Rename phar files on upload

Block access to all php and phar files that are uploaded into the media folder
Escape user-controlled element/collection names in CollectionElementDeleted log rendering
2026-07-30 13:11:39 +00:00 · 2026-06-07 20:45:43 +02:00 · 2026-06-07 20:40:15 +02:00 · 2026-06-07 18:04:40 +02:00 · 2026-06-07 14:11:53 +02:00 · 2026-06-07 14:08:48 +02:00
13 changed files with 171 additions and 140 deletions
--- a/.docker/frankenphp/Caddyfile
+++ b/.docker/frankenphp/Caddyfile
@ -51,5 +51,9 @@
 	# Disable Topics tracking if not enabled explicitly: https://github.com/jkarlin/topics
 	header ?Permissions-Policy "browsing-topics=()"

+	# Prevent PHP execution in the media upload directory
+	@php_in_media path_regexp (?i)^/media/.*\.(php[3-8]?|phar|phtml|pht|phps)$
+	respond @php_in_media 403
+
 	php_server
 }
--- a/.docker/symfony.conf
+++ b/.docker/symfony.conf
@ -15,6 +15,14 @@
            AllowOverride All
        </Directory>

+        # Prevent PHP execution in the media upload directory (server-level, not .htaccess,
+        # because public/media is a Docker volume and .htaccess there may not be present)
+        <Directory /var/www/html/public/media>
+            <FilesMatch "(?i)\.(php[3-8]?|phar|phtml|pht|phps)$">
+                Require all denied
+            </FilesMatch>
+        </Directory>
+
        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
--- a/composer.lock
+++ b/composer.lock
@ -976,16 +976,16 @@
        },
        {
            "name": "api-platform/doctrine-common",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/doctrine-common.git",
-                "reference": "089b196c2f8e4d14333aaa3c6db33356e8fd8be0"
+                "reference": "a342c7e4cd4a7545d355b8eaae6d2f46de4f8936"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/doctrine-common/zipball/089b196c2f8e4d14333aaa3c6db33356e8fd8be0",
-                "reference": "089b196c2f8e4d14333aaa3c6db33356e8fd8be0",
+                "url": "https://api.github.com/repos/api-platform/doctrine-common/zipball/a342c7e4cd4a7545d355b8eaae6d2f46de4f8936",
+                "reference": "a342c7e4cd4a7545d355b8eaae6d2f46de4f8936",
                "shasum": ""
            },
            "require": {
@ -1060,22 +1060,22 @@
                "rest"
            ],
            "support": {
-                "source": "https://github.com/api-platform/doctrine-common/tree/v4.3.7"
+                "source": "https://github.com/api-platform/doctrine-common/tree/v4.3.10"
            },
-            "time": "2026-05-04T13:25:58+00:00"
+            "time": "2026-06-05T09:05:29+00:00"
        },
        {
            "name": "api-platform/doctrine-orm",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/doctrine-orm.git",
-                "reference": "095a4c56cdd9986208100dedd5d28be50a4830ba"
+                "reference": "db75bac977cc9fe76cee90c1e5361c744cfa2144"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/doctrine-orm/zipball/095a4c56cdd9986208100dedd5d28be50a4830ba",
-                "reference": "095a4c56cdd9986208100dedd5d28be50a4830ba",
+                "url": "https://api.github.com/repos/api-platform/doctrine-orm/zipball/db75bac977cc9fe76cee90c1e5361c744cfa2144",
+                "reference": "db75bac977cc9fe76cee90c1e5361c744cfa2144",
                "shasum": ""
            },
            "require": {
@ -1149,13 +1149,13 @@
                "rest"
            ],
            "support": {
-                "source": "https://github.com/api-platform/doctrine-orm/tree/v4.3.7"
+                "source": "https://github.com/api-platform/doctrine-orm/tree/v4.3.10"
            },
-            "time": "2026-05-07T11:45:31+00:00"
+            "time": "2026-06-04T13:58:17+00:00"
        },
        {
            "name": "api-platform/documentation",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/documentation.git",
@ -1212,22 +1212,22 @@
            ],
            "description": "API Platform documentation controller.",
            "support": {
-                "source": "https://github.com/api-platform/documentation/tree/v4.3.7"
+                "source": "https://github.com/api-platform/documentation/tree/v4.3.10"
            },
            "time": "2026-04-30T12:21:24+00:00"
        },
        {
            "name": "api-platform/http-cache",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/http-cache.git",
-                "reference": "dd7c092b9abee06e72fd58544fe714b6c2a61efa"
+                "reference": "98e5ba9344abe9db7d6789429745ee4eb0a2fd8f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/http-cache/zipball/dd7c092b9abee06e72fd58544fe714b6c2a61efa",
-                "reference": "dd7c092b9abee06e72fd58544fe714b6c2a61efa",
+                "url": "https://api.github.com/repos/api-platform/http-cache/zipball/98e5ba9344abe9db7d6789429745ee4eb0a2fd8f",
+                "reference": "98e5ba9344abe9db7d6789429745ee4eb0a2fd8f",
                "shasum": ""
            },
            "require": {
@ -1292,22 +1292,22 @@
                "rest"
            ],
            "support": {
-                "source": "https://github.com/api-platform/http-cache/tree/v4.3.7"
+                "source": "https://github.com/api-platform/http-cache/tree/v4.3.10"
