curator::views.details.disk key, so it is already translated in every shipped locale.Adds a new attach_curator_media.modal.selected_files key under resources/lang/en/views.php. Other locales fall back to English until translated — contributions welcome.
Thanks to @Elgorm for reporting and fixing this in #716.
curator::views.details.disk key, so it is already translated in every shipped locale.Adds a new attach_curator_media.modal.selected_files key under resources/lang/en/views.php. Other locales fall back to English until translated — contributions welcome.
Thanks to @Elgorm for reporting and fixing this in #716.
Fixes a broken access control vulnerability (CWE-862 / CWE-639, CVSS 7.6 High): the media picker modal's per-item Edit, Delete, and Download actions resolved their target Media record from client-supplied input without a per-record authorization check or tenant scoping. Any authenticated user able to reach a form containing a CuratorPicker field could edit, delete, or download arbitrary Media records by id — bypassing any MediaPolicy the host app defines and Curator's own multi-tenancy scoping. The Download action also streamed a client-supplied disk/path directly.
These actions now enforce the resource's authorization policy per-record and apply the same tenant scoping used elsewhere in the picker, and Download streams from the stored record instead of the request payload. No configuration changes are required after upgrading.
See the security advisory for full details: https://github.com/awcodes/filament-curator/security/advisories/GHSA-3m5g-3j68-ghvp
Fixes a broken access control vulnerability (CWE-862 / CWE-639, CVSS 7.6 High): the media picker modal's per-item Edit, Delete, and Download actions resolved their target Media record from client-supplied input without a per-record authorization check or tenant scoping. Any authenticated user able to reach a form containing a CuratorPicker field could edit, delete, or download arbitrary Media records by id — bypassing any MediaPolicy the host app defines and Curator's own multi-tenancy scoping. The Download action also streamed a client-supplied disk/path directly.
These actions now enforce the resource's authorization policy per-record and apply the same tenant scoping used elsewhere in the picker, and Download streams from the stored record instead of the request payload. No configuration changes are required after upgrading.
See the security advisory for full details: https://github.com/awcodes/filament-curator/security/advisories/GHSA-3m5g-3j68-ghvp
Fixes a broken access control vulnerability (CWE-862 / CWE-639, CVSS 7.6 High): the media picker modal's per-item Delete, Download, and Edit/Save actions resolved their target Media record from client-supplied input (action arguments / the selected item) and, while gated by a global ability check, applied no per-record authorization or tenant scoping. A user holding the delete/update/download ability could act on arbitrary Media records by id — including across tenants — and the Download action streamed a client-supplied disk/path.
These actions now perform a per-record policy check and apply the picker's tenant scoping before touching a record, and Download streams from the stored record instead of the request payload. No configuration changes are required after upgrading.
See the security advisory for full details: https://github.com/awcodes/filament-curator/security/advisories/GHSA-3m5g-3j68-ghvp
Fixes a stored XSS vulnerability (CWE-79, CVSS 5.4 Moderate): SVG files uploaded through the Curator panel were served inline without sanitization, allowing embedded JavaScript to execute in the application's origin when a user opened the file via the View action. SVG uploads are now sanitized (scripts, event handlers, and remote references stripped) before being written to storage.
After upgrading, run php artisan curator:sanitize-svgs to clean any SVGs uploaded before
this release (use --dry-run to preview first).
See the security advisory for full details: https://github.com/awcodes/filament-curator/security/advisories/GHSA-8vm9-f75m-5h2m
enshrined/svg-sanitize as a dependency.Fixes a stored XSS vulnerability (CWE-79, CVSS 5.4 Moderate): SVG files uploaded through the Curator panel were served inline without sanitization, allowing embedded JavaScript to execute in the application's origin when a user opened the file via the View action. SVG uploads are now sanitized (scripts, event handlers, and remote references stripped) before being written to storage.
After upgrading, run php artisan curator:sanitize-svgs to clean any SVGs uploaded before
this release (use --dry-run to preview first).
See the security advisory for full details: https://github.com/awcodes/filament-curator/security/advisories/GHSA-8vm9-f75m-5h2m
enshrined/svg-sanitize.Backports the fix for a stored XSS vulnerability (CWE-79, CVSS 5.4 Moderate): SVG files uploaded through the Curator panel were served inline without sanitization, allowing embedded JavaScript to execute in the application's origin when a user opened the file via the View action. SVG uploads are now sanitized (scripts, event handlers, and remote references stripped) before being written to storage.
After upgrading, run php artisan curator:sanitize-svgs to clean any SVGs uploaded before
this release (use --dry-run to preview first).
See the security advisory for full details: https://github.com/awcodes/filament-curator/security/advisories/GHSA-8vm9-f75m-5h2m
enshrined/svg-sanitize.Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.8...v3.7.9
Backports the fix for a cross-tenant media metadata disclosure in the Curator picker search (introduced in v3.2.4 with multitenancy support). In multitenant panels, an authenticated user could retrieve other tenants' media metadata by typing in the picker search box. Single-tenant installs are not affected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)Upgrade recommended for any multitenant deployment. Also fixed in 4.1.1 and 5.1.1. A GitHub Security Advisory and CVE will be linked here once published.
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.7...v3.7.8
Fixes a cross-tenant media metadata disclosure in the Curator picker search. In multitenant panels, an authenticated user could retrieve other tenants' media metadata by typing in the picker search box. Single-tenant installs are not affected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)Upgrade recommended for any multitenant deployment. Also fixed in 3.7.8 and 4.1.1. A GitHub Security Advisory and CVE will be linked here once published.
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.1.0...v5.1.1
Fixes a cross-tenant media metadata disclosure in the Curator picker search. In multitenant panels, an authenticated user could retrieve other tenants' media metadata by typing in the picker search box. Single-tenant installs are not affected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)Upgrade recommended for any multitenant deployment. Also fixed in 3.7.8 and 5.1.1. A GitHub Security Advisory and CVE will be linked here once published.
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.1.0...v4.1.1
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.8...v5.1.0
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.8...v4.1.0
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.7...v5.0.8
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.7...v4.0.8
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.6...v5.0.7
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.6...v4.0.7
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.5...v5.0.6
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.5...v4.0.6
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.4...v5.0.5
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.4...v4.0.5
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.3...v5.0.4
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.2...v5.0.3
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.3...v4.0.4
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.1...v5.0.2
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.2...v4.0.3
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.1...v4.0.2
Full Changelog: https://github.com/awcodes/filament-curator/compare/v5.0.0...v5.0.1
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0...v4.0.1
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0...v5.0.0
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.4.6...v4.0.0
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0-alpha.6...v4.0.0-alpha.7
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0-alpha.5...v4.0.0-alpha.6
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0-alpha.4...v4.0.0-alpha.5
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0-alpha.3...v4.0.0-alpha.4
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0-alpha.2...v4.0.0-alpha.3
Full Changelog: https://github.com/awcodes/filament-curator/compare/v4.0.0-alpha.1...v4.0.0-alpha.2
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.4.6...v4.0.0-alpha.1
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.6...v3.7.7
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.5...v3.7.6
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.4...v3.7.5
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.3...v3.7.4
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.2...v3.7.3
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.1...v3.7.2
Full Changelog: https://github.com/awcodes/filament-curator/compare/v3.7.0...v3.7.1
How can I help you explore Laravel packages today?