diff --git a/administrator/components/com_banners/forms/banner.xml b/administrator/components/com_banners/forms/banner.xml index 9c3dc80f97d..82c1d6a67c6 100644 --- a/administrator/components/com_banners/forms/banner.xml +++ b/administrator/components/com_banners/forms/banner.xml @@ -301,6 +301,9 @@ diff --git a/administrator/components/com_config/forms/application.xml b/administrator/components/com_config/forms/application.xml index 0e1f2f654aa..f0cba88ffe0 100644 --- a/administrator/components/com_config/forms/application.xml +++ b/administrator/components/com_config/forms/application.xml @@ -1022,6 +1022,9 @@ diff --git a/administrator/components/com_contact/config.xml b/administrator/components/com_contact/config.xml index ced0f5f8af9..58171c31bfe 100644 --- a/administrator/components/com_contact/config.xml +++ b/administrator/components/com_contact/config.xml @@ -253,6 +253,9 @@ diff --git a/administrator/components/com_content/forms/article.xml b/administrator/components/com_content/forms/article.xml index b53a81ee436..3d84a99caf1 100644 --- a/administrator/components/com_content/forms/article.xml +++ b/administrator/components/com_content/forms/article.xml @@ -723,6 +723,9 @@ name="image_intro" type="media" label="COM_CONTENT_FIELD_INTRO_LABEL" + schemes="http,https,ftp,ftps,data,file" + validate="url" + relative="true" /> diff --git a/administrator/components/com_languages/tmpl/installed/default.php b/administrator/components/com_languages/tmpl/installed/default.php index fb4156b39a3..7689e221268 100644 --- a/administrator/components/com_languages/tmpl/installed/default.php +++ b/administrator/components/com_languages/tmpl/installed/default.php @@ -120,7 +120,7 @@ $listDirn = $this->escape($this->state->get('list.direction')); escape($row->author); ?> - escape($row->authorEmail)); ?> + escape(PunycodeHelper::emailToUTF8($row->authorEmail)); ?> escape($row->extension_id); ?> diff --git a/administrator/components/com_menus/forms/item_alias.xml b/administrator/components/com_menus/forms/item_alias.xml index cdb89b2be20..6ef0572ada7 100644 --- a/administrator/components/com_menus/forms/item_alias.xml +++ b/administrator/components/com_menus/forms/item_alias.xml @@ -58,6 +58,9 @@ diff --git a/administrator/components/com_menus/forms/item_component.xml b/administrator/components/com_menus/forms/item_component.xml index 08422b73cb1..0ce210be7e4 100644 --- a/administrator/components/com_menus/forms/item_component.xml +++ b/administrator/components/com_menus/forms/item_component.xml @@ -27,6 +27,9 @@ diff --git a/administrator/components/com_menus/forms/item_heading.xml b/administrator/components/com_menus/forms/item_heading.xml index b4ce4ce2bf9..38b5b1ef879 100644 --- a/administrator/components/com_menus/forms/item_heading.xml +++ b/administrator/components/com_menus/forms/item_heading.xml @@ -28,6 +28,9 @@ diff --git a/administrator/components/com_menus/forms/item_separator.xml b/administrator/components/com_menus/forms/item_separator.xml index 20f05444452..63371c68452 100644 --- a/administrator/components/com_menus/forms/item_separator.xml +++ b/administrator/components/com_menus/forms/item_separator.xml @@ -23,6 +23,9 @@ diff --git a/administrator/components/com_menus/forms/item_url.xml