            },
-            "time": "2026-04-30T12:21:24+00:00"
+            "time": "2026-05-29T13:58:43+00:00"
        },
        {
            "name": "api-platform/hydra",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/hydra.git",
-                "reference": "317a696e396b80ba87de2560679c362923ef0a14"
+                "reference": "a0314c8dda95f69f15054d7309ddbc1ca32f2149"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/hydra/zipball/317a696e396b80ba87de2560679c362923ef0a14",
-                "reference": "317a696e396b80ba87de2560679c362923ef0a14",
+                "url": "https://api.github.com/repos/api-platform/hydra/zipball/a0314c8dda95f69f15054d7309ddbc1ca32f2149",
+                "reference": "a0314c8dda95f69f15054d7309ddbc1ca32f2149",
                "shasum": ""
            },
            "require": {
@ -1379,29 +1379,29 @@
                "rest"
            ],
            "support": {
-                "source": "https://github.com/api-platform/hydra/tree/v4.3.7"
+                "source": "https://github.com/api-platform/hydra/tree/v4.3.10"
            },
-            "time": "2026-05-11T11:50:19+00:00"
+            "time": "2026-06-04T13:52:24+00:00"
        },
        {
            "name": "api-platform/json-api",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/json-api.git",
-                "reference": "b275e45653f693427e38b53b195a6cdab890418b"
+                "reference": "2e1773bc4b098119531c59de14124afa0cb693a2"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/json-api/zipball/b275e45653f693427e38b53b195a6cdab890418b",
-                "reference": "b275e45653f693427e38b53b195a6cdab890418b",
+                "url": "https://api.github.com/repos/api-platform/json-api/zipball/2e1773bc4b098119531c59de14124afa0cb693a2",
+                "reference": "2e1773bc4b098119531c59de14124afa0cb693a2",
                "shasum": ""
            },
            "require": {
                "api-platform/documentation": "^4.3",
                "api-platform/json-schema": "^4.3",
                "api-platform/metadata": "^4.3",
-                "api-platform/serializer": "^4.3",
+                "api-platform/serializer": "^4.3.8",
                "api-platform/state": "^4.3",
                "php": ">=8.2",
                "symfony/error-handler": "^6.4 || ^7.0 || ^8.0",
@ -1461,22 +1461,22 @@
                "rest"
            ],
            "support": {
-                "source": "https://github.com/api-platform/json-api/tree/v4.3.7"
+                "source": "https://github.com/api-platform/json-api/tree/v4.3.10"
            },
-            "time": "2026-05-25T06:50:22+00:00"
+            "time": "2026-06-05T15:17:34+00:00"
        },
        {
            "name": "api-platform/json-schema",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/json-schema.git",
-                "reference": "23dc2c388a08f2006b9189a0883a08f8837d7249"
+                "reference": "6a0a2ddc4914bb1fdb1b71777c49aef388f6ea31"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/json-schema/zipball/23dc2c388a08f2006b9189a0883a08f8837d7249",
-                "reference": "23dc2c388a08f2006b9189a0883a08f8837d7249",
+                "url": "https://api.github.com/repos/api-platform/json-schema/zipball/6a0a2ddc4914bb1fdb1b71777c49aef388f6ea31",
+                "reference": "6a0a2ddc4914bb1fdb1b71777c49aef388f6ea31",
                "shasum": ""
            },
            "require": {
@ -1542,13 +1542,13 @@
                "swagger"
            ],
            "support": {
-                "source": "https://github.com/api-platform/json-schema/tree/v4.3.7"
+                "source": "https://github.com/api-platform/json-schema/tree/v4.3.10"
            },
-            "time": "2026-04-30T12:21:24+00:00"
+            "time": "2026-06-03T14:46:27+00:00"
        },
        {
            "name": "api-platform/jsonld",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/jsonld.git",
@ -1622,22 +1622,22 @@
                "rest"
            ],
            "support": {
-                "source": "https://github.com/api-platform/jsonld/tree/v4.3.7"
+                "source": "https://github.com/api-platform/jsonld/tree/v4.3.10"
            },
            "time": "2026-04-30T12:21:24+00:00"
        },
        {
            "name": "api-platform/metadata",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/metadata.git",
-                "reference": "2272ab2bc4f1c8e4e3ae358952ed15c09830bd3b"
+                "reference": "b835ce534861f9e7b2a316fa582f28afe4ad5fe6"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/metadata/zipball/2272ab2bc4f1c8e4e3ae358952ed15c09830bd3b",
-                "reference": "2272ab2bc4f1c8e4e3ae358952ed15c09830bd3b",
+                "url": "https://api.github.com/repos/api-platform/metadata/zipball/b835ce534861f9e7b2a316fa582f28afe4ad5fe6",
+                "reference": "b835ce534861f9e7b2a316fa582f28afe4ad5fe6",
                "shasum": ""
            },
            "require": {
@ -1720,22 +1720,22 @@
                "swagger"
            ],
            "support": {
-                "source": "https://github.com/api-platform/metadata/tree/v4.3.7"
