We have completed our updates to the 5.6.4.0 codebase for PHP 8.
We now have it running on PHP 8.5
We have also completed a comprehensive check and update of security vulnerabilities …
A short summary of the security work we just completed.
- CSRF protection — added and verified security tokens on vulnerable POST/action endpoints.
- Authorization & access-control audit — checked that dashboard/tools actions enforce the appropriate Concrete5 permissions before executing.
- User-management security — hardened bulk user actions, user search/access checks, and protected the current user/super user from inappropriate deletion.
- File Manager security — protected file operations including delete, file-set deletion, adding to sets, starring/favourites and remote-import related actions.
- Sitemap security — added/verified permission and token protection for sitemap updates, drag/move operations and related tools.
- Area/block security — protected area-menu reload and block-limit operations with appropriate tokens/permissions.
- Stacks security — secured stack reordering/move operations using tokens and
canMoveOrCopyPage()permission checks. - Page/version security — audited page/version operations and added appropriate
canRead()/permission gating where required. - Saved-search security — added CSRF/token validation to saved-search creation/deletion operations.
- XSS testing — tested stored-output handling, including the page-version-name test, and investigated the affected rendering path.
- Direct tool/end-point access — audited Concrete5
/tools/endpoints to prevent actions being performed simply by requesting the URL directly. - Input validation/sanitisation — strengthened handling of request parameters, IDs and missing/invalid values.