1.0.6

givanz/Vvveb1.0.6Jan 13, 2025by givanz

AI Summary

Major refactoring of the permission system using traits to share code between GraphQL and Rest. It adds brute force protection, honeypot spam protection, and supports theme AJAX page loading.

Key Highlights

  • Permission trait for common permission check methods.
  • Added rest and graphql tabs to role permissions.
  • User signup honeypot spam protection and brute force protection for login.
  • Code editor disable saving for php and tpl files for less privileged roles.

New Features

  • Permission trait refactoring
  • GraphQL and Rest role permissions
  • Brute force protection
  • Honeypot spam protection

Full Release Notes

* Changed product model getContent method table alias to product https://github.com/givanz/Vvveb/commit/3661080b0895bd6346bd90024a887671bdfa49e0
* Plugins update https://github.com/givanz/Vvveb/commit/50f66fca75189a3f22689613aaba7935fe03e8c3
* Permission trait for common permission check methods https://github.com/givanz/Vvveb/commit/d18fbf837907d1e6673d4f33c27dd5bbd5995209
* Added styles properties for section component https://github.com/givanz/Vvveb/commit/d598b3b1d1235afd5bd57b9bf7ff8fd5920dc52c
* Changed plugin activate page refresh parameters from r to t to avoid conflict cu editor refresh parameter https://github.com/givanz/Vvveb/commit/e020be7327849fa53a8c45bf83b1ec19f8bbfa1a
* Added escape for menu items to avoid XSS for custom post types menu entries, vulnerability reported by https://github.com/givanz/Vvveb/commit/b53c7161da606f512b7efcb392d6ffc708688d49 @0xHamy
* Fixed bug in buildParams function https://github.com/givanz/Vvveb/commit/3eb08e9e7ec845637bb0dda016a0e0bbe91f2726
* Moved method parameters and table columns data from local method variable to model properties to also be able to use it for validate method https://github.com/givanz/Vvveb/commit/5f0e04f5cf62dd4bacbbc9876bfce938f5f257e9
* Include validate method in sqlP generated models https://github.com/givanz/Vvveb/commit/9cc9ddd37d954f549e78c1651d060958ee3cf1fd
* Added https://github.com/givanz/Vvveb/commit/f5df45cb3c5cfd59d44b350b2e9c71088e7fe1c5 @results support for sqlP macros https://github.com/givanz/Vvveb/commit/f5df45cb3c5cfd59d44b350b2e9c71088e7fe1c5
* Added default template parameter for setSite method https://github.com/givanz/Vvveb/commit/d50882752edac78fac6d40e356d37c4c19c27a6f
* Check for imagick first before falling back to gd when choosing php image library extension https://github.com/givanz/Vvveb/commit/82a4a8230c570ac9eef1502bbd486a65823b60b9
* Include comments for db drivers getColumnsMeta method https://github.com/givanz/Vvveb/commit/b21ede462a217dff156fa8d31e4ccd2e7a672f2a
* Table columns validate method to be used for edit and add model methods validation https://github.com/givanz/Vvveb/commit/a5bdb2caf3808a26e2545e5a1dff03451d85770c
* Request class set post array values for put and patch methods also for REST api https://github.com/givanz/Vvveb/commit/e3f863dfdfb204cd342d7c47140b5087db2c5fed
* Check if component has request method before calling https://github.com/givanz/Vvveb/commit/657aebd7876a793ba8cddb383f8137b7a725ef94
* Include cart product subscription and taxes if id not empty https://github.com/givanz/Vvveb/commit/cd23047de66b4555820c9f91cdbaade39d6082af
* Added rest and graphql tabs to role permissions, fixed backup/restore progress bar js, copy from default language button https://github.com/givanz/Vvveb/commit/2d383f0a1efa358b2a9ad5a0039390d97b909c1e
* Theme ajax page loading support https://github.com/givanz/Vvveb/commit/508f788242ca9effc45fae888c333d9e8d23a76a
* Fix for product options delete not working, added date range input support https://github.com/givanz/Vvveb/commit/9559ba02ab752f7386616abdff4a8a8350008ea8
* Docker image and configuration update https://github.com/givanz/Vvveb/commit/797fea83eb69db933ce5c8e9caf82ebd7a2682d8
* Sql file name fix for post_to_taxonomy_item table https://github.com/givanz/Vvveb/commit/111cbe9c4cf3dbeaa0d94fc7fb007ccd19793ea7