+                "source": "https://github.com/api-platform/metadata/tree/v4.3.10"
            },
-            "time": "2026-05-28T13:34:59+00:00"
+            "time": "2026-06-05T09:05:29+00:00"
        },
        {
            "name": "api-platform/openapi",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/openapi.git",
-                "reference": "1562617e7500a50c2b6e6f43a0fb29a6a47e83a2"
+                "reference": "21e22f4d74fafc4b01ee5790be7a264387445dcf"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/openapi/zipball/1562617e7500a50c2b6e6f43a0fb29a6a47e83a2",
-                "reference": "1562617e7500a50c2b6e6f43a0fb29a6a47e83a2",
+                "url": "https://api.github.com/repos/api-platform/openapi/zipball/21e22f4d74fafc4b01ee5790be7a264387445dcf",
+                "reference": "21e22f4d74fafc4b01ee5790be7a264387445dcf",
                "shasum": ""
            },
            "require": {
@ -1811,22 +1811,22 @@
                "swagger"
            ],
            "support": {
-                "source": "https://github.com/api-platform/openapi/tree/v4.3.7"
+                "source": "https://github.com/api-platform/openapi/tree/v4.3.10"
            },
-            "time": "2026-04-30T12:21:24+00:00"
+            "time": "2026-06-03T14:37:29+00:00"
        },
        {
            "name": "api-platform/serializer",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/serializer.git",
-                "reference": "2c4f996bb6e5fef49106df0c48d0c1954e10998b"
+                "reference": "04d56abff2910390111613716cd75796f23e34d5"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/serializer/zipball/2c4f996bb6e5fef49106df0c48d0c1954e10998b",
-                "reference": "2c4f996bb6e5fef49106df0c48d0c1954e10998b",
+                "url": "https://api.github.com/repos/api-platform/serializer/zipball/04d56abff2910390111613716cd75796f23e34d5",
+                "reference": "04d56abff2910390111613716cd75796f23e34d5",
                "shasum": ""
            },
            "require": {
@ -1905,22 +1905,22 @@
                "serializer"
            ],
            "support": {
-                "source": "https://github.com/api-platform/serializer/tree/v4.3.7"
+                "source": "https://github.com/api-platform/serializer/tree/v4.3.10"
            },
-            "time": "2026-05-12T10:07:44+00:00"
+            "time": "2026-06-05T12:07:51+00:00"
        },
        {
            "name": "api-platform/state",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/state.git",
-                "reference": "6e3f6d75e605ba7171a7590c82da5126979a936b"
+                "reference": "06067bf0efae09badc618fac8add67191f12f1e3"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/state/zipball/6e3f6d75e605ba7171a7590c82da5126979a936b",
-                "reference": "6e3f6d75e605ba7171a7590c82da5126979a936b",
+                "url": "https://api.github.com/repos/api-platform/state/zipball/06067bf0efae09badc618fac8add67191f12f1e3",
+                "reference": "06067bf0efae09badc618fac8add67191f12f1e3",
                "shasum": ""
            },
            "require": {
@ -2002,22 +2002,22 @@
                "swagger"
            ],
            "support": {
-                "source": "https://github.com/api-platform/state/tree/v4.3.7"
+                "source": "https://github.com/api-platform/state/tree/v4.3.10"
            },
-            "time": "2026-05-22T12:02:28+00:00"
+            "time": "2026-06-05T15:16:47+00:00"
        },
        {
            "name": "api-platform/symfony",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/symfony.git",
-                "reference": "2660c6a24915b0302243ef30a77f6531b2f846a9"
+                "reference": "70a1a4468d77c9761ac1a6cba681277fa986c39b"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/api-platform/symfony/zipball/2660c6a24915b0302243ef30a77f6531b2f846a9",
-                "reference": "2660c6a24915b0302243ef30a77f6531b2f846a9",
+                "url": "https://api.github.com/repos/api-platform/symfony/zipball/70a1a4468d77c9761ac1a6cba681277fa986c39b",
+                "reference": "70a1a4468d77c9761ac1a6cba681277fa986c39b",
                "shasum": ""
            },
            "require": {
@ -2131,13 +2131,13 @@
                "symfony"
            ],
            "support": {
-                "source": "https://github.com/api-platform/symfony/tree/v4.3.7"
+                "source": "https://github.com/api-platform/symfony/tree/v4.3.10"
            },
-            "time": "2026-05-29T07:06:36+00:00"
+            "time": "2026-06-05T15:17:34+00:00"
        },
        {
            "name": "api-platform/validator",
-            "version": "v4.3.7",
+            "version": "v4.3.10",
            "source": {
                "type": "git",
                "url": "https://github.com/api-platform/validator.git",
@ -2207,7 +2207,7 @@
                "validator"
            ],
            "support": {
-                "source": "https://github.com/api-platform/validator/tree/v4.3.7"
+                "source": "https://github.com/api-platform/validator/tree/v4.3.10"
            },
            "time": "2026-05-07T11:45:31+00:00"
        },
@ -5030,16 +5030,16 @@
