diff --git a/source/conf.py b/source/conf.py index f1ad8c241..30cfd210e 100644 --- a/source/conf.py +++ b/source/conf.py @@ -29,7 +29,7 @@ # The short X.Y version. version = u'current' # The full version, including alpha/beta/rc tags. -release = u'4.5.2' +release = u'4.6.0' # -- General configuration --------------------------------------------------- diff --git a/source/contribute/acknowledgements.rst b/source/contribute/acknowledgements.rst index 116188120..67f979cae 100644 --- a/source/contribute/acknowledgements.rst +++ b/source/contribute/acknowledgements.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.5.2 +:last-updated: 4.6.0 .. meta:: :description lang=en: diff --git a/source/index.rst b/source/index.rst index 79a7a0546..ad25072dc 100644 --- a/source/index.rst +++ b/source/index.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.5.2 +:last-updated: 4.6.0 ######################## CrafterCMS Documentation @@ -75,8 +75,8 @@ CrafterCMS is used by three main constituencies: ========================= Latest CrafterCMS Release ========================= -The latest community version of CrafterCMS is `4.5.2 `__ and the latest -enterprise version is ``4.5.2E``. +The latest community version of CrafterCMS is `4.6.0 `__ and the latest +enterprise version is ``4.6.0E``. Start exploring the latest version of CrafterCMS in a few minutes using Docker by simply running the following command: diff --git a/source/reference/api/search.rst b/source/reference/api/search.rst index 04f8d414b..cef64e91b 100644 --- a/source/reference/api/search.rst +++ b/source/reference/api/search.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.1.6 +:last-updated: 4.6.0 .. index:: Search, Query, OpenSearch, GraphQL @@ -377,7 +377,7 @@ Here's how the query will look like for the above image of a multi-index query f } ' -| +Note that the Site Search REST API ``POST /api/1/site/search/search.json`` rejects request bodies that contain restricted JSON object keys, including keys in nested objects and objects contained in arrays, with an HTTP 400 response. See :ref:`engine-search-restricted-key-patterns` for more information. See :base_url:`here <_static/api/engine.html#tag/search/operation/search>` for more information on the Crafter Engine API ``search``. diff --git a/source/reference/modules/engine.rst b/source/reference/modules/engine.rst index f7294a207..252c8301a 100644 --- a/source/reference/modules/engine.rst +++ b/source/reference/modules/engine.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.5.0 +:last-updated: 4.6.0 .. meta:: :description: Crafter Engine is the CrafterCMS content delivery module — serving REST, GraphQL, and FreeMarker-rendered content for web and mobile apps. @@ -729,6 +729,8 @@ In this section we will highlight some of the more commonly used properties in t - Allows you to set the content root folder * - :ref:`engine-turn-off-show-error` - Allows you to turn off showing errors in line with content + * - :ref:`engine-site-allowed-descriptor-paths` + - Allows you to configure allowed descriptor patterns used by ``SiteItemService`` * - :ref:`engine-http-response-headers` - Allows you to add headers to responses, such as caching policies * - :ref:`engine-url-rewrite-configuration` @@ -755,6 +757,8 @@ In this section we will highlight some of the more commonly used properties in t - Allows you to configure the search client connection timeout, socket timeout and number of threads * - :ref:`engine-search-default-filters` - Allows you to enable/disable default filters for search queries + * - :ref:`engine-search-restricted-key-patterns` + - Allows you to configure JSON keys that are not allowed in Site Search API request bodies * - :ref:`engine-search-connection-pool` - Allows you to configure the search connection pool max total connections and max connections per route * - :ref:`engine-content-length-headers` @@ -822,6 +826,38 @@ Templates in CrafterCMS will display the errors in line with content as they enc | +|hr| + +.. _engine-site-allowed-descriptor-paths: + +"""""""""""""""""""""""" +Allowed Descriptor Paths +"""""""""""""""""""""""" +.. version_tag:: + :label: Since + :version: 4.6.0 + +Crafter Engine limits which site URLs ``SiteItemService`` can return as content items. This is set with a +comma-separated list of regular expressions in the following property (default: ``/site/.