easycorp/easyadmin-bundle

This is a security release. Upgrade as soon as possible. Before this fix, the custom-action route dispatcher could bypass the access_control rules defined in your Symfony security configuration.

Security fixes

[6228dfe] Re-validate access_control when dispatching custom-action routes (@javiereguiluz)

Full security advisory information:
GHSA-g2fm-8hr4-j82h

📣 Announcement: New in EasyAdmin 5.5

If EasyAdmin helps your company ship faster, consider funding its development:
❤️ Sponsor EasyAdmin

New features

[c52151b] Support sorting by nested association fields (@javiereguiluz)
[f4fbdce] Allow to prepend and append text/HTML/icons in form fields (@javiereguiluz)
[d71a1c1] Persist the selected tab between detail and edit pages (@javiereguiluz)

Bug fixes

[cc33b6a] Fix autocomplete ids with non-Symfony uid Doctrine types (e.g. ramsey/uuid-doctrine) (@bortomar)
[8e7574d] Fix search in deeply nested properties (@javiereguiluz)
[7d3b287] Fix the design of multi-row tabs (@javiereguiluz)
[8f0da71] Update assets to not depend on DOM structure (@javiereguiluz)
[f4198cf] Fix the input group prepend (@javiereguiluz)
[81d0db5] Fix NumericFilter with null values on money fields (@ERuban)
[8ba443a] Restore BC by catching exceptions thrown by stringables (@KDederichs)
[315d927] Make Bootstrap grid gutters follow the density scale (@javiereguiluz)
[516487d] Fix the lock/unlock button of the slug field (@javiereguiluz)
[5917e86] Add generic return type to AbstractCrudController::getContext() (@ERuban)

Bug fixes

[68772e7] Fix setting custom HTML attributes on boolean fields and Switch component (@javiereguiluz)
[355314b] Remove the auto-scroll feature in long menus (@javiereguiluz)
[393c4d2] Fix nested dropdowns in inline actions (@javiereguiluz)

📣 Announcement: New in EasyAdmin 5.4: Theming Is Here

If EasyAdmin helps your company ship faster, consider funding its development:
❤️ Sponsor EasyAdmin

New features

[c77572a] Support nested associations and embedded properties in filters (@Seb33300, @KDederichs)
[77df5aa] Update the design of the tabs and tab lists (@javiereguiluz)
[9fbc5f5] Allow to override each part of the detail page (@javiereguiluz)
[ffa9207] Add group_by support to autocomplete association fields (@javiereguiluz)
[c368517] Add a simple but powerful theming API (@javiereguiluz)

Bug fixes

[f2df281] Fix the swapped debug messages of InsufficientEntityPermissionException (@guillaume-sainthillier)
[2d04070] Fix ArrayFilter crashing when the filtered property is not a displayed field (@guillaume-sainthillier)
[457c1ec] Fix TypeError when calling Crud::setFilters(null) (@guillaume-sainthillier)
[dd250a5] Don't lose the original exception when the fallback AdminContext creation fails (@guillaume-sainthillier)
[7a326e6] Support absolute filesystem paths in setUploadDir() (@lacatoire)
[1af2bd5] Fix image field lightbox init and thumbnail scroll jump (@nlemoine)
[7797ade] Fix the design of split buttons (@javiereguiluz)

Misc changes

[7fca25c] Add native property types to the test app entities (@guillaume-sainthillier)
[e3300f1] Remove dead code and simplify redundant constructs (@guillaume-sainthillier)
[acf774b] Mark immutable promoted properties as readonly (@guillaume-sainthillier)
[8a79c22] Remove the ENTITY_FQCN_TO_CRUD_FQCN cache entry, which was written but never read (@guillaume-sainthillier)
[3ee3bd8] Add native types to DTO properties, getters and event interfaces (@guillaume-sainthillier)
[eb5ae08] Update .gitattributes for cleaner repository exports (@IndraGunawan)

Version details blog post:

New in EasyAdmin 5.3: A Modernized Sidebar, Symfony Reprise, and More Theming Groundwork
https://dev.to/javiereguiluz/new-in-easyadmin-53-a-modernized-sidebar-symfony-reprise-and-more-theming-groundwork-3p8i

New features

[6eb4708] Add support for Symfony Reprise assets (@Kocal)
[cfa4fd4] Add a Sidebar Twig component (@javiereguiluz)
[da32e36] Port new tab badge feature to detail.html.twig (@natepage)

Bug fixes

[92bca6a] Fix the divisor used by MoneyField for Money objects of non-2-decimal currencies (@guillaume-sainthillier)
[e443064] Fix the app.css build asset corrupted by merge conflict markers (@nlemoine)