        },
        {
            "name": "imagine/imagine",
-            "version": "1.5.3",
+            "version": "1.5.4",
            "source": {
                "type": "git",
                "url": "https://github.com/php-imagine/Imagine.git",
-                "reference": "8bc9773b65d123930efe82f89320f248a739ffbf"
+                "reference": "dd57a4c290ff4d223d17bcd219dac9ac8bf1cc16"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/php-imagine/Imagine/zipball/8bc9773b65d123930efe82f89320f248a739ffbf",
-                "reference": "8bc9773b65d123930efe82f89320f248a739ffbf",
+                "url": "https://api.github.com/repos/php-imagine/Imagine/zipball/dd57a4c290ff4d223d17bcd219dac9ac8bf1cc16",
+                "reference": "dd57a4c290ff4d223d17bcd219dac9ac8bf1cc16",
                "shasum": ""
            },
            "require": {
@ -5086,9 +5086,9 @@
            ],
            "support": {
                "issues": "https://github.com/php-imagine/Imagine/issues",
-                "source": "https://github.com/php-imagine/Imagine/tree/1.5.3"
+                "source": "https://github.com/php-imagine/Imagine/tree/1.5.4"
            },
-            "time": "2026-06-03T10:24:10+00:00"
+            "time": "2026-06-04T10:05:48+00:00"
        },
        {
            "name": "jbtronics/2fa-webauthn",
@ -8960,16 +8960,16 @@
        },
        {
            "name": "phpoffice/phpspreadsheet",
-            "version": "5.7.0",
+            "version": "5.8.0",
            "source": {
                "type": "git",
                "url": "https://github.com/PHPOffice/PhpSpreadsheet.git",
-                "reference": "9f55d3b9b7bcb1084fda8340e4b7ce4ed10cd0c8"
+                "reference": "01964d92536edf1a3a874b9580a52824bebf6fbb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/PHPOffice/PhpSpreadsheet/zipball/9f55d3b9b7bcb1084fda8340e4b7ce4ed10cd0c8",
-                "reference": "9f55d3b9b7bcb1084fda8340e4b7ce4ed10cd0c8",
+                "url": "https://api.github.com/repos/PHPOffice/PhpSpreadsheet/zipball/01964d92536edf1a3a874b9580a52824bebf6fbb",
+                "reference": "01964d92536edf1a3a874b9580a52824bebf6fbb",
                "shasum": ""
            },
            "require": {
@ -9063,9 +9063,9 @@
            ],
            "support": {
                "issues": "https://github.com/PHPOffice/PhpSpreadsheet/issues",
-                "source": "https://github.com/PHPOffice/PhpSpreadsheet/tree/5.7.0"
+                "source": "https://github.com/PHPOffice/PhpSpreadsheet/tree/5.8.0"
            },
-            "time": "2026-04-20T02:42:17+00:00"
+            "time": "2026-06-07T03:51:10+00:00"
        },
        {
            "name": "phpstan/phpdoc-parser",
@ -10555,16 +10555,16 @@
        },
        {
            "name": "spomky-labs/otphp",
-            "version": "11.4.3",
+            "version": "11.5.0",
            "source": {
                "type": "git",
                "url": "https://github.com/Spomky-Labs/otphp.git",
-                "reference": "46663316285bf1f001a31584213b327494b00ae7"
+                "reference": "877683d6352b80cdc7020fd43a725629c2524435"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/Spomky-Labs/otphp/zipball/46663316285bf1f001a31584213b327494b00ae7",
-                "reference": "46663316285bf1f001a31584213b327494b00ae7",
+                "url": "https://api.github.com/repos/Spomky-Labs/otphp/zipball/877683d6352b80cdc7020fd43a725629c2524435",
+                "reference": "877683d6352b80cdc7020fd43a725629c2524435",
                "shasum": ""
            },
            "require": {
@ -10609,7 +10609,7 @@
            ],
            "support": {
                "issues": "https://github.com/Spomky-Labs/otphp/issues",
-                "source": "https://github.com/Spomky-Labs/otphp/tree/11.4.3"
+                "source": "https://github.com/Spomky-Labs/otphp/tree/11.5.0"
            },
            "funding": [
                {
@ -10621,7 +10621,7 @@
                    "type": "patreon"
                }
            ],
-            "time": "2026-05-31T12:42:43+00:00"
+            "time": "2026-06-06T23:41:24+00:00"
        },
        {
            "name": "spomky-labs/pki-framework",
@ -19429,11 +19429,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.2.1",
+            "version": "2.2.2",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/dea9c8f2d25cc849391042b71e429c1a4bf82660",
-                "reference": "dea9c8f2d25cc849391042b71e429c1a4bf82660",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
+                "reference": "e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
                "shasum": ""
            },
            "require": {
@ -19489,7 +19489,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-28T14:44:12+00:00"
+            "time": "2026-06-05T09:00:01+00:00"
        },
        {
            "name": "phpstan/phpstan-doctrine",
@ -20216,12 +20216,12 @@
            "source": {
                "type": "git",
                "url": "https://github.com/Roave/SecurityAdvisories.git",
-                "reference": "79d4585eac9c287effcdf55a21c2ae7315fae84e"
