Releases

Security hardening.

• The JSON API's POST endpoints (save, rollback, copy to theme, copy theme, settings) now require a CSRF token, sent by the editor as a csrf form field and an X-CSRF-Token header. Requests without a valid token are rejected with HTTP 403.
• The editor page no longer shows the content of a non-.phtml file that lives inside a view/ directory. The extension is checked before the file is read, and FileEditor::readFile() now enforces it as well.
• Path validation in FileBrowser now rejects absolute paths before trimming slashes (previously /etc/passwd became etc/passwd and the check never fired), and resolves both sides of the under-root check with realpath() so symlinked roots such as macOS /private/var compare correctly.
• The Create disk backup before overwriting setting is now honoured: it sets the default state of the save dialog's checkbox instead of being stored and ignored.
• The per-user save rate limit is persisted in user settings, so it is enforced across requests and PHP-FPM workers rather than within a single process.
• Removed the stale activeTheme view variable and attribute left over from the old active-theme concept.
• Fixed the integration test suite: settings mocks now return the real defaults, and macOS temp paths are resolved before comparison.