b/administrator/components/com_menus/forms/item_url.xml index 21850df4abb..7b58b121adf 100644 --- a/administrator/components/com_menus/forms/item_url.xml +++ b/administrator/components/com_menus/forms/item_url.xml @@ -54,6 +54,9 @@ diff --git a/administrator/components/com_menus/forms/itemadmin_alias.xml b/administrator/components/com_menus/forms/itemadmin_alias.xml index 2e4077f9020..714233ecc69 100644 --- a/administrator/components/com_menus/forms/itemadmin_alias.xml +++ b/administrator/components/com_menus/forms/itemadmin_alias.xml @@ -38,6 +38,9 @@ diff --git a/administrator/components/com_menus/forms/itemadmin_component.xml b/administrator/components/com_menus/forms/itemadmin_component.xml index 8724d640111..c5196cfc77c 100644 --- a/administrator/components/com_menus/forms/itemadmin_component.xml +++ b/administrator/components/com_menus/forms/itemadmin_component.xml @@ -22,6 +22,9 @@ diff --git a/administrator/components/com_menus/forms/itemadmin_container.xml b/administrator/components/com_menus/forms/itemadmin_container.xml index d6c07c0cdd9..bbf75ff074e 100644 --- a/administrator/components/com_menus/forms/itemadmin_container.xml +++ b/administrator/components/com_menus/forms/itemadmin_container.xml @@ -35,6 +35,9 @@ diff --git a/administrator/components/com_menus/forms/itemadmin_heading.xml b/administrator/components/com_menus/forms/itemadmin_heading.xml index 8aba60deaae..25181bcbb17 100644 --- a/administrator/components/com_menus/forms/itemadmin_heading.xml +++ b/administrator/components/com_menus/forms/itemadmin_heading.xml @@ -35,6 +35,9 @@ diff --git a/administrator/components/com_menus/forms/itemadmin_url.xml b/administrator/components/com_menus/forms/itemadmin_url.xml index 3f2b932dc55..355cee6896b 100644 --- a/administrator/components/com_menus/forms/itemadmin_url.xml +++ b/administrator/components/com_menus/forms/itemadmin_url.xml @@ -52,6 +52,9 @@ diff --git a/administrator/components/com_newsfeeds/forms/newsfeed.xml b/administrator/components/com_newsfeeds/forms/newsfeed.xml index a9f647b9bc0..b380d4226c0 100644 --- a/administrator/components/com_newsfeeds/forms/newsfeed.xml +++ b/administrator/components/com_newsfeeds/forms/newsfeed.xml @@ -242,6 +242,9 @@ @@ -285,6 +288,9 @@ diff --git a/administrator/components/com_privacy/tmpl/requests/default.php b/administrator/components/com_privacy/tmpl/requests/default.php index 382887ec3b7..f192de4a4d1 100644 --- a/administrator/components/com_privacy/tmpl/requests/default.php +++ b/administrator/components/com_privacy/tmpl/requests/default.php @@ -98,7 +98,7 @@ $urgentRequestDate->sub(new DateInterval('P' . $this->urgentRequestAge . 'D')); - escape($item->email)); ?> + escape(PunycodeHelper::emailToUTF8($item->email)); ?> diff --git a/administrator/components/com_tags/config.xml b/administrator/components/com_tags/config.xml index 46d675c58f2..516a73a1a24 100644 --- a/administrator/components/com_tags/config.xml +++ b/administrator/components/com_tags/config.xml @@ -73,6 +73,9 @@ diff --git a/administrator/components/com_tags/forms/tag.xml b/administrator/components/com_tags/forms/tag.xml index fd016058b53..f0bcafe3f73 100644 --- a/administrator/components/com_tags/forms/tag.xml +++ b/administrator/components/com_tags/forms/tag.xml @@ -248,6 +248,9 @@ @@ -280,6 +283,9 @@ diff --git a/administrator/components/com_users/src/Controller/MethodController.php b/administrator/components/com_users/src/Controller/MethodController.php index d8a852ddf27..a8a2089fc41 100644 --- a/administrator/components/com_users/src/Controller/MethodController.php +++ b/administrator/components/com_users/src/Controller/MethodController.php @@ -21,6 +21,7 @@ use Joomla\CMS\Uri\Uri; use Joomla\CMS\User\User; use Joomla\CMS\User\UserFactoryAwareInterface; use Joomla\CMS\User\UserFactoryAwareTrait; +use Joomla\CMS\User\UserHelper; use Joomla\Component\Users\Administrator\Helper\Mfa as MfaHelper; use Joomla\Component\Users\Administrator\Model\BackupcodesModel; use Joomla\Component\Users\Administrator\Model\MethodModel; @@ -387,6 +388,9 @@ class MethodController extends BaseControllerAlias implements UserFactoryAwareIn return; } + // Method updated, destroy other active sessions + UserHelper::destroyUserSessions($userId, true); + $this->setRedirect($url); } diff --git a/administrator/components/com_users/tmpl/users/default.php b/administrator/components/com_users/tmpl/users/default.php index 20794214054..a1f0bfec89a 100644 --- a/administrator/components/com_users/tmpl/users/default.php +++ b/administrator/components/com_users/tmpl/users/default.php @@ -187,7 +187,7 @@ $mfa = PluginHelper::isEnabled('multifactorauth'); - escape($item->email)); ?> + escape(PunycodeHelper::emailToUTF8($item->email)); ?> lastvisitDate !== null) : ?> diff --git a/administrator/language/en-GB/install.xml b/administrator/language/en-GB/install.xml index db8e69ed617..743338a7cd8 100644 --- a/administrator/language/en-GB/install.xml +++ b/administrator/language/en-GB/install.xml @@ -3,7 +3,7 @@ English (en-GB) en-GB 4.4.3 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/administrator/language/en-GB/langmetadata.xml b/administrator/language/en-GB/langmetadata.xml index cfa47311bb7..6c16913844a 100644 --- a/administrator/language/en-GB/langmetadata.xml +++ b/administrator/language/en-GB/langmetadata.xml @@ -2,7 +2,7 @@ English (en-GB) 4.4.3 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/administrator/language/en-GB/lib_joomla.ini b/administrator/language/en-GB/lib_joomla.ini index 70c1ba14a93..8d0a88ba6c5 100644 --- a/administrator/language/en-GB/lib_joomla.ini +++ b/administrator/language/en-GB/lib_joomla.ini @@ -345,6 +345,7 @@ JLIB_FORM_VALIDATE_FIELD_INVALID="Invalid field: %s" JLIB_FORM_VALIDATE_FIELD_REQUIRED="Field required: %s" JLIB_FORM_VALIDATE_FIELD_RULE_MISSING="Validation Rule missing: %s" JLIB_FORM_VALIDATE_FIELD_URL_SCHEMA_MISSING="Invalid URL: URL schema is missing in %1$s. Please add one of the following at the beginning: %2$s." +JLIB_FORM_VALIDATE_FIELD_URL_INJECTION_DETECTED="Invalid URL: A code injection has been detected in %1$s." JLIB_FORM_VALUE_CACHE_APCU="APC User Cache" JLIB_FORM_VALUE_CACHE_FILE="File" JLIB_FORM_VALUE_CACHE_MEMCACHED="Memcached (Experimental)" diff --git a/administrator/manifests/files/joomla.xml b/administrator/manifests/files/joomla.xml index d8e5ae3e3c9..cf71819d9bb 100644 --- a/administrator/manifests/files/joomla.xml +++ b/administrator/manifests/files/joomla.xml @@ -6,8 +6,8 @@ www.joomla.org (C) 2019 Open Source Matters, Inc. GNU General Public License version 2 or later; see LICENSE.txt - 4.4.3-dev - 2024-01 + 4.4.3 + 2024-02 FILES_JOOMLA_XML_DESCRIPTION administrator/components/com_admin/script.php diff --git a/administrator/manifests/packages/pkg_en-GB.xml b/administrator/manifests/packages/pkg_en-GB.xml index 047a7848b77..f820c1f2cc4 100644 --- a/administrator/manifests/packages/pkg_en-GB.xml +++ b/administrator/manifests/packages/pkg_en-GB.xml @@ -3,7 +3,7 @@ English (en-GB) Language Pack en-GB 4.4.3.1 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/administrator/templates/atum/templateDetails.xml b/administrator/templates/atum/templateDetails.xml index 2ebe5801bed..032dca7868b 100644 --- a/administrator/templates/atum/templateDetails.xml +++ b/administrator/templates/atum/templateDetails.xml @@ -111,6 +111,9 @@ English (en-GB) en-GB 4.4.3 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/api/language/en-GB/langmetadata.xml b/api/language/en-GB/langmetadata.xml index 71fe10e4dc0..ab8d006d1c6 100644 --- a/api/language/en-GB/langmetadata.xml +++ b/api/language/en-GB/langmetadata.xml @@ -2,7 +2,7 @@ English (en-GB) 4.4.3 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/components/com_contact/forms/form.xml b/components/com_contact/forms/form.xml index bd5429db8ce..8e7da7e3291 100644 --- a/components/com_contact/forms/form.xml +++ b/components/com_contact/forms/form.xml @@ -111,6 +111,9 @@ diff --git a/components/com_contact/tmpl/contact/default_address.php b/components/com_contact/tmpl/contact/default_address.php index 8133fb9b0cc..0e8a0b6a381 100644 --- a/components/com_contact/tmpl/contact/default_address.php +++ b/components/com_contact/tmpl/contact/default_address.php @@ -152,7 +152,7 @@ $icon = $this->params->get('contact_icons') == 0;
+ escape(PunycodeHelper::urlToUTF8($this->item->webpage)); ?>
diff --git a/components/com_contact/tmpl/contact/default_profile.php b/components/com_contact/tmpl/contact/default_profile.php index b4e0134a04f..098006cda45 100644 --- a/components/com_contact/tmpl/contact/default_profile.php +++ b/components/com_contact/tmpl/contact/default_profile.php @@ -30,9 +30,9 @@ use Joomla\CMS\String\PunycodeHelper; $v_http = substr($profile->value, 0, 4); if ($v_http === 'http') : - echo '
' . PunycodeHelper::urlToUTF8($profile->text) . '
'; + echo '
' . $this->escape(PunycodeHelper::urlToUTF8($profile->text)) . '
'; else : - echo '
' . PunycodeHelper::urlToUTF8($profile->text) . '
'; + echo '
' . $this->escape(PunycodeHelper::urlToUTF8($profile->text)) . '
'; endif; break; diff --git a/components/com_content/forms/article.xml b/components/com_content/forms/article.xml index e02d23f1dc1..508a419ec56 100644 --- a/components/com_content/forms/article.xml +++ b/components/com_content/forms/article.xml @@ -217,6 +217,9 @@ @@ -254,6 +257,9 @@ diff --git a/components/com_newsfeeds/tmpl/category/default_items.php b/components/com_newsfeeds/tmpl/category/default_items.php index db4cb4b60c2..91c3627eaf7 100644 --- a/components/com_newsfeeds/tmpl/category/default_items.php +++ b/components/com_newsfeeds/tmpl/category/default_items.php @@ -71,7 +71,7 @@ $listDirn = $this->escape($this->state->get('list.direction')); link); ?> - + escape($link); ?>