+                "reference": "b000295a5fd02609ee7ad31d084cfa904af8a69a"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/79d4585eac9c287effcdf55a21c2ae7315fae84e",
-                "reference": "79d4585eac9c287effcdf55a21c2ae7315fae84e",
+                "url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/b000295a5fd02609ee7ad31d084cfa904af8a69a",
+                "reference": "b000295a5fd02609ee7ad31d084cfa904af8a69a",
                "shasum": ""
            },
            "conflict": {
@ -20284,7 +20284,7 @@
                "azuracast/azuracast": "<=0.23.5",
                "b13/seo_basics": "<0.8.2",
                "backdrop/backdrop": "<=1.32",
-                "backpack/crud": "<3.4.9",
+                "backpack/crud": "<4.0.63|>=4.1,<4.1.69|>=5,<5.0.13",
                "backpack/filemanager": "<2.0.2|>=3,<3.0.9",
                "bacula-web/bacula-web": "<9.7.1",
                "badaso/core": "<=2.9.11",
@ -20301,6 +20301,7 @@
                "bedita/bedita": "<4",
                "bednee/cooluri": "<1.0.30",
                "bigfork/silverstripe-form-capture": ">=3,<3.1.1",
+                "billabear/billabear": "<=2025.01.03",
                "billz/raspap-webgui": "<3.3.6",
                "binarytorch/larecipe": "<2.8.1",
                "bk2k/bootstrap-package": ">=7.1,<7.1.2|>=8,<8.0.8|>=9,<9.0.4|>=9.1,<9.1.3|>=10,<10.0.10|>=11,<11.0.3",
@ -20425,7 +20426,7 @@
                "drupal/commerce_alphabank_redirect": "<1.0.3",
                "drupal/commerce_eurobank_redirect": "<2.1.1",
                "drupal/config_split": "<1.10|>=2,<2.0.2",
-                "drupal/core": ">=6,<6.38|>=7,<7.103|>=8,<10.4.9|>=10.5,<10.5.6|>=11,<11.1.9|>=11.2,<11.2.8",
+                "drupal/core": ">=6,<6.38|>=7,<7.103|>=8,<10.5.9|>=10.6,<10.6.7|>=11,<11.2.11|>=11.3,<11.3.7",
                "drupal/core-recommended": ">=7,<7.102|>=8,<10.2.11|>=10.3,<10.3.9|>=11,<11.0.8",
                "drupal/currency": "<3.5",
                "drupal/drupal": ">=5,<5.11|>=6,<6.38|>=7,<7.102|>=8,<10.2.11|>=10.3,<10.3.9|>=11,<11.0.8",
@ -20452,7 +20453,7 @@
                "drupal/umami_analytics": "<1.0.1",
                "duncanmcclean/guest-entries": "<3.1.2",
                "dweeves/magmi": "<=0.7.24",
-                "easycorp/easyadmin-bundle": ">=4,<4.29.10|>=5,<5.0.10",
+                "easycorp/easyadmin-bundle": ">=4,<4.29.10|>=5,<5.0.13",
                "ec-cube/ec-cube": "<2.4.4|>=2.11,<=2.17.1|>=3,<=3.0.18.0-patch4|>=4,<=4.3.1",
                "ecodev/newsletter": "<=4",
                "ectouch/ectouch": "<=2.7.2",
@ -20536,7 +20537,7 @@
                "friendsoftypo3/tt-address": "<8.1.2|>=9,<9.1.1|>=10,<10.0.1",
                "froala/wysiwyg-editor": "<=4.3",
                "frosh/adminer-platform": "<2.2.1",
-                "froxlor/froxlor": "<=2.3.6",
+                "froxlor/froxlor": "<2.3.7",
                "frozennode/administrator": "<=5.0.12",
                "fuel/core": "<1.8.1",
                "funadmin/funadmin": "<=7.1.0.0-RC6",
@ -20943,8 +20944,8 @@
                "sheng/yiicms": "<1.2.1",
                "shopper/cart": "<2.8",
                "shopper/framework": "<2.8",
-                "shopware/core": "<6.6.10.15-dev|>=6.7,<6.7.8.1-dev",
-                "shopware/platform": "<6.6.10.15-dev|>=6.7,<6.7.8.1-dev",
+                "shopware/core": "<6.6.10.18-dev|>=6.7,<6.7.10.1-dev",
+                "shopware/platform": "<6.6.10.18-dev|>=6.7,<6.7.10.1-dev",
                "shopware/production": "<=6.3.5.2",
                "shopware/shopware": "<=5.7.17|>=6.4.6,<6.6.10.10-dev|>=6.7,<6.7.6.1-dev",
                "shopware/storefront": "<6.6.10.10-dev|>=6.7,<6.7.5.1-dev",
@ -21096,7 +21097,7 @@
                "thorsten/phpmyfaq": "<4.1.3",
                "tikiwiki/tiki-manager": "<=17.1",
                "timber/timber": ">=0.16.6,<1.23.1|>=1.24,<1.24.1|>=2,<2.1",
-                "tinymce/tinymce": "<7.2",
+                "tinymce/tinymce": "<7.9.3|>=8,<8.5.1",
                "tinymighty/wiki-seo": "<1.2.2",
                "titon/framework": "<9.9.99",
                "tltneon/lgsl": "<7",
@ -21299,7 +21300,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-06-03T13:43:23+00:00"
+            "time": "2026-06-05T20:39:10+00:00"
        },
        {
            "name": "sebastian/cli-parser",
--- a/config/reference.php
+++ b/config/reference.php
@ -2436,6 +2436,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *     },
 *     jsonapi?: array{
 *         use_iri_as_id?: bool|Param, // Set to false to use entity identifiers instead of IRIs as the "id" field in JSON:API responses. // Default: true
+ *         allow_client_generated_id?: bool|Param, // Allow client-generated IDs on JSON:API POST per https://jsonapi.org/format/#crud-creating-client-ids. Off by default to prevent id spoofing on public endpoints. // Default: false
 *     },
 *     eager_loading?: bool|array{
 *         enabled?: bool|Param, // Default: true
--- a/docs/installation/nginx.md
+++ b/docs/installation/nginx.md
@ -52,6 +52,11 @@ server {
    location ~ \.php$ {
        return 404;
    }
+
+    # Prevent PHP execution in the media upload directory
+    location ~* ^/media/.*\.(php[3-8]?|phar|phtml|pht|phps)$ {
+        return 403;
+    }
    
