Repository navigation

Fix manager privilege escalation - #2493

Merged

Seiger merged 7 commits into

evolution-cms:3.5.xfrom

elcreator:fix-manager-privilege-escalation

Oct 8, 2026

Merged

Fix manager privilege escalation#2493
Seiger merged 7 commits into
evolution-cms:3.5.xfrom
elcreator:fix-manager-privilege-escalation

Commits on Oct 8, 2026
- fix(media-browser): reject disguised and mismatched image uploads
  
  elcreator
  and
  claude
  committed
  6e222ba
- fix(tv): require save_snippet before a TV binding can run code
  
  elcreator
  and
  claude
  committed
  60d8e07
- fix(manager): check permissions on action 118's settings/plugin ajax
  
  elcreator
  and
  claude
  committed
  0c19bcd
- fix(tv): restrict a TV by its own access group, not the document's
  
  elcreator
  and
  claude
  committed
  18de1c1
- fix(core): confine @FILE/@INCLUDE/file_get_contents to safe content
  
  elcreator
  and
  claude
  committed
  d7597ba
- fix(manager): sandbox the resource preview iframe
  
  elcreator
  and
  claude
  committed
  8fb1a87
- fix(manager): stop the web user email label overlapping its field
  
  elcreator
  and
  claude
  committed
  068766e