* Fixed some default values for tables https://github.com/givanz/Vvveb/commit/3eeb33a82aa49932b5609ce8349f3415d1bc7fc0
* Changed routes for post and products back to using only slug without id's https://github.com/givanz/Vvveb/commit/78cc20de2140e10f13fb97ad5639f97df5aab816
* Keep username input value on post for login box https://github.com/givanz/Vvveb/commit/1f67d007f3f8d663d297ba96f78a63b9b92d42e2
* Validate user profile update form https://github.com/givanz/Vvveb/commit/c2806bbd2d618c86155bdde9daad42591fb535e0
* Fixed product_id request to read from get or post parameters and template array product key https://github.com/givanz/Vvveb/commit/8e6b8d71f95f542805f81a07cb8ee8c0021c875b
* Fix for php notice when all languages are disabled or removed. https://github.com/givanz/Vvveb/commit/d4cad09b99f6611007725a634ef651894ada17da
* Added slug and name to order by list https://github.com/givanz/Vvveb/commit/e7ed8a3f209de2a9ce0a22c152bdb1dfc33392d9
* Fixed component content saving https://github.com/givanz/Vvveb/commit/8735000746f302dd81d019c422cd88b6e2da4ebb
* Added site_id parameter to components https://github.com/givanz/Vvveb/commit/f7e2fe14d10022421a37f08521bff0bcec38d9c1
* Changed module to match module parameter from get to avoid mismatch with route parameter https://github.com/givanz/Vvveb/commit/efdb6bc1919b5264660a9ba69c0f89d62c97f7a0
* Restricted user and post content input length to match db length https://github.com/givanz/Vvveb/commit/9dbd5c0b7f2ce0a23b801cf399bde2c6c6a5d133
* Output error/success message directly to allow html content in messages https://github.com/givanz/Vvveb/commit/7199e4042ecfcbf375d824879a4e2f71b37264c2
* Added escape for menu items to avoid XSS for custom post types menu entries, vulnerability reported by https://github.com/givanz/Vvveb/commit/605a70f8729e4d44ebe272671cb1e43e3d6ae014 @0xHamy
* Fixed failed login models delete method https://github.com/givanz/Vvveb/commit/ab7b56ab514a5f20ded26e07bf41fa30eaefe0f0
* Changed role model delete method to work with multiple id's https://github.com/givanz/Vvveb/commit/ce83b52f810d28936bcc96a1b0578e0f5c285d05
* Added missing type for params https://github.com/givanz/Vvveb/commit/4d72ae49500ef704b9b96e6e5880533344509b4f
* Removed redundant language_id param https://github.com/givanz/Vvveb/commit/acaf7906ae012cb8d4dbee82c43e82fde418c93f
* Include role name in admin user info https://github.com/givanz/Vvveb/commit/22cf311b3ddff5c20cc004b87a1d93d957ebfbb3
* Show 404 not found if the user does not exist https://github.com/givanz/Vvveb/commit/062061b676d54974457a54be74a96536dae038dd
* Database upgrade with new tables created on core update https://github.com/givanz/Vvveb/commit/a62a4846a81b7b592970929d0452573d12ef0f87
* Cache driver info and GraphQL and Rest enabled status https://github.com/givanz/Vvveb/commit/0223af3c124c15d9165ec9f1e4101420d39ad7b8
* Added exit after backup file reading to avoid html rendering after dump https://github.com/givanz/Vvveb/commit/07a495f3fe74ae833bf9b839711cda51b8a29423
* Site id parameter for theme list to set correct active theme for current site, excluded backup folder from site duplicate skip folders https://github.com/givanz/Vvveb/commit/3b322be025b9b1cc2065fb8ad104a740d11f2496
* Merge site config data with site db data, sanitize description fields. https://github.com/givanz/Vvveb/commit/969a5ab5d6b855618e74645d8054618bd854eb3a
* Added event filter for email settings to allow adding new providers https://github.com/givanz/Vvveb/commit/45a1b7d86875d135c180f69e9f610f56fc521a42
* Post/product content parameter changed in model edit method, added file checks to load only templates that are html files inside theme folder, previously other files could be loaded from theme fold… https://github.com/givanz/Vvveb/commit/56e8b848b3e8a06482e3a1ca2b985b737f9f5950
* Fixed wrong getAll method for manufacturer https://github.com/givanz/Vvveb/commit/f5d0a12e93478ad3408520a1ead7969a648923d8
* Crud and Listing traits update to work for both admin and REST https://github.com/givanz/Vvveb/commit/7525a660603ad47071c172a6fa59b25836291373
