LoginSign Up
← Back to all sparks
G

Grav

DEVOPS
Velocity2.5

Modern flat-file CMS that runs without a database

getgrav.org ↗

Grav backports a Clockwork profiler security fix from 2.1.7 to its 1.7 line.

cmsflat-filephpsecurity-fixesbackports
◆Current state
Grav's only entry in the feed is 1.7.53.6, a patch to the legacy 1.7 branch. It backports a Grav 2.1.7 security fix so Clockwork profiler data requires a configured debugger.token, even for requests arriving from localhost through a same-server reverse proxy. It also keeps accented letters intact in title-derived slugs on PHP 7.3 to 8.1 with single-byte locales.
◆Where it's heading
The fix originates on Grav 2.x and is carried back to 1.7, so the project is maintaining two lines, with 1.7 receiving security and compatibility patches for older PHP versions. With a single entry, the cadence on either branch isn't visible yet.
◆Prediction
Expect further 1.7.53.x patches that mirror security fixes from the 2.x line. The entries don't show how long 1.7 support continues.

◆Recent moves

  1. 3d ago

    Grav 1.7.53.6: profiler token now required, slug encoding fix

    A security backport from 2.1.7: Clockwork profiler data now needs a debugger.token, closing access through same-server reverse proxies that look local. Sites on 1.7 using the profiler must set a token after upgrading.

    View source ↗