Security update

This release of FileField Sources fixes several long-standing bugs that have been fixed by the community as well as a security fix that now properly hides the file names when using the autocomplete source. The security fix only applies to users that both used the autocomplete source and used private files on the same field. See the security announcement at https://www.drupal.org/sa-contrib-2018-007 for more information.

Changes since 7.x-1.10

Fixes Entity Reference Tab / Accordion Formatter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-008

Summary

This is a security release. Please update your sites as soon as possible.

This release contains only the fix for the security issue. For more information refer to the security advisory SA-CONTRIB-2018-005.

Fixed security issue "XSS in its field formatter".

Taxonomy Term Reference Tree Widget - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-006

This resolves SA-CONTRIB-2018-004, and also includes other minor bug fixes and improvements. Updating is recommended for all sites.

Known issues

A problem with one of the issues showed up: #2941981: Backup files being overwritten. A new release will be made available shortly.

Changes since 7.x-3.3:

Fixes SA-CONTRIB-2017-095.