacy/services/Gql.php # yii2-adapter/legacy/services/Security.php # yii2-adapter/legacy/web/View.php # yii2-adapter/legacy/web/twig/AllowedInSandbox.php # yii2-adapter/tests/_craft/config/general.php
2 parents 5b378ff + 8f01851 commit 2cec3d8

File tree

34 files changed

+684
-55
lines changed

34 files changed

+684
-55
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,11 @@
1515
- Fixed a JavaScript error that could occur if two control panel animations were triggered simultaneously.
1616
- Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. ([#18185](https://github.com/craftcms/cms/pull/18185))
1717
- Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
18+
- Fixed a bug where consecutive hyphens (`-`) within Link fields’ “Class Name” values were getting removed. ([#18201](https://github.com/craftcms/cms/issues/18201))
1819
- Fixed an SSRF vulnerability. (GHSA-96pq-hxpw-rgh8)
1920
- Fixed an XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
21+
- Fixed a SQL injection vulnerability. (GHSA-2453-mppf-46cj)
22+
- Fixed an XSS vulnerability. (GHSA-9f5h-mmq6-2x78)
2023

2124
## 5.8.21 - 2025-12-04
2225

‎config/twig-sandbox.php‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
<?php
2+
3+
return [
4+
'allowedTags' => [
5+
'apply',
6+
'autoescape',
7+
'for',
8+
'if',
9+
'macro',
10+
'set',
11+
'switch',
12+
'verbatim',
13+
],
14+
'allowedFilters' => [
15+
'abs',
16+
'address',
17+
'append',
18+
'ascii',
19+
'base64_encode',
20+
'batch',
21+
'boolean',
22+
'camel',
23+
'capitalize',
24+
'column',
25+
'contains',
26+
'currency',
27+
'date',
28+
'date_modify',
29+
'datetime',
30+
'default',
31+
'diff',
32+
'duration',
33+
'e',
34+
'escape',
35+
'filesize',
36+
'filter',
37+
'filter',
38+
'filterByValue',
39+
'find',
40+
'first',
41+
'float',
42+
'format',
43+
'group',
44+
'id',
45+
'index',
46+
'indexOf',
47+
'integer',
48+
'intersect',
49+
'invoke',
50+
'join',
51+
'kebab',
52+
'keys',
53+
'last',
54+
'lcfirst',
55+
'length',
56+
'length',
57+
'lower',
58+
'map',
59+
'map',
60+
'markdown',
61+
'md',
62+
'merge',
63+
'merge',
64+
'money',
65+
'multisort',
66+
'nl2br',
67+
'number',
68+
'number_format',
69+
'pascal',
70+
'percentage',
71+
'prepend',
72+
'push',
73+
'raw',
74+
'reduce',
75+
'reduce',
76+
'replace',
77+
'replace',
78+
'reverse',
79+
'round',
80+
'shuffle',
81+
'slice',
82+
'sort',
83+
'spaceless',
84+
'split',
85+
'string',
86+
'striptags',
87+
't',
88+
'time',
89+
'timestamp',
90+
'title',
91+
'translate',
92+
'trim',
93+
'truncate',
94+
'ucfirst',
95+
'ucwords',
96+
'unique',
97+
'unshift',
98+
'upper',
99+
'url_encode',
100+
'values',
101+
'where',
102+
'widont',
103+
'without',
104+
'withoutKey',
105+
],
106+
'allowedFunctions' => [
107+
'attr',
108+
'ceil',
109+
'collect',
110+
'combine',
111+
'cpUrl',
112+
'cycle',
113+
'dataUrl',
114+
'date',
115+
'date',
116+
'encodeUrl',
117+
'floor',
118+
'max',
119+
'min',
120+
'ol',
121+
'random',
122+
'range',
123+
'raw',
124+
'seq',
125+
'shuffle',
126+
'siteUrl',
127+
'svg',
128+
'tag',
129+
'timezone_names',
130+
'ul',
131+
'url',
132+
'uuid',
133+
],
134+
'allowedMethods' => [],
135+
'allowedProperties' => [],
136+
];

‎resources/templates/_components/fieldtypes/Number/input.twig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
<div class="flex">
2626
{% if hasPrefix %}
2727
<div aria-hidden="true">
28-
{{ prefix|t('site')|md(inlineOnly=true)|raw }}
28+
{{ prefix|t('site')|md(inlineOnly=true,encode=true)|raw }}
2929
</div>
3030
{% endif %}
3131
<div>
@@ -51,7 +51,7 @@
5151
</div>
5252
{% if hasSuffix %}
5353
<div aria-hidden="true">
54-
{{ suffix|t('site')|md(inlineOnly=true)|raw }}
54+
{{ suffix|t('site')|md(inlineOnly=true,encode=true)|raw }}
5555
</div>
5656
{% endif %}
5757
</div>

‎resources/templates/graphql/schemas/_edit.twig‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,15 @@
122122
label: '{name} directive'|t('app', {
123123
name: '`@parseRefs`',
124124
}),
125-
warning: 'Provides read-only access to user data and most content.',
125+
warning: 'Can be exploited to reveal sensitive content by information disclosure attacks.'|t('app'),
126126
},
127-
}) }}
127+
'directive:transform': not craft.app.config.general.disableGraphqlTransformDirective ? {
128+
label: '{name} directive'|t('app', {
129+
name: '`@transform`',
130+
}),
131+
warning: 'Can be exploited by DoS attacks.'|t('app'),
132+
},
133+
}|filter) }}
128134
</div>
129135

130136
{% endblock %}

‎resources/translations/cy/app.php‎

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Component/Contracts/CpEditable.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
namespace CraftCms\Cms\Component\Contracts;
66

7+
use craft\web\twig\AllowedInSandbox;
8+
79
/**
810
* CpEditable defines the common interface to be implemented by components
911
* that have a dedicated edit page in the control panel.
@@ -13,5 +15,6 @@ interface CpEditable
1315
/**
1416
* Returns the URL to the component’s edit page in the control panel.
1517
*/
18+
#[AllowedInSandbox]
1619
public function getCpEditUrl(): ?string;
1720
}

‎src/Config/ConfigServiceProvider.php‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ final class ConfigServiceProvider extends ServiceProvider
1919
'general',
2020
'redirects',
2121
'routes',
22+
'twig-sandbox',
2223
];
2324

2425
#[Override]
@@ -27,6 +28,14 @@ public function register(): void
2728
Env::extend(fn () => ConstAdapter::class, 'CraftConstAdapter');
2829

2930
$this->app->singleton(GeneralConfig::class, fn () => $this->app->make(ConfigRepository::class)->get('craft.general'));
31+
32+
collect($this->configFiles)->each(function (string $file) {
33+
if ($file === 'general') {
34+
return;
35+
}
36+
37+
$this->mergeConfigFrom(__DIR__."/../../config/$file.php", "craft.$file");
38+
});
3039
}
3140

3241
public function boot(): void
@@ -41,7 +50,7 @@ private function bootPublishables(): void
4150
return;
4251
}
4352

44-
collect($this->configFiles)->each(function ($file) {
53+
collect($this->configFiles)->each(function (string $file) {
4554
$this->publishes([__DIR__."/../../config/$file.php" => config_path("craft/$file.php")], 'craftcms-config');
4655
});
4756
}

‎src/Config/GeneralConfig.php‎

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1039,7 +1039,7 @@ class GeneralConfig extends BaseConfig
10391039
public bool $disallowRobots = false;
10401040

10411041
/**
1042-
* @var bool Whether the `transform` directive should be disabled for the GraphQL API.
1042+
* @var bool Whether the `@transform` directive should be disabled for the GraphQL API.
10431043
*
10441044
* ::: code
10451045
* ```php Static Config
@@ -1050,7 +1050,15 @@ class GeneralConfig extends BaseConfig
10501050
* ```
10511051
* :::
10521052
*
1053+
* ::: tip
1054+
* As of Craft 5.9.0, the `@transform` directive can be optionally included for each GraphQL schema,
1055+
* unless this setting is set to `true`.
1056+
* :::
1057+
*
10531058
* @group GraphQL
1059+
*
1060+
* @since 3.6.0
1061+
* @deprecated in 5.9.0
10541062
*/
10551063
public bool $disableGraphqlTransformDirective = false;
10561064

@@ -1240,6 +1248,24 @@ class GeneralConfig extends BaseConfig
12401248
*/
12411249
public bool $enableTemplateCaching = true;
12421250

1251+
/**
1252+
* @var bool Whether user-defined Twig templates should be sandboxed.
1253+
*
1254+
* ::: code
1255+
* ```php Static Config
1256+
* ->enableTwigSandbox()
1257+
* ```
1258+
* ```shell Environment Override
1259+
* CRAFT_ENABLE_TWIG_SANDBOX=true
1260+
* ```
1261+
* :::
1262+
*
1263+
* @see enableTwigSandbox()
1264+
*
1265+
* @group Security
1266+
*/
1267+
public bool $enableTwigSandbox = false;
1268+
12431269
/**
12441270
* @var string The prefix that should be prepended to HTTP error status codes when determining the path to look for an error’s template.
12451271
*
@@ -4487,12 +4513,17 @@ public function disallowRobots(bool $value = true): self
44874513
}
44884514

44894515
/**
4490-
* Whether the `transform` directive should be disabled for the GraphQL API.
4516+
* Whether the `@transform` directive should be disabled for the GraphQL API.
44914517
*
44924518
* ```php
44934519
* ->disableGraphqlTransformDirective(true)
44944520
* ```
44954521
*
4522+
* ::: tip
4523+
* As of Craft 5.9.0, the `@transform` directive can be optionally included for each GraphQL schema,
4524+
* unless this setting is set to `true`.
4525+
* :::
4526+
*
44964527
* @group GraphQL
44974528
*
44984529
* @see $disableGraphqlTransformDirective
@@ -4719,10 +4750,10 @@ public function enableTemplateCaching(bool $value = true): self
47194750
}
47204751

47214752
/**
4722-
* Whether all Twig templates should be sandboxed.
4753+
* Whether user-defined Twig templates should be sandboxed.
47234754
*
47244755
* ```php
4725-
* ->enableTwigSandbox(false)
4756+
* ->enableTwigSandbox()
47264757
* ```
47274758
*
47284759
* @group Security
@@ -4732,7 +4763,7 @@ public function enableTemplateCaching(bool $value = true): self
47324763
#[Deprecated(message: 'in 6.0.0. Sandbox is always enabled.')]
47334764
public function enableTwigSandbox(bool $value = true): self
47344765
{
4735-
app()->booting(fn () => Deprecator::log('generalConfig.enableTwigSandbox', 'Calling enableTwigSandbox() is deprecated. Sandbox is always enabled.'));
4766+
$this->enableTwigSandbox = $value;
47364767

47374768
return $this;
47384769
}

‎src/Field/Number.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use CraftCms\Cms\Field\Contracts\MergeableFieldInterface;
1616
use CraftCms\Cms\Field\Contracts\SortableFieldInterface;
1717
use CraftCms\Cms\Support\Facades\I18N;
18+
use CraftCms\Cms\Support\Html;
1819
use CraftCms\Cms\Support\Query;
1920
use CraftCms\Cms\Translation\Locale;
2021
use GraphQL\Type\Definition\Type;
@@ -24,6 +25,7 @@
2425
use Throwable;
2526
use yii\base\InvalidArgumentException;
2627
use yii\db\Schema;
28+
use yii\helpers\Markdown;
2729

2830
use function CraftCms\Cms\t;
2931

@@ -377,11 +379,11 @@ public function getPreviewHtml(mixed $value, ElementInterface $element): string
377379
};
378380

379381
if ($this->prefix) {
380-
$formatted = $this->prefix.$formatted;
382+
$formatted = Markdown::processParagraph(Html::encode($this->prefix)).$formatted;
381383
}
382384

383385
if ($this->suffix) {
384-
$formatted .= $this->suffix;
386+
$formatted .= Markdown::processParagraph(Html::encode($this->suffix));
385387
}
386388

387389
return $formatted;

0 commit comments

Comments
 (0)