diff --git a/components/com_tags/tmpl/tag/default.xml b/components/com_tags/tmpl/tag/default.xml index 78ded32a244..3e542ba6f45 100644 --- a/components/com_tags/tmpl/tag/default.xml +++ b/components/com_tags/tmpl/tag/default.xml @@ -88,6 +88,9 @@ diff --git a/components/com_tags/tmpl/tag/list.xml b/components/com_tags/tmpl/tag/list.xml index 3c1a5af8f4a..b691efa4c9e 100644 --- a/components/com_tags/tmpl/tag/list.xml +++ b/components/com_tags/tmpl/tag/list.xml @@ -87,6 +87,9 @@ diff --git a/components/com_tags/tmpl/tags/default.xml b/components/com_tags/tmpl/tags/default.xml index d23fb69a3c5..8de92b78558 100644 --- a/components/com_tags/tmpl/tags/default.xml +++ b/components/com_tags/tmpl/tags/default.xml @@ -71,6 +71,9 @@ diff --git a/components/com_users/tmpl/login/default.xml b/components/com_users/tmpl/login/default.xml index ff0697f7479..0abcef5ed20 100644 --- a/components/com_users/tmpl/login/default.xml +++ b/components/com_users/tmpl/login/default.xml @@ -78,6 +78,9 @@ @@ -158,6 +161,9 @@ diff --git a/composer.json b/composer.json index fb60a3238bf..eb45763f27f 100644 --- a/composer.json +++ b/composer.json @@ -30,6 +30,14 @@ "type": "vcs", "url": "https://github.com/joomla-backports/json-api-php.git", "no-api": true + }, + { + "type": "vcs", + "url": "https://github.com/joomla-framework/security-filter.git" + }, + { + "type": "vcs", + "url": "https://github.com/joomla-framework/security-input.git" } ], "autoload": { @@ -53,7 +61,7 @@ "joomla/database": "^2.1.1", "joomla/di": "^2.0.1", "joomla/event": "^2.0.2", - "joomla/filter": "^2.0.3", + "joomla/filter": "dev-2.x-mbstring-issue566 as 2.0.4", "joomla/filesystem": "^2.0.2", "joomla/http": "^2.0.2", "joomla/input": "^2.0.4", diff --git a/composer.lock b/composer.lock index c89eae51bf7..ec1a58213e0 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "186d1c75ba657af1ae5b59e4bfdafe01", + "content-hash": "00e01144155a50c968a51bf9692b2b0c", "packages": [ { "name": "algo26-matthias/idna-convert", @@ -1702,16 +1702,16 @@ }, { "name": "joomla/filter", - "version": "2.0.3", + "version": "dev-2.x-mbstring-issue566", "source": { "type": "git", - "url": "https://github.com/joomla-framework/filter.git", - "reference": "9102630f9069351c1259b6f585a704fde7029d2a" + "url": "git@github.com:joomla-framework/security-filter.git", + "reference": "72881a29e90beed6d043af228b64df6850bbfeff" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/joomla-framework/filter/zipball/9102630f9069351c1259b6f585a704fde7029d2a", - "reference": "9102630f9069351c1259b6f585a704fde7029d2a", + "url": "https://api.github.com/repos/joomla-framework/security-filter/zipball/72881a29e90beed6d043af228b64df6850bbfeff", + "reference": "72881a29e90beed6d043af228b64df6850bbfeff", "shasum": "" }, "require": { @@ -1729,6 +1729,7 @@ "suggest": { "joomla/language": "Required only if you want to use `OutputFilter::stringURLSafe`." }, + "default-branch": true, "type": "joomla-package", "extra": { "branch-alias": { @@ -1740,7 +1741,11 @@ "Joomla\\Filter\\": "src/" } }, - "notification-url": "https://packagist.org/downloads/", + "autoload-dev": { + "psr-4": { + "Joomla\\Filter\\Tests\\": "Tests/" + } + }, "license": [ "GPL-2.0-or-later" ], @@ -1752,20 +1757,20 @@ "joomla" ], "support": { - "issues": "https://github.com/joomla-framework/filter/issues", - "source": "https://github.com/joomla-framework/filter/tree/2.0.3" + "source": "https://github.com/joomla-framework/security-filter/tree/2.x-mbstring-issue566", + "issues": "https://github.com/joomla-framework/security-filter/issues" }, "funding": [ { - "url": "https://community.joomla.org/sponsorship-campaigns.html", - "type": "custom" + "type": "github", + "url": "https://github.com/joomla" }, { - "url": "https://github.com/joomla", - "type": "github" + "type": "custom", + "url": "https://community.joomla.org/sponsorship-campaigns.html" } ], - "time": "2023-08-26T07:57:54+00:00" + "time": "2024-02-10T14:19:54+00:00" }, { "name": "joomla/http", @@ -9898,6 +9903,12 @@ } ], "aliases": [ + { + "package": "joomla/filter", + "version": "dev-2.x-mbstring-issue566", + "alias": "2.0.4", + "alias_normalized": "2.0.4.0" + }, { "package": "voku/portable-utf8", "version": "6.0.12.0", @@ -9907,6 +9918,7 @@ ], "minimum-stability": "stable", "stability-flags": { + "joomla/filter": 20, "tobscure/json-api": 20 }, "prefer-stable": false, @@ -9921,5 +9933,5 @@ "platform-overrides": { "php": "7.2.5" }, - "plugin-api-version": "2.3.0" + "plugin-api-version": "2.2.0" } diff --git a/includes/framework.php b/includes/framework.php index 69130d7cfe3..235c5d5c996 100644 --- a/includes/framework.php +++ b/includes/framework.php @@ -9,6 +9,7 @@ defined('_JEXEC') or die; +use Joomla\CMS\Uri\Uri; use Joomla\CMS\Version; use Joomla\Utilities\IpHelper; @@ -22,7 +23,7 @@ if ( || (file_exists(JPATH_INSTALLATION . '/index.php') && (false === (new Version())->isInDevelopmentState())) ) { if (file_exists(JPATH_INSTALLATION . '/index.php')) { - header('Location: ' . substr($_SERVER['REQUEST_URI'], 0, strpos($_SERVER['REQUEST_URI'], 'index.php')) . 'installation/index.php'); + header('Location: ' . Uri::base() . 'installation/index.php'); exit; } else { diff --git a/installation/language/en-GB/langmetadata.xml b/installation/language/en-GB/langmetadata.xml index d12b69093a1..4e18486e84f 100644 --- a/installation/language/en-GB/langmetadata.xml +++ b/installation/language/en-GB/langmetadata.xml @@ -2,7 +2,7 @@ English (United Kingdom) 4.4.3 - 2024-01 + 2024-02 Joomla! Project (C) 2005 Open Source Matters, Inc. GNU General Public License version 2 or later; see LICENSE.txt diff --git a/language/en-GB/install.xml b/language/en-GB/install.xml index 18a8e7c1631..1a7d134ebd0 100644 --- a/language/en-GB/install.xml +++ b/language/en-GB/install.xml @@ -3,7 +3,7 @@ English (en-GB) en-GB 4.4.3 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/language/en-GB/langmetadata.xml b/language/en-GB/langmetadata.xml index 3f6e4ac4c55..0334eae720d 100644 --- a/language/en-GB/langmetadata.xml +++ b/language/en-GB/langmetadata.xml @@ -2,7 +2,7 @@ English (en-GB) 4.4.3 - 2024-01 + 2024-02 Joomla! Project admin@joomla.org www.joomla.org diff --git a/language/en-GB/lib_joomla.ini b/language/en-GB/lib_joomla.ini index 698eac0317a..1878809d3b8 100644 --- a/language/en-GB/lib_joomla.ini +++ b/language/en-GB/lib_joomla.ini @@ -344,6 +344,7 @@ JLIB_FORM_VALIDATE_FIELD_INVALID="Invalid field: %s" JLIB_FORM_VALIDATE_FIELD_REQUIRED="Field