Starstruk Logo MarkStarstruk

1.0.8.3

takahirom/arbigent1.0.8.3May 13, 2026by givanz

AI Summary

This release focuses on critical security patches to address vulnerabilities related to cart data exposure, module permissions, XSS risks, and PHP memory exhaustion.

Key Highlights

  • Fixed cart page to use encrypted cart_id
  • Fixed wrong module permission checks for admin controllers
  • Added sanitization for user display_name field
  • Validated plugin uploads to prevent PHP exposure
  • Prevented apache directory listing

New Features

  • Security hardening (encryption, sanitization, validation, directory listing prevention)

Full Release Notes

* Fixed cart page to use only encrypted cart_id instead of unencrypted to avoid loading random cart data, vulnerability reported by @Mitchell45 https://github.com/givanz/Vvveb/commit/301e9b66a3b3a1cb42cb05ad1ff3cd428ed30b26
* Fixed wrong module permission check for some admin controllers, vulnerability reported by @Mitchell45 https://github.com/givanz/Vvveb/commit/8d59962b5d9775264f0f05bf87ee1f514ebf7666
* White list sort order and direction for /user/orders, vulnerability reported by @whuHouYF https://github.com/givanz/Vvveb/commit/e855c8572b7298901ebc249e11883eefc03a7b48
* Added sanitization for user display_name field, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/fefac290a8c85d3c87fe80ffed68b6c5bc50e93c
* Validate plugin upload and check that no php is exposed in public folder, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6
* Prevent apache directory listing, vulnerability reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb
* Fixed Controller Recursion PHP Memory Exhaustion reported by @CyberWarrior9 https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 
* Added escape for customer_order_id in missing order warning message, fix for GHSA-3xwm-8f6m-cfc6 reported by @whuHouYF https://github.com/givanz/Vvveb/commit/2457d88b125430d0724978993442946e43a6dac2 
* Changed sanitizeHTML to strip javascript code inside tags with escaped entities, fix for GHSA-39gc-pjv5-4w4p reported by @elvinsuleymanov https://github.com/givanz/Vvveb/commit/7e02b0e1a375480bf4b45a10175f6c07f91ff409