Misc changes

[78bbd7e] Fix stale docblocks in AdminContext and AfterEntityUpdatedEvent (@guillaume-sainthillier)
[321f2d8] Clean up the test suite (@guillaume-sainthillier)
[53c585b] Adapt the actions test fixture to the stricter URL generation (@guillaume-sainthillier)
[ce49ced] Remove the unused AdminRouteGenerator argument of MenuItemMatcher (@guillaume-sainthillier)
[621dd52] Update styles to ease future theming (@javiereguiluz)
[8c87f51] Update CSS to use layers (@javiereguiluz)
[5ec0169] Uniformize styles onto the base design tokens (@javiereguiluz)

Version details blog post:

New in EasyAdmin 5.2: Twig Components, Polished UI, and Theming Groundwork
https://dev.to/javiereguiluz/new-in-easyadmin-52-twig-components-polished-ui-and-theming-groundwork-23on

New features

[7878d69] Allow to display badges in form tabs (@javiereguiluz)
[62332b0] Add a <twig:ea:Switch> Twig component to render switches/toggles (@javiereguiluz)
[72d1f35] Add a <twig:ea:Pagination> Twig component to render pagination elements (@javiereguiluz)
[5b644bb] Add a <twig:ea:Modal> (and <twig:ea:Modal:Trigger>, <twig:ea:Modal:Close>) Twig component to create modals (@javiereguiluz)
[1b959f1][e66e807] Improve the <twig:ea:ActionMenu> component (@javiereguiluz)
[aa88896] Improve the <twig:ea:Flag> component (@javiereguiluz)
[ddb01d0] Improve the <twig:ea:Button> component (@javiereguiluz)
[b7a3ba5] Improve the <twig:ea:Icon> component (@javiereguiluz)
[3abe57e] Improve the <twig:ea:Alert> component (@javiereguiluz)

Bug fixes

[54bb503] Avoid interdependent content_title and page_title Twig blocks (@MatTheCat)
[8162aa1] Adjust select height (@Seb33300)
[7fc4e48] Fix several button design issues (@javiereguiluz)
[c09a46d] Fix file upload when using Flysystem (@javiereguiluz)
[27b2a2a] Preserve custom query parameters in index search forms (@javiereguiluz)
[0c0a328] Open rows in new tabs when using middle click or control click (@javiereguiluz)
[351dfae] Misc doc changes (@vincentvdree)

Misc changes

[cf313af] Improve performance of some Twig Components (@javiereguiluz)
[e3b4ef7] Add a new doc page to explain how our Twig Components work (@javiereguiluz)
[e1b5b4d] Remove redundant getEntityFqcn backed by interface (@guillaume-sainthillier)
[ad18d67] Improve phpdoc with generics (@guillaume-sainthillier)
[4f36812] Improve performance of Countr field by compiling the choice label template once (@guillaume-sainthillier)

New features

[8956734] Allow to use "id" in addition to "entityId" as the route placeholder (@javiereguiluz)

Bug fixes

[3fe4332] Fix sorting on embeddable (@javiereguiluz)
[4b246ce] Fix multiple click event listeners get added to delete buttons (@Deksor)
[661d593] Fix unwantted JavaScript validation outside of submitted form (@javiereguiluz)
[6f1b948] Fix an interface deprecation (@javiereguiluz)
[03cd95f] Avoid inline event handler in content search input (CSP issue) (@ERuban)
[839a878] Fixed Hungarian translations (@pwgen81)

Misc changes

[4dec4ed] Remove deprecated features (usePrettyUrls() method, and some cache keys in the admin route generator)

This is a security release. Upgrade as soon as possible. Before this fix, the custom-action route dispatcher could bypass the access_control rules defined in your Symfony security configuration.

Security fixes

[6228dfe] Re-validate access_control when dispatching custom-action routes (@javiereguiluz)

Full security advisory information:
GHSA-g2fm-8hr4-j82h

Bug fixes

[cc33b6a] Fix autocomplete ids with non-Symfony uid Doctrine types (e.g. ramsey/uuid-doctrine) (@bortomar)

Bug fixes

[54bb503] Avoid interdependent content_title and page_title Twig blocks (@MatTheCat)

ebd7e7a

New features

[ 3557ae7 ] Allow to customize the default row action click trigger ( @natepage )

Bug fixes

[ ab2a739 ] Fix translations domain for VichUploadBundle ( @theredled ) [ f0f111c ] Fix the Datetime filter for null value ( @macintoshplus ) [ 3b06649 ] Fix some filter conditions when using null values ( @javiereguiluz ) [ 00d294f ] Fix checkbox label condition to avoid rendering a label when explicitly set to false ( @dragosprotung ) [ c9113b0 ] Adding space above the header on the login page ( @axzx )

Misc changes

[ 0f6698f ] UpdatePHPDoc in Action::setHtmlAttributes (Matthieu Renard) [ 7ac96a7 ] Minor improvements in the login page design ( @javiereguiluz )

Contributors

javiereguiluz, macintoshplus, and 4 other contributors