required: %s" JLIB_FORM_VALIDATE_FIELD_RULE_MISSING="Validation Rule missing: %s" JLIB_FORM_VALIDATE_FIELD_URL_SCHEMA_MISSING="Invalid URL: URL schema is missing in %1$s. Please add one of the following at the beginning: %2$s." +JLIB_FORM_VALIDATE_FIELD_URL_INJECTION_DETECTED="Invalid URL: A code injection has been detected in %1$s." JLIB_FORM_VALUE_CACHE_APCU="APC User Cache" JLIB_FORM_VALUE_CACHE_FILE="File" JLIB_FORM_VALUE_CACHE_MEMCACHED="Memcached (Experimental)" diff --git a/libraries/src/Form/Rule/UrlRule.php b/libraries/src/Form/Rule/UrlRule.php index 447d603afc6..0325b756222 100644 --- a/libraries/src/Form/Rule/UrlRule.php +++ b/libraries/src/Form/Rule/UrlRule.php @@ -9,6 +9,7 @@ namespace Joomla\CMS\Form\Rule; +use Joomla\CMS\Filter\InputFilter; use Joomla\CMS\Form\Form; use Joomla\CMS\Form\FormRule; use Joomla\CMS\Language\Text; @@ -53,6 +54,12 @@ class UrlRule extends FormRule return true; } + // Check the value for XSS payloads + if ((string) $element['disableXssCheck'] !== 'true' && InputFilter::checkAttribute(['href', $value])) { + $element->addAttribute('message', Text::sprintf('JLIB_FORM_VALIDATE_FIELD_URL_INJECTION_DETECTED', $element['name'])); + return false; + } + $urlParts = UriHelper::parse_url($value); // See https://www.w3.org/Addressing/URL/url-spec.txt diff --git a/libraries/src/Version.php b/libraries/src/Version.php index e58ae54fe6a..8dce50bf01d 100644 --- a/libraries/src/Version.php +++ b/libraries/src/Version.php @@ -66,7 +66,7 @@ final class Version * @var string * @since 3.8.0 */ - public const EXTRA_VERSION = 'dev'; + public const EXTRA_VERSION = ''; /** * Development status. @@ -74,7 +74,7 @@ final class Version * @var string * @since 3.5 */ - public const DEV_STATUS = 'Development'; + public const DEV_STATUS = 'Stable'; /** * Code name. @@ -90,7 +90,7 @@ final class Version * @var string * @since 3.5 */ - public const RELDATE = '9-January-2024'; + public const RELDATE = '20-February-2024'; /** * Release time. @@ -98,7 +98,7 @@ final class Version * @var string * @since 3.5 */ - public const RELTIME = '16:01'; + public const RELTIME = '16:00'; /** * Release timezone. diff --git a/modules/mod_custom/mod_custom.xml b/modules/mod_custom/mod_custom.xml index 8dc3ad2d2d1..036619b1849 100644 --- a/modules/mod_custom/mod_custom.xml +++ b/modules/mod_custom/mod_custom.xml @@ -40,6 +40,9 @@ diff --git a/plugins/user/profile/src/Extension/Profile.php b/plugins/user/profile/src/Extension/Profile.php index 4bc410e5a06..a7f6a15d5a3 100644 --- a/plugins/user/profile/src/Extension/Profile.php +++ b/plugins/user/profile/src/Extension/Profile.php @@ -138,7 +138,7 @@ final class Profile extends CMSPlugin return HTMLHelper::_('users.value', $value); } else { // Convert website URL to utf8 for display - $value = PunycodeHelper::urlToUTF8(htmlspecialchars($value)); + $value = htmlspecialchars(PunycodeHelper::urlToUTF8($value), ENT_QUOTES, 'UTF-8'); if (strpos($value, 'http') === 0) { return '' . $value . ''; diff --git a/templates/cassiopeia/templateDetails.xml b/templates/cassiopeia/templateDetails.xml index d8628d3324a..c28503f1fb0 100644 --- a/templates/cassiopeia/templateDetails.xml +++ b/templates/cassiopeia/templateDetails.xml @@ -63,6 +63,9 @@