    # Set Content-Security-Policy for svg files, to block embedded javascript in there
    location ~* \.svg$ {
--- a/public/kicad/footprints.txt
+++ b/public/kicad/footprints.txt
@ -1,4 +1,4 @@
-# Generated on Mon May 25 06:41:46 UTC 2026
+# Generated on Mon Jun  1 07:07:44 UTC 2026
 # This file contains all footprints available in the offical KiCAD library
 Audio_Module:Reverb_BTDR-1H
 Audio_Module:Reverb_BTDR-1V
--- a/public/kicad/symbols.txt
+++ b/public/kicad/symbols.txt
@ -1,4 +1,4 @@
-# Generated on Mon May 25 06:42:27 UTC 2026
+# Generated on Mon Jun  1 07:08:24 UTC 2026
 # This file contains all symbols available in the offical KiCAD library
 4xxx:14528
 4xxx:14529
@ -2255,11 +2255,11 @@ Battery_Management:BQ76200PW
 Battery_Management:BQ76920PW
 Battery_Management:BQ76930DBT
 Battery_Management:BQ76940DBT
-Battery_Management:BQ7695201PFBR
-Battery_Management:BQ7695202PFBR
-Battery_Management:BQ7695203PFBR
-Battery_Management:BQ7695204PFBR
-Battery_Management:BQ76952PFBR
+Battery_Management:BQ7695201PFB
+Battery_Management:BQ7695202PFB
+Battery_Management:BQ7695203PFB
+Battery_Management:BQ7695204PFB
+Battery_Management:BQ76952PFB
 Battery_Management:BQ78350DBT
 Battery_Management:BQ78350DBT-R1
 Battery_Management:CN3063
@ -16037,6 +16037,7 @@ Power_Supervisor:TPS3831
 Power_Supervisor:TPS3839DBZ
 Power_Supervisor:TPS3839DQN
 RF:0900PC15J0013
+RF:AD8302xRU
 RF:ADC-10-1R
 RF:ADCH-80
 RF:ADCH-80A
--- a/public/media/.gitignore
+++ b/public/media/.gitignore
@ -1,3 +1,4 @@
 # Ignore everything except this .gitignore
 *
-!.gitignore
+!.gitignore
+!.htaccess
--- a/public/media/.htaccess
+++ b/public/media/.htaccess
@ -0,0 +1,10 @@
+# Deny access to PHP and PHP-like files to prevent remote code execution
+<FilesMatch "(?i)\.(php[3-8]?|phar|phtml|pht|phps)$">
+    <IfModule mod_authz_core.c>
+        Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order deny,allow
+        Deny from all
+    </IfModule>
+</FilesMatch>
--- a/src/Controller/PartImportExportController.php
+++ b/src/Controller/PartImportExportController.php
@ -90,7 +90,7 @@ class PartImportExportController extends AbstractController
                goto ret;
            }

