Weave Code
Weaver
Helps Laravel developers discover, compare, and choose open-source packages. See popularity, security, maintainers, and scores at a glance to make better decisions.
Feedback
Share your thoughts, report bugs, or suggest improvements.
Subject
Message

Bundles Cms Laravel Package

kunstmaan/bundles-cms

Kunstmaan CMS is a full-featured, multilingual CMS built on the Symfony full-stack framework. It offers page and form assembly, versioning, workflow, translation tools, and media management, plus integrations with community bundles.

View on GitHub
Deep Wiki
Context7
7.3.2

This release mainly focuses on security hardenings for the media bundle, it is adviced to update to this version.

Thanks to @N0fl0w for reporting the security issue and for the verification of the patch!


Upgrade info:

  • The blacklisted_extensions option is now matched case-insensitively. Previously the check was case-sensitive while the stored extension was lowercased afterwards, so a file uploaded as webshell.pHp bypassed the blacklist and was written to disk as webshell.php. This closes an authenticated arbitrary file upload (RCE where public/ executes PHP).

  • The default blacklisted_extensions list is expanded from php/htaccess to the full set of commonly server-executable extensions (phtml, php5, phar, phps, shtml, cgi, pl, asp, jsp, ...). Files with these extensions are stored as .txt, as before. If you relied on uploading one of these types, override the option:

    kunstmaan_media:
        blacklisted_extensions:
            - php
            # ...
    
  • A new opt-in allowed_extensions option was added. When it is left empty (the default) only the blacklist applies and behaviour is unchanged. When set, it acts as a strict allow-list and any other extension is stored as .txt. The blacklist is still applied on top of it, so an executable extension can never be re-enabled through the allow-list.

    kunstmaan_media:
        allowed_extensions: ['jpg', 'jpeg', 'png', 'gif', 'webp', 'pdf', 'docx', 'zip']
    

    Note that svg and html are intentionally not blacklisted by default because a media library legitimately hosts them, but both are same-origin stored-XSS vectors. Add them to the blacklist, or use allowed_extensions, if your project does not need them.

  • As additional hardening it is strongly recommended to serve the public/uploads/media/ directory with script execution disabled and with an X-Content-Type-Options: nosniff response header.

7.3.1

Thanks to @t1nonymous for reporting the security issue and for the verification of the patch!


https://github.com/Kunstmaan/KunstmaanBundlesCMS/security/advisories/GHSA-j376-w3x3-q674

Public form file uploads (the FileUploadPagePart) are now restricted to an allow-list of file types, and the stored file extension is always derived from the uploaded file's content instead of the client-supplied file name. This closes an unauthenticated arbitrary file upload (stored XSS / potential RCE where public/ executes PHP).

The default allow-list contains common document and image types (pdf, doc(x), xls(x), ppt(x), odt/ods/odp, txt, csv, rtf, jpg/jpeg, png, gif, webp, avif, jxl, zip). Dangerous types such as php, html and svg are intentionally excluded. If your forms rely on other file types, extend the list via configuration:

kunstmaan_form:
    file_upload:
        allowed_extensions:
            - pdf
            - jpg
            # ...

As additional hardening it is still strongly recommended to serve the public/uploads/formsubmissions/ directory with script execution disabled and with a Content-Disposition: attachment + X-Content-Type-Options: nosniff response. Check your websites for invalid uploads and apply the above mentioned mitigations.

7.3.0
7.2.1
7.1.4
6.4.4
  • [DashboardBundle] Backport #3372 to 6.4
7.2.0
7.1.3
7.1.2
7.0.5

Last bugfix release of the 7.0 version

6.4.3

Last bugfix release of the 6.4 version

7.1.1
7.0.4
6.4.2
7.1.0

7.1.0-alpha2

7.1.0-alpha1

7.0.3
6.4.1
7.0.2
7.1.0-alpha2
7.0.1
7.1.0-alpha1
7.0.0
6.4.0
6.4.0-alpha2

Previous alpha tag was missing some 6.4 changes, this tag contains all correct changes

7.0.0-alpha1
6.4.0-alpha1
6.3.1
6.3.0
6.2.5
6.2.4
6.1.9

This is the last 6.1 bugfix release

6.2.3
Weaver

How can I help you explore Laravel packages today?

Conversation history is not saved when not logged in.
Prompt
Add packages to context
No packages found.
andydefer/laravel-notification
adachsoft/cli-process-tester
jhaskell13/laraflow
sebastienheyd/boilerplate-media-manager
ccast/tagixo-primix
pretendtrue/laravel-builder
sawmainek/laravel-scout-tntsearch-driver
tomshaw/laravel-calendar-table
dibakar/laravel-ownership
steadrun/laravel-monitor
labyrinthe/connect-laravel
elmogy/layan
drewdan/sentinel-client
dskripchenko/laravel-llm
fatryst/nuonuo
stevenay/myanfont
gmostafa/php-graphql-client
xeviant/paystack
snowsoft/faker
meditationsteps/blogetc