Grav 2.0.4 Security Update: Fix blackaccess Case-Sensitivity, Twig regex_replace PCRE Error, and Form Validation

Vulnerability Overview In Grav version 2.0.4, multiple security vulnerabilities and fixes have been addressed, primarily concerning file access control, the Twig template engine, image processing, and form validation. Affected Scope File Access Control: The rules in Grav no longer distinguish between uppercase and lowercase characters when matching sensitive folders and files. This fixes an issue where requests with differing case formats could potentially access account and configuration YAML files on case-insensitive file systems (such as Windows, macOS, and certain Docker mounts). Twig Template Engine: The filter now returns the unchanged input instead of when encountering PCRE errors (such as backtracking limit issues), preventing potential output corruption. Image Processing: When resizing images larger than their original dimensions, Grav no longer pads them onto an oversized canvas with a white border. Instead, it maintains their natural size, unless the parameter is explicitly used. Form Validation: Disabling the Twig sandbox no longer breaks pages or modules containing forms. Previously, these would fail with a "SandboxExtension extension is not enabled" error. Sandbox Whitelist: Clearing blocked items from the tool report now correctly removes the corresponding block from the recent block list. Remediation File Access Control: Fixed the case-sensitivity issue with rules, ensuring proper blocking of access to sensitive files on case-insensitive file systems. Twig Template Engine: Fixed the behavior of the filter when encountering PCRE errors, ensuring it returns the unchanged input. Image Processing: Fixed the image resizing behavior, ensuring images retain their natural size unless is explicitly specified. Form Validation: Fixed form validation issues when the Twig sandbox is disabled, ensuring pages or modules containing forms function correctly. Sandbox Whitelist: Fixed the issue of clearing block items from the tool report, ensuring blocks can be cleared correctly. POC Code or Exploit Code No specific POC code or exploit code was provided for this page.

Goal Reached Thanks to every supporter — we hit 100%!

Grav 2.0.4 Security Update: Fix blackaccess Case-Sensitivity, Twig regex_replace PCRE Error, and Form Validation

More from this source