From 5842805e3bd768957cb9ae9a2b44ffa3e0e9a52e Mon Sep 17 00:00:00 2001 From: ildyria Date: Mon, 13 Jul 2026 22:35:53 +0200 Subject: [PATCH 1/4] Version 7.7.1: hotfix on webshop --- src/content/docs/docs/getting-started/releases.md | 15 +++++++++++++++ src/data/releases.ts | 1 + 2 files changed, 16 insertions(+) diff --git a/src/content/docs/docs/getting-started/releases.md b/src/content/docs/docs/getting-started/releases.md index 478500b0..df4c8aa5 100644 --- a/src/content/docs/docs/getting-started/releases.md +++ b/src/content/docs/docs/getting-started/releases.md @@ -13,6 +13,21 @@ sidebar: ## Version 7 +### v7.7.1 + +Released on July 13th, 2026 + +#### Hotfixes + +Just when you publish a new release, there is another vulnerability reported... +Which means we need to ship a fix ASAP. + +* `fix` #4514 : Hotfix on webshop by @ildyria. + > A user can craft a post request and get discounted prices on the webshop. This is now fixed. +* `fix` #4516 : Fix Sqlite bug on virtual columns by @ildyria. + > When using sqlite, the virtual columns were not properly handled. This is now fixed. + + ### v7.7.0 Released on July 13th, 2026 diff --git a/src/data/releases.ts b/src/data/releases.ts index fbe9f79a..445f3238 100644 --- a/src/data/releases.ts +++ b/src/data/releases.ts @@ -8,6 +8,7 @@ export interface Release { // Release data extracted from releases.md export const releases: Release[] = [ + { version: 'v7.7.1', date: 'Jul 13, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a mojor vulnerability in the webshop', 'minor sqlite fix'] }, { version: 'v7.7.0', date: 'Jul 13, 2026', title: 'Album thumbs, and RSS feed customization', type: 'feature', highlights: ['Add cover to tag albums', 'Add option to disable the second line on album thumbs', 'Allow customizing RSS feed title & description', 'Fixes access rights with multiple groups', 'Fixes webshop bypass vulnerability (8.3)'] }, { version: 'v7.6.4', date: 'Jun 26, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a path traversal vulnerability (8.9)'] }, { version: 'v7.6.3', date: 'Jun 24, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a major vulnerability', 'minor fixes'] }, From d42a098913d50f24eae6d191de0c6d8bf275baab Mon Sep 17 00:00:00 2001 From: ildyria Date: Mon, 13 Jul 2026 22:38:52 +0200 Subject: [PATCH 2/4] typo --- src/data/releases.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/data/releases.ts b/src/data/releases.ts index 445f3238..4015c0a6 100644 --- a/src/data/releases.ts +++ b/src/data/releases.ts @@ -8,7 +8,7 @@ export interface Release { // Release data extracted from releases.md export const releases: Release[] = [ - { version: 'v7.7.1', date: 'Jul 13, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a mojor vulnerability in the webshop', 'minor sqlite fix'] }, + { version: 'v7.7.1', date: 'Jul 13, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a major vulnerability in the webshop', 'minor sqlite fix'] }, { version: 'v7.7.0', date: 'Jul 13, 2026', title: 'Album thumbs, and RSS feed customization', type: 'feature', highlights: ['Add cover to tag albums', 'Add option to disable the second line on album thumbs', 'Allow customizing RSS feed title & description', 'Fixes access rights with multiple groups', 'Fixes webshop bypass vulnerability (8.3)'] }, { version: 'v7.6.4', date: 'Jun 26, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a path traversal vulnerability (8.9)'] }, { version: 'v7.6.3', date: 'Jun 24, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a major vulnerability', 'minor fixes'] }, From 838c656de04d56e393105d601ad5c3fbc2be1381 Mon Sep 17 00:00:00 2001 From: ildyria Date: Mon, 13 Jul 2026 23:32:36 +0200 Subject: [PATCH 3/4] thanks --- src/content/docs/docs/getting-started/releases.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/content/docs/docs/getting-started/releases.md b/src/content/docs/docs/getting-started/releases.md index df4c8aa5..a12ff1eb 100644 --- a/src/content/docs/docs/getting-started/releases.md +++ b/src/content/docs/docs/getting-started/releases.md @@ -27,6 +27,8 @@ Which means we need to ship a fix ASAP. * `fix` #4516 : Fix Sqlite bug on virtual columns by @ildyria. > When using sqlite, the virtual columns were not properly handled. This is now fixed. +Thanks to @5ud0er for reporting the bypass vulnerability on pricing. + ### v7.7.0 From 6bef0206650242fa86101f49b64f5663fad9797d Mon Sep 17 00:00:00 2001 From: ildyria Date: Mon, 13 Jul 2026 23:51:22 +0200 Subject: [PATCH 4/4] thanks --- src/pages/support.astro | 74 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/src/pages/support.astro b/src/pages/support.astro index 8c9a1012..a32ee671 100644 --- a/src/pages/support.astro +++ b/src/pages/support.astro @@ -283,6 +283,80 @@ const metadata = { ]} /> + +