Grav CMS - Package Updates

[Package Updates]

[1.10.17]

• Update grav to 2.0.18
• Full Changelog
• [security] Updated the bundled DOM sanitizer to 1.0.14, which closes two further ways a crafted stylesheet could hide an external image reference from the checks added in the previous release (GHSA-ww22-4mqv-x5w3).
• [security] Modular pages are now checked for cross-site scripting when they are saved, closing a way for a page editor to store a script that ran for every visitor (GHSA-fg8g-663r-f366).
• [security] The Twig sort and find filters no longer run a plain function name as a callable inside the content sandbox, closing a way for a page editor to execute arbitrary PHP (GHSA-p6qj-p5m7-f62h).
• A blueprint that builds on another one can again fill dropdowns from its own PHP, which mostly affected themes because their page blueprints nearly always extend the default one (getgrav/grav-plugin-email#193).
• The Scheduler no longer fails outright on hosts that disable PHP's proc_open, so scheduled jobs can still be viewed and edited there getgrav/grav-admin-next#16
• A scheduled job that cannot be started on such a host is now reported as failed with an explanation, instead of stopping the whole scheduler run
• Grav now works out who the site runs as without starting a shell, so that detail still appears when external commands are unavailable
• The record of when the scheduler last ran is now written to a fixed location rather than one relative to wherever the trigger happened to run from
• Grav now decides whether the scheduler is being triggered by checking that each job has run when its own schedule says it should have, instead of requiring a run in the last two minutes, so a sparse crontab, a webhook or a scheduled task on Windows all count

[Package Updates]

[1.10.18]

• Update grav to 2.0.19
• Full Changelog
• You can now tighten the Twig content sandbox below its built-in defaults with new denied_* settings in security.yaml.
• The "Twig in Content" report can show the effective sandbox policy, so you can see exactly what page content is allowed to do.
• A theme or plugin that ships its own .htaccess can no longer switch off the protection on its own folder, which used to leave its configuration and template files downloadable #4236
• Twig in page content now renders on new installs by default, instead of appearing as raw text until the setting was turned on.
• The long Twig sandbox allowlists now ship built into Grav, so security.yaml only records your own additions and future security updates to the defaults reach every site.
• Existing sites that had trimmed those allowlists to tighten them keep exactly that policy after upgrading, now recorded as explicit denied_* entries.
• Removed two rarely-used Twig sandbox switches (logging and admin_hint); both behaviours are now always on.
• The content cross-site scripting check no longer objects to harmless <option> and <select> markup, whose original issue is fixed in the form field that actually rendered it.
• Sites running with the Twig 2 compatibility setting no longer crash with a server error on every page once an update clears the template cache #4235