* Changed post and product model edit method to add post/product content as separate parameter https://github.com/givanz/Vvveb/commit/aff63256ae7224e499e3184a1cd3f4ea490f637a
* Permissions code moved to trait to share code for GraphQL and Rest https://github.com/givanz/Vvveb/commit/27fb8e4207e127343593c2f00070c03107b4f2ed
* GraphQL and Rest role permissions https://github.com/givanz/Vvveb/commit/79f6255a7542c000291ce48878198c4cf57d4a41
* Add post and product id to edit url if available https://github.com/givanz/Vvveb/commit/a13e0fd26b4ac65c9616d317a35a9c6e4075841c
* Added new isController, isModel, model and controller functions https://github.com/givanz/Vvveb/commit/ef691bcaf758bf682779560dbf705c275cfa2109
* User signup honeypot spam protection https://github.com/givanz/Vvveb/commit/29c0ad71bc33420b3dd8799940671cbb1f75cbe8
* Code editor disable saving for php and tpl files to avoid php code injection from less privileged admin roles, vulnerability reported by https://github.com/givanz/Vvveb/commit/f684f3e374d04db715730fc4796e102f5ebcacb2 @0xHamy
* Brute force protection for admin and user login pages, vulnerability reported by https://github.com/givanz/Vvveb/commit/739c6a694276e27fbc4513a0806204091648faf3 @0xHamy
* Fix site access list empty on admin user page https://github.com/givanz/Vvveb/commit/ea1c950ccf08a721489689cb3a4c3ce665e16798  https://github.com/givanz/Vvveb/issues/240
* Changed data-v-global-site.title to data-v-global-site.description.title, disable add to cart if product out of stock, changed sections title to aria-label. https://github.com/givanz/Vvveb/commit/79bc7a3579558bdec238e7b699cb1431e37fd0eb
* Avoid js error if alert button is not on page, save page url on history state change https://github.com/givanz/Vvveb/commit/9c05abc6a29c5ef7aa256bf85c1c6b8a2f5a08fc
* Moved clearMedia function to admin theme js https://github.com/givanz/Vvveb/commit/8b5f80fd15028c40454a243bcd47068814e67ec4
* Use aria-label if available for section title, prevent default action on page item in file manager https://github.com/givanz/Vvveb/commit/959bc77dc8a2964dfad4d15c1fe19907c6279783
* Changed posts to post alia for taxonomy queries and categories component https://github.com/givanz/Vvveb/commit/a6cb0d2be5cd83010540e2fcb5732be1d269fc0c
* Check if email already in use on guest checkout page https://github.com/givanz/Vvveb/commit/f48b8adaaeec35e3a3dfae85efec4ebd584f2dfd
* Fixed wrong url on localhost for menu items links https://github.com/givanz/Vvveb/commit/0b7fbe0c9b56d6bfb89788c1f1eb76d25ebb2d75
* Added permissions rule precedence for exact rules, removed action from permission rules to make it simpler and shorter, increased role list dropdown length https://github.com/givanz/Vvveb/commit/5a39ca87fdf0246ea5dd1589c6ee233c3811d1cd
* Fixed template list wrong html path on windows because of different directory separator https://github.com/givanz/Vvveb/commit/81cc62125243c319d5e0b0eece16659af101f428
* Language rtl support https://github.com/givanz/Vvveb/commit/57089caba84f99e36269aa30db10c2ad3b3cb35b
* Fix typo https://github.com/givanz/Vvveb/commit/d4673cc5e77f2aecdb36409be4aaf3e65f1c2ea7
* Replaced with for escaping html in templates and added where missing. https://github.com/givanz/Vvveb/commit/0331f4b1f3f742a8445ce89c8177318aad4925a9
* Added vtpl and attributes support to add conditional attributes to html nodes. https://github.com/givanz/Vvveb/commit/5c5d797ac0ec59a1b19b3606e716e66675cf2fa7
* Check if module route is present before checking if post or product page to avoid php warning https://github.com/givanz/Vvveb/commit/a3ba3de70997ea47a71d401489519edeca1f9731
* Don't add subdir for urls where current path is used https://github.com/givanz/Vvveb/commit/eb682965ad2022c219e59e36ebeac381fdab567a
* Fixed error during install when using sub directory install https://github.com/givanz/Vvveb/commit/964064e4d7d090b6cce5e7bd4a50563dbfe18649  https://github.com/givanz/Vvveb/discussions/201
* Check if language code is valid before changing language https://github.com/givanz/Vvveb/commit/5dec6131a6abea9683746e92ae868f663546e5c2