*``): + +.. code-block:: properties + :caption: *CRAFTER_HOME/bin/apache-tomcat/shared/classes/crafter/engine/extension/server-config.properties* + + # List of regular expressions for the paths that are allowed to be used as descriptor paths (the SiteItemService will only return items from these paths) + crafter.engine.site.default.descriptors.allowed.paths=/site/.* + +``SiteItemService.getSiteItem(...)`` returns an item only when the item URL matches one of the patterns. +``SiteItemService.getSiteTree(...)`` includes only matching items in the tree. + +``SiteItemService.exists(path)`` is not limited by these patterns. It only checks whether the path is present in +the site content store. Engine configuration lookups use ``exists()`` and ``getRawContent()`` rather than +``getSiteItem()``, so configuration files outside the allowed descriptor paths can still be detected and read. + +If Groovy, Freemarker, or other Engine code calls ``getSiteItem`` or ``getSiteTree`` for paths outside the allowed +patterns, those calls receive ``null`` or an empty tree. To include extra descriptor locations, add more regexes to +the property. + + |hr| .. _engine-http-response-headers: @@ -1665,6 +1701,35 @@ To enable/disable the default filters for all queries, set the following: |hr| +.. _engine-search-restricted-key-patterns: + +""""""""""""""""""""""""""""""" +Search Restricted Key Patterns +""""""""""""""""""""""""""""""" +.. version_tag:: + :label: Since + :version: 4.6.0 + +The Site Search REST API (``POST /api/1/site/search/search.json``, and the legacy +``POST /api/1/site/elasticsearch/search.json``) rejects request bodies that contain restricted JSON object keys. + +Configure the restricted key patterns used by the Site Search REST API, using the ``crafter.engine.search.restricted.key.patterns`` property. The value is a comma-separated list of Java regular expressions with a default value of ``script``: + +.. code-block:: properties + :caption: *CRAFTER_HOME/bin/apache-tomcat/shared/classes/crafter/engine/extension/server-config.properties* + :linenos: + + # Comma-separated list of regex patterns for JSON keys that are not allowed in search requests + crafter.engine.search.restricted.key.patterns=script + + +The Site Search API checks the entire JSON payload, including nested objects and arrays, and evaluates object keys. +If there's a match, it returns a HTTP 400 with a message such as ``Search request must not contain a 'script' key``. + +| + +|hr| + .. _engine-content-length-headers: """""""""""""""""""""" diff --git a/source/release-notes/4-6-0.rst b/source/release-notes/4-6-0.rst new file mode 100644 index 000000000..9c639fc2f --- /dev/null +++ b/source/release-notes/4-6-0.rst @@ -0,0 +1,53 @@ +.. index:: CrafterCMS version 4.6.0 Release Notes + +----------------------------------- +CrafterCMS Version 4.6.0 and 4.6.0E +----------------------------------- + +Released *September TBD, 2026* + +.. important:: + + Please see :ref:`Breaking changes ` for breaking changes and other + things to consider before upgrading + + For instructions on how to update your CrafterCMS install, please see :ref:`upgrading-craftercms` + +^^^^^^^^^^^^ +Enhancements +^^^^^^^^^^^^ +* `Improved publishing `__ + + Publishing soft dependencies are limited to items the current user is allowed to publish. Items the user cannot publish are omitted from the soft dependency list when requesting to publish. + +* ``SiteItemService`` now returns items only for URLs that match the configured descriptor paths in ``crafter.engine.site.default.descriptors.allowed.paths``. + + See :ref:`engine-site-allowed-descriptor-paths` for more information. + +* The Site Search API now rejects restricted JSON keys in the request body. + + See :ref:`engine-search-restricted-key-patterns` for more information on configuring restricted key patterns. + +^^^^^^^^^ +Bug Fixes +^^^^^^^^^ +* `Fixed issue with Groovy based REST APIs defaulting to XML even when JSON extension is present `__ + + See :ref:`breaking-changes-in-craftercms-4-6-0` for some important changes to Engine REST scripts. + +^^^^^^^^^^^^^^^^^^ +Dependency Updates +^^^^^^^^^^^^^^^^^^ +* Noteworthy dependency updates: + + - Spring Framework to version 7.0.9 + - Spring Security to version 7.1.1 + - Spring Boot to version 4.1.1 + - Mybatis-Spring to version 4.1.0 + +For a complete list of community tickets, please visit: `GitHub 4.6.0 `_ + +For information on upgrading 3.1.x sites, see :ref:`here ` + +|hr| + diff --git a/source/release-notes/4-x-breaking-changes.rst b/source/release-notes/4-x-breaking-changes.rst index fe26a09f4..35e0acdd3 100644 --- a/source/release-notes/4-x-breaking-changes.rst +++ b/source/release-notes/4-x-breaking-changes.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.5.1 +:last-updated: 4.6.0 :orphan: .. _breaking-changes-4-x: @@ -23,6 +23,29 @@ before upgrading. Please review the following and apply changes as required: |hr| +.. _breaking-changes-in-craftercms-4-6-0: + +------------------------------------ +Breaking Changes in CrafterCMS 4.6.0 +------------------------------------ +* Groovy, Freemarker, or other Engine code that called ``siteItemService.getSiteItem(url)`` or ``getSiteTree(...)`` for paths outside the allowed descriptor patterns now receives null or an empty tree. To include extra descriptor locations, extend: + + ``crafter.engine.site.default.descriptors.allowed.paths=/site/.*`` + + See :ref:`engine-site-allowed-descriptor-paths` for more information. + +* Use ``siteItemService.exists(path)`` when you only need to know if a path exists. That check is not limited by the allowed-path patterns. + +* Search clients that send a script key (or any key matching ``crafter.engine.search.restricted.key.patterns``) in the JSON body will get 400 Bad Request. + + See :ref:`engine-search-restricted-key-patterns` for more information + +* Users without ``Publish`` permission on a related item will no longer see that item in the publish soft-dependency list. + +* Engine REST Scripts No Longer Produce XML. + + Clients that request XML via the ``Accept: application/xml`` header or a ``.xml`` URL will receive ``HTTP 406 Not Acceptable``. Update those clients to request JSON (``Accept: application/json`` or a ``.json`` URL) and parse JSON instead of XML. + .. _breaking-changes-in-craftercms-4-5-1: ------------------------------------ diff --git a/source/release-notes/index.rst b/source/release-notes/index.rst index d6aa813b9..a6da97f86 100644 --- a/source/release-notes/index.rst +++ b/source/release-notes/index.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.5.2 +:last-updated: 4.6.0 .. meta:: :description lang=en: @@ -15,6 +15,7 @@ version release's release notes page :ref:`below ` .. note:: CrafterCMS requires Java 21 +.. include:: /release-notes/4-6-0.rst .. include:: /release-notes/4-5-2.rst .. include:: /release-notes/4-5-1.rst .. include:: /release-notes/4-5-0.rst diff --git a/source/support.rst b/source/support.rst index 8f0d76870..401618687 100644 --- a/source/support.rst +++ b/source/support.rst @@ -1,5 +1,5 @@ :is-up-to-date: True -:last-updated: 4.5.2 +:last-updated: 4.6.0 .. meta:: :description lang=en: @@ -25,9 +25,14 @@ What's Supported? - Commercial Support - Latest - * - `4.5 `__ - - January 23, 2026 + * - `4.6 `__ + - September TBD, 2026 + - :green:`Active` - :green:`Active` + - 4.6.0 (September TBD, 2026) + * - 4.5 + - January 23, 2026 + - :maroon:`Ended on September TBD, 2026` - :green:`Active` - 4.5.2 (August 27, 2026) * - 4.4