-            if (!isset($errors) || $errors) {
+            if (!isset($errors) || $errors) { //@phpstan-ignore-line
                $this->addFlash('error', 'parts.import.flash.error');
            } else {
                $this->addFlash('success', 'parts.import.flash.success');
--- a/src/Services/Attachments/AttachmentSubmitHandler.php
+++ b/src/Services/Attachments/AttachmentSubmitHandler.php
@ -69,7 +69,7 @@ class AttachmentSubmitHandler

    protected const BLACKLISTED_EXTENSIONS = ['php', 'phtml', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'phtm', 'sh',
        'asp', 'cgi', 'py', 'pl', 'exe', 'aspx', 'js', 'mjs', 'jsp', 'css', 'jar', 'html', 'htm', 'shtm', 'shtml', 'htaccess',
-        'htpasswd', ''];
+        'htpasswd', 'phar', 'phps', ''];

    public function __construct(
        protected AttachmentPathResolver $pathResolver,
--- a/src/Services/LogSystem/LogEntryExtraFormatter.php
+++ b/src/Services/LogSystem/LogEntryExtraFormatter.php
@ -169,8 +169,8 @@ class LogEntryExtraFormatter
            $array['log.collection_deleted.deleted'] = sprintf(
                '%s: %s (%s)',
                $this->elementTypeNameGenerator->getLocalizedTypeLabel($context->getDeletedElementClass()),
-                $context->getOldName() ?? (string) $context->getDeletedElementID(),
-                $context->getCollectionName()
+                htmlspecialchars($context->getOldName() ?? (string) $context->getDeletedElementID()),
+                htmlspecialchars($context->getCollectionName())
            );
        }

