Skip to content

Liveblog 1.12.0

Choose a tag to compare

View all tags
@GaryJones GaryJones released this 27 Apr 17:16
· 114 commits to develop since this release
1.12.0
This tag was signed with the committer’s verified signature.
GaryJones Gary Jones
GPG key ID: 26945F7AF685BCCB
Verified
Learn about vigilant mode.
3913b1a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Breaking change (security fix): The pre-1.12.0 /liveblog/v1/authors/<term> and /liveblog/v1/hashtags/<term> REST routes, and the matching admin-ajax liveblog_authors and liveblog_terms actions, only checked a global capability. That allowed any user holding publish_posts to enumerate every editor on the site and every entry in the hashtags taxonomy, regardless of which post — if any — they were editing (CWE-863). Closing that gap requires scoping the permission check to a specific post, which forces the post id to appear in the URL or the query string. The new shapes are /liveblog/v1/<post_id>/authors/<term>, /liveblog/v1/<post_id>/hashtags/<term>, and admin-ajax.php?action=liveblog_authors&post_id=… (likewise for liveblog_terms). The bundled JavaScript client has been updated. Anything else calling these endpoints — bespoke integrations, custom blocks, headless clients — needs to be updated to include the target post id.

Security

  • fix: scope liveblog write authorisation to the target post by @GaryJones in #870 (CWE-285 BAC)
  • fix: harden preview CSRF, autocomplete post-scoping, attribute escaping, and author/contributor validation by @GaryJones in #873 (CWE-352, CWE-863, CWE-79, CWE-639)
  • fix: cap checks, ID sanitisation, and safer JSON-LD and AMP output by @GaryJones in #867 (CWE-285, CWE-20, CWE-79)

Documentation

  • docs: restructure documentation around audience by @GaryJones in #872

Maintenance

  • npm(deps): bump @lexical/react from 0.40.0 to 0.43.0 by @dependabot in #866
  • npm(deps): bump @lexical/rich-text from 0.39.0 to 0.43.0 by @dependabot in #865
  • npm(deps-dev): bump the dev-dependencies group with 2 updates by @dependabot in #864
  • Actions(deps): bump actions/setup-node from 6.3.0 to 6.4.0 in the actions group by @dependabot in #863

Full Changelog: 1.11.1...1.12.0

Contributors

GaryJones and dependabot
Assets 3
Loading