diff --git a/.github/workflows/assets_code_analysis.yaml b/.github/workflows/assets_code_analysis.yaml index 4540ae9e5..e180a496c 100644 --- a/.github/workflows/assets_code_analysis.yaml +++ b/.github/workflows/assets_code_analysis.yaml @@ -21,6 +21,12 @@ jobs: - name: Lint on SCSS files run: npm run stylelint + - name: UI Unit Tests + run: npm run test:coverage + + - name: Type Check + run: npm run typecheck + - name: Build for production run: npm run build diff --git a/.stylelintrc b/.stylelintrc index f3d909b63..72e095d1a 100644 --- a/.stylelintrc +++ b/.stylelintrc @@ -3,9 +3,39 @@ "stylelint-config-standard", "stylelint-config-recommended-scss" ], - "syntax": "scss", + "customSyntax": "postcss-scss", + "ignoreFiles": [ + "assets/scss/vendor/**/*.scss" + ], "plugins": ["stylelint-scss"], "rules": { - "no-descending-specificity": null + "alpha-value-notation": null, + "color-function-alias-notation": null, + "color-function-notation": null, + "custom-property-pattern": null, + "declaration-block-no-redundant-longhand-properties": null, + "font-family-name-quotes": null, + "function-url-quotes": null, + "import-notation": null, + "keyframes-name-pattern": null, + "no-descending-specificity": null, + "no-invalid-position-at-import-rule": null, + "number-max-precision": null, + "property-no-deprecated": null, + "property-no-vendor-prefix": null, + "scss/at-extend-no-missing-placeholder": null, + "scss/comment-no-empty": null, + "scss/load-no-partial-leading-underscore": null, + "scss/load-partial-extension": null, + "scss/no-global-function-names": null, + "scss/operator-no-unspaced": null, + "selector-attribute-quotes": null, + "selector-class-pattern": null, + "selector-id-pattern": null, + "selector-not-notation": null, + "shorthand-property-no-redundant-values": null, + "unit-no-unknown": null, + "value-keyword-case": null, + "value-no-vendor-prefix": null } } diff --git a/CHANGELOG.md b/CHANGELOG.md index a004d750e..731a48bf0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,20 @@ Released: Not yet released - The default query limit can now be configured. Thanks @Vondry! (https://github.com/bolt/core/pull/3727) + +## 6.1.4 + +Released: 2026-07-04 + +This release includes several security-related fixes. Our thanks to @Vondry and @0xmgaye for identifying these issues and disclosing them to us responsibly! πŸ‘πŸ™ + +### πŸ” Security related changes + +- Fix SQL injection in ListFormatHelper (@Vondry) +- Prevent SSRF in upload-from-URL and embed endpoint (@Vondry) +- Filter unpublished/viewless content from the public Relation API (@Vondry) +- Block open redirect on login endpoint (@0xmgaye, fix by @bobvandevijver) + ## 6.1.3 Released: 2026-05-16 diff --git a/assets/js/app/common.js b/assets/js/app/common.js index 8523ef607..fdb7110fb 100644 --- a/assets/js/app/common.js +++ b/assets/js/app/common.js @@ -144,7 +144,10 @@ $(document).ready(function () { /* ** Copy text to clipboard. Used in filemanager actions. */ - new ClipboardJS('*[data-clipboard-text]'); + const clipboard = new ClipboardJS('*[data-clipboard-text]'); + clipboard.on('success', function (event) { + event.clearSelection(); + }); /* End of copy text to clipboard */ /* diff --git a/assets/js/app/editor/Components/Checkbox.vue b/assets/js/app/editor/Components/Checkbox.vue index d507424c8..1f82e07f5 100644 --- a/assets/js/app/editor/Components/Checkbox.vue +++ b/assets/js/app/editor/Components/Checkbox.vue @@ -8,9 +8,9 @@ :checked="value" type="checkbox" :readonly="readonly" - @change="liveValue = $event.target.checked" + @change="liveValue = ($event.target as HTMLInputElement).checked" /> - + @@ -19,36 +19,18 @@ - diff --git a/assets/js/app/editor/Components/Collection.vue b/assets/js/app/editor/Components/Collection.vue index 2e19a10d3..17cc7af3a 100644 --- a/assets/js/app/editor/Components/Collection.vue +++ b/assets/js/app/editor/Components/Collection.vue @@ -1,7 +1,7 @@ - diff --git a/assets/js/app/editor/Components/Date.vue b/assets/js/app/editor/Components/Date.vue index 5a9e184d2..3c3bf41fd 100644 --- a/assets/js/app/editor/Components/Date.vue +++ b/assets/js/app/editor/Components/Date.vue @@ -1,5 +1,5 @@ - diff --git a/assets/js/app/editor/Components/Email.vue b/assets/js/app/editor/Components/Email.vue index 6a9f88791..f23b26d9e 100644 --- a/assets/js/app/editor/Components/Email.vue +++ b/assets/js/app/editor/Components/Email.vue @@ -10,40 +10,23 @@ type="email" :required="required" :readonly="readonly" - :data-errormessage="errormessage" - :pattern="pattern" - :placeholder="placeholder" + :data-errormessage="typeof errormessage === 'string' ? errormessage : undefined" + :pattern="typeof pattern === 'string' ? pattern : undefined" + :placeholder="typeof placeholder === 'string' ? placeholder : undefined" /> - diff --git a/assets/js/app/editor/Components/Embed.vue b/assets/js/app/editor/Components/Embed.vue index eb9bd8d44..8ad01e84f 100644 --- a/assets/js/app/editor/Components/Embed.vue +++ b/assets/js/app/editor/Components/Embed.vue @@ -8,6 +8,7 @@
- + {{ labels.label_matched_embed }}
- + {{ labels.label_preview }}
+ {{ labels.label_preview }}
@@ -108,102 +114,95 @@ - diff --git a/assets/js/app/editor/Components/File.vue b/assets/js/app/editor/Components/File.vue index e6435a301..33d491188 100644 --- a/assets/js/app/editor/Components/File.vue +++ b/assets/js/app/editor/Components/File.vue @@ -10,6 +10,7 @@
@@ -132,129 +135,155 @@ - diff --git a/assets/js/app/editor/Components/Filelist.vue b/assets/js/app/editor/Components/Filelist.vue index 6411abbe7..8f012a602 100644 --- a/assets/js/app/editor/Components/Filelist.vue +++ b/assets/js/app/editor/Components/Filelist.vue @@ -10,10 +10,10 @@ :directory="directory" :filelist="filelist" :csrf-token="csrfToken" - :labels="labels" + :labels="labelsValue" :in-filelist="true" :name="fieldName(index)" - :extensions="extensions" + :extensions="extensionsValue" :is-first-in-filelist="isFirstInFilelist(index)" :is-last-in-filelist="isLastInFilelist(index)" :readonly="readonly" @@ -28,105 +28,136 @@ - diff --git a/assets/js/app/editor/Components/Html.vue b/assets/js/app/editor/Components/Html.vue index cac33f8ca..0ff92cccd 100644 --- a/assets/js/app/editor/Components/Html.vue +++ b/assets/js/app/editor/Components/Html.vue @@ -1,46 +1,38 @@ - diff --git a/assets/js/app/editor/Components/Image.vue b/assets/js/app/editor/Components/Image.vue index 5bd15cee0..5f9a22ff6 100644 --- a/assets/js/app/editor/Components/Image.vue +++ b/assets/js/app/editor/Components/Image.vue @@ -9,7 +9,7 @@
- +
- +
- {{ labels.button_remove }} + + {{ labels.button_remove }}
@@ -185,137 +189,173 @@ tabindex="-1" type="file" :accept="acceptedExtensions" - @change="uploadFile($event.target.files[0])" + @change="uploadSelectedFile" />
- diff --git a/assets/js/app/editor/Components/Imagelist.vue b/assets/js/app/editor/Components/Imagelist.vue index 8e7e57875..9e344a7a3 100644 --- a/assets/js/app/editor/Components/Imagelist.vue +++ b/assets/js/app/editor/Components/Imagelist.vue @@ -1,8 +1,7 @@ - diff --git a/assets/js/app/editor/Components/Language.vue b/assets/js/app/editor/Components/Language.vue index 9b0f136d8..2f2f91005 100644 --- a/assets/js/app/editor/Components/Language.vue +++ b/assets/js/app/editor/Components/Language.vue @@ -1,69 +1,77 @@