Statamic 5.73.21

[markjensen-novu]

First of all, thank you 🫵 for taking the time to contribute to Statamic, we really appreciate it! 💜

Please take 30 seconds to read the following so we can be as efficient as possible when reviewing and considering merging PRs:

1️⃣ Is this your first PR? If so, please read our contribution guide first.

2️⃣ Please make sure to create a new branch for your PR.

3️⃣ Typically you should target the branch of the most current release, e.g. 5.x, unless your PR includes a breaking change, in which case you should target the master branch for the next major release.

4️⃣ We really appreciate it if your PR includes tests. This makes it much easier for us to review, merge, and release. A PR with tests is usually reviewed and merged 5x-10x faster.

5️⃣ If your PR introduce a new feature, adds to an existing one, or changes current behavior, please open an issue for it in the statamic/docs repo referencing your PR. A simple "Goes along with statamic#9000" is enough. Otherwise it's really easy to forget and no will ever become aware of your ✨ sparkling ✨ invention if it's not documented.

6️⃣ Remove this placeholder text and replace it with a description of what this PR is doing.

Note

Harden security across Statamic 5.73.21 with access control, input validation, and live preview fixes

• Forgot password endpoints now always return a generic success response regardless of whether the user exists or is throttled, preventing user enumeration.
• Reset form URLs are validated more robustly: encrypted values must be internal; plaintext values must be safe relative paths without control characters or excessive length.
• Password protection bypass via live preview tokens is now scoped to the specific item being previewed (isLivePreviewOf), not any live preview request.
• getQueryableValue across entries, assets, users, terms, and other models now uses an explicit allowlist instead of method_exists, preventing invocation of arbitrary methods (e.g. delete, save).
• Dictionary file paths are validated against path traversal (..) before use.
• SVG assets are sanitized on reupload when svg_sanitization_on_upload is enabled, and SVG responses in the CP include a script-src 'none' CSP header.
• CP sort parameters across entries, users, terms, assets, and form submissions are now validated via OrderBy::column before being applied.
• Taxonomy term revisions are removed: CP routes, controllers, and UI props for term revisions are deleted.
• Stache index loading is now re-entrant safe via a stack, fixing URI blinking during any concurrent index load.
• Risk: term revision data and routes are permanently removed; any code depending on term working copies or revision endpoints will break.

📊 Macroscope summarized 21da7d1. 64 files reviewed, 2 issues evaluated, 0 issues filtered, 2 comments posted

🗂️ Filtered Issues