Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-30770: Terminalfour 8.3.8 Release Notes

Terminalfour before 8.3.8 allows XSS, aka RDSM-31817. 8.2.18.2.1 and 8.2.18.5 are also fixed versions.

CVE
#xss#ios

General****Workflows

We received feedback about Workflow issues with multi-lingual Content Items, errors around rejection steps, and email functionality taking longer than it should. This release has over 20 fixes in place around the workflow functionality which should hopefully make things run smoother there.

A couple of highlights:

RDSM-29134

Approving Content Items in a Section Workflow configured to notify step moderators could be very slow. We’ve improved this by changing how those emails are queued and sent.

RDSM-31244

Previously if you modified and saved a Content Item where the reject settings were set to “Do nothing” and it had been already rejected in a Workflow, the Content Item did not re-enter or show up in the Workflow. That’s fixed up now.

RDSM-31306

There were problems with rejecting independent Media Items that entered a Workflow. This has been resolved now.

Performance

Moving mirrored sections - RDSM-25970

As always we’re still finding performance gains with each release. For this release our performance piece was around the time it takes to move a Mirrored Section. At a large scale (e.g. over 7000 Child Sections) this was very slow. With this update, the same action takes about 30% of the previous time, a welcome improvement.

Fixes of note

Accessibility and anchor tags - RDSM-31347

We made some adjustments to the meta_anchor T4 Tag with this release. Previously that tag would output an <a> tag like this:

<a id="d.en.10743"></a>

From an accessibility perspective, this isn’t great – it’s not a link and it’s not going anywhere – so we changed it from an <a> tag to a <span>. The linking functionality will work the same but the markup is better.

Duplicating/mirroring/moving content to a Section, content ordering is lost - RDSM-28606

As part of this release, we took a look at what is happening with ordering when content is mirrored/moved/duplicated. There were a few idiosyncrasies that we have ironed out now. For a view on the expected functionality see the new documentation.

Translating a List into another language - RDSM-26130

When you tried to translate a List you could end up on a blank screen. We had a workaround but it wasn’t user-friendly, so we’ve fixed the problem and you should be able to translate lists again.

Group names over 40 characters - RDSM-32481

Up until now, Group names had to be under 40 characters. Now that’s configurable from the database if it needs to be longer.

Content Syncer and extended user content type - RDSM-32242

We spotted a problem where the Content Syncer functionality was being blocked if the system had an extended user Content Type set. That’s been fixed up now.

Inactive Content Items that are made pending publish - RDSM-14098

This is an issue that’s worth keeping an eye out for as it’s been around for a while and may change current publish behavior on some older pages (albeit incorrect behavior). In this scenario, we’ve seen that content that was made inactive, then updated to be pending (not approved) could be published. We’ve put a fix in so in this situation only approved content will be published.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907