1.0.8.3

ruixenui/ruixen.com1.0.8.3May 13, 2026by givanz

AI Summary

Vvveb 1.0.8.3 is a security-focused patch release addressing vulnerabilities in cart handling, module permissions, path handling, and sanitizing user inputs to prevent XSS and data exposure.

Key Highlights

Fixed cart page to use only encrypted cart_id
Fixed wrong module permission checks for admin controllers
Added sanitization for user display_name field
Fixed PHP memory exhaustion in Controller Recursion

New Features

Enhanced cart security
Module permission fixes
Input sanitization and XSS prevention

Full Release Notes

* Fixed cart page to use only encrypted cart_id instead of unencrypted to avoid loading random cart data, vulnerability reported by @Mitchell45 https://github.com/givanz/Vvveb/commit/301e9b66a3b3a1cb42cb05ad1ff3cd428ed30b26
* Fixed wrong module permission check for some admin controllers, vulnerability reported by @Mitchell45 https://github.com/givanz/Vvveb/commit/8d59962b5d9775264f0f05bf87ee1f514ebf7666
* White list sort order and direction for /user/orders, vulnerability reported by @whuHouYF https://github.com/givanz/Vvveb/commit/e855c8572b7298901ebc249e11883eefc03a7b48
* Added sanitization for user display_name field, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/fefac290a8c85d3c87fe80ffed68b6c5bc50e93c
* Validate plugin upload and check that no php is exposed in public folder, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6
* Prevent apache directory listing, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb
* Fixed Controller Recursion PHP Memory Exhaustion reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 
* Added escape for customer_order_id in missing order warning message, fix for GHSA-3xwm-8f6m-cfc6 reported by @whuHouYF https://github.com/givanz/Vvveb/commit/2457d88b125430d0724978993442946e43a6dac2 
* Changed sanitizeHTML to strip javascript code inside tags with escaped entities, fix for GHSA-39gc-pjv5-4w4p reported by @elvinsuleymanov https://github.com/givanz/Vvveb/commit/7e02b0e1a375480bf4b45a10175f6c07f91ff409