Security update

Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

Improved permissions for the admin settings form.

REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

This release ensures that access is properly checked for rest views displays.

Upgrade tarteaucitron.js to 1.17.0

Changelog

Issues: 3 issues resolved.

Changes since 8.x-6.4:

See Registration role - Critical - Access bypass - SA-CONTRIB-2024-015.

This release ensures that, even if configuration does not ever get updated to the new schema as expected, only the expected roles are granted to new registrants.

If you cannot update right away, simply re-save the configuration form at /admin/people/registration-role and your configuration will be fixed, even without this release.

Security updates

Fixes: Drupal Symfony Mailer Lite - Moderately critical - Cross site request forgery

Maintenance release to fix XSS vulnerability, see Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011.

No other changes since 8.x-1.3