Skip to content

v2_12_2 #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mathieu-ducrot merged 4 commits into from
Aug 5, 2026
Merged

v2_12_2 #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5ddef62
Add missing sec tok on login form pour fix CWE-352
mathieu-ducrot Aug 4, 2026
9690b01
Add missing integrity attribut on iconify to fix CWE-345
mathieu-ducrot Aug 4, 2026
5f229d6
Add integrity hash for marked js use on the markdown template
mathieu-ducrot Aug 5, 2026
f7c8611
Update changelog v2.12.2 about recent fixed CWEs
mathieu-ducrot Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,14 @@
CHANGELOG
===================
## v2.12.2 - (2026-08-05)
### BC BREAK
- The login form now submits a CSRF token. You must enable `enable_csrf: true` on the `form_login` of the admin firewall in your `security.yaml` config, otherwise authentication will fail.

### Fixed
- `templates/security/login.html.twig` Add missing CSRF token on login form to fix CWE-352
- `templates/empty_layout.html.twig` Add missing `integrity`/`crossorigin` attributes on the Iconify CDN script to fix CWE-345
- `templates/admin/documentation/markdown.html.twig` Pin `marked` CDN script to a fixed version and add `integrity`/`crossorigin` attributes to fix CWE-345

## v2.12.1 - (2026-05-19)
### Removed
- Removed redundant Composer dependencies duplicated from `smartbooster/core-bundle`
Expand Down
2 changes: 1 addition & 1 deletion templates/admin/documentation/markdown.html.twig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@

{% block javascripts %}
{{ parent() }}
<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/marked@15.0.12/marked.min.js" integrity="sha384-948ahk4ZmxYVYOc+rxN1H2gM1EJ2Duhp7uHtZ4WSLkV4Vtx5MUqnV+l7u9B+jFv+" crossorigin="anonymous"></script>
<script type="application/javascript">
document.addEventListener('DOMContentLoaded', function() {
const content = {{ markdown_content|json_encode|raw }}
Expand Down
2 changes: 1 addition & 1 deletion templates/empty_layout.html.twig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
{# no parent() to disable javascript on empty_layout to prevent loading jquery #}

{# https://iconify.design/docs/iconify-icon/#registering-the-web-component #}
<script src="https://code.iconify.design/iconify-icon/2.1.0/iconify-icon.min.js"></script>
<script src="https://code.iconify.design/iconify-icon/2.1.0/iconify-icon.min.js" integrity="sha384-GPb5RlngihS9H0z1D137JsvzmeZ7tCpWEF4t5YDoTZyMsPP8S7h7vFDh4XhheU83" crossorigin="anonymous"></script>
{% endblock %}

{% block sonata_wrapper %}
Expand Down
1 change: 1 addition & 0 deletions templates/security/login.html.twig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,13 @@
<div class="login-box-body">
{% block smartsonata_box_header %}<h1 class="text-center">SMART SONATA</h1>{% endblock %}
<form action="{{ security_login_check_url }}" method="post">
<input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
<div class="form-group has-feedback">
<input type="text" name="_username" class="form-control" autocomplete="off" placeholder="{{ 'login.label_username'|trans({}, 'security') }}" required />

Check warning on line 20 in templates/security/login.html.twig

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an "id" attribute to this input field and associate it with a label. 


See more on https://sonarcloud.io/project/issues?id=smartbooster_sonata-bundle&issues=AZ_RILakVFs3hZYmINje&open=AZ_RILakVFs3hZYmINje&pullRequest=85
<span class="glyphicon glyphicon-user form-control-feedback"></span>
</div>
<div class="form-group has-feedback">
<input type="password" name="_password" class="form-control" autocomplete="off" placeholder="{{ 'login.label_password'|trans({}, 'security') }}" required />

Check warning on line 24 in templates/security/login.html.twig

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an "id" attribute to this input field and associate it with a label. 


See more on https://sonarcloud.io/project/issues?id=smartbooster_sonata-bundle&issues=AZ_RILakVFs3hZYmINjf&open=AZ_RILakVFs3hZYmINjf&pullRequest=85
<span class="glyphicon glyphicon-lock form-control-feedback"></span>
</div>
<div class="row margin-bottom">
Expand Down
Loading