@ -218,4 +218,4 @@ class LogEntryExtraFormatter

        return implode(', ', $output);
    }
-}
+}
--- a/yarn.lock
+++ b/yarn.lock
@ -1887,9 +1887,9 @@
  integrity sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==

 "@types/node@*":
-  version "25.9.1"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-25.9.1.tgz#3bda556db500ae4319c08e7fc9ab94f19013ba0b"
-  integrity sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==
+  version "25.9.2"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-25.9.2.tgz#fc8958e757994b71fee516f9634bdb03d1b19e9f"
+  integrity sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw==
  dependencies:
    undici-types ">=7.24.0 <7.24.7"

@ -2223,9 +2223,9 @@ base64-js@^1.1.2, base64-js@^1.3.0:
  integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==

 baseline-browser-mapping@^2.10.12:
-  version "2.10.33"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.33.tgz#27c299b096404978831958d429f48390424c4f9b"
-  integrity sha512-bA6+tcSLpz2tIEdDXZPpPTIuxBcC4+w6SieaYyfigIa4h8GlFxbA17v22Vx3JUtuZQj9SgOsnbK+aTBzyDyEuw==
+  version "2.10.34"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.34.tgz#dedb606362446777cfe328d30d4ee15056d06303"
+  integrity sha512-IMDedajPifLnHNY0X9n8hKxRTQ6/eTHwr5bDo04WnuqxyKw6LYtQywCuuqPZwhl3aBXMvQpJov42GLCwRRdQzw==

 big.js@^5.2.2:
  version "5.2.2"
@ -2310,9 +2310,9 @@ caniuse-api@^3.0.0:
    lodash.uniq "^4.5.0"

 caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001782:
-  version "1.0.30001793"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz#238887ddf5fcfc8c36d872394d0a78a517312a72"
-  integrity sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==
+  version "1.0.30001797"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001797.tgz#1332709e1439f01ff92085dd17001e0a45897ec0"
+  integrity sha512-l8xKG+gwAIExZGl9FrF7KUwuOmk6wbEPC9Xoy/RtnWv1XG0Q4LFlagaLpUv3Kiza3W/wm27zy0yWJEieYKAP6w==

 ccount@^2.0.0:
  version "2.0.1"
@ -2902,9 +2902,9 @@ domutils@^3.0.1:
    domhandler "^5.0.3"

 electron-to-chromium@^1.5.328:
-  version "1.5.366"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.366.tgz#54cfb4090db768d58dce9ef5a2f8b837e61ebe6b"
-  integrity sha512-OlRuhb688YTCzzU3gXPLn6nGyd+F+53INE1qaKKlu6kETErE8FYsyDh0XqXEU+uBRn0MpCzz2vfNwORhkap8qg==
+  version "1.5.368"
+  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.368.tgz#8e8d4600c5f5f01e891f8f843b4a941afb640412"
+  integrity sha512-7RckJJK4uESJF9PxvfMWd3TGqIiieUTG4HxnKaKuIpGbcr+r2ZEB3g2gAhCP3Fqm42vJSzLfgab9eva/C4/XVw==

 emoji-regex@^8.0.0:
  version "8.0.0"
@ -2917,9 +2917,9 @@ emojis-list@^3.0.0:
  integrity sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==

 enhanced-resolve@^5.0.0, enhanced-resolve@^5.22.0:
-  version "5.22.2"
-  resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.22.2.tgz#b8ff1a9207130b9f5497031ec68d9acb040656e9"
-  integrity sha512-0rxICaFZ7NQho/sHely2bvOPRP0Eu2B0NZ9zM54YvRvWMn7jfz3DmnOZDR9LlXDdDcqntAVc6Hfy4gr/tdH/Ag==
+  version "5.23.0"
+  resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.23.0.tgz#dfdf8d1c9065e4b52f8a598356138931c07305f9"
+  integrity sha512-yJN/BOOLxcOW2aQgeif9mSnaUB8KtvmMMp56oA1kx1CRfBKbhZm2pJ+NBY+3eOboHxix8lfjWpHE0Ei5U8RbSