We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent c419575 commit aea3f3bCopy full SHA for aea3f3b
CHANGES.rst
@@ -1,6 +1,21 @@
1
Changes
2
=======
3
4
+1.3.2
5
+-----
6
+
7
+Added CSP (Content Security Policy) middleware to stop malicious SVG files from
8
+executing JavaScript. This was possible if:
9
10
+* Local media storage was enabled
11
+* SVG uploads were allowed from untrusted sources
12
+* When viewing an uploaded SVG in Piccolo Admin, if you open the SVG in a new
13
+ tab then it's possible for JavaScript to run.
14
15
+It's recommended that you upgrade to this version. Thanks to @Skelmis for this.
16
17
+-------------------------------------------------------------------------------
18
19
1.3.1
20
-----
21
piccolo_admin/version.txt
@@ -1 +1 @@
-1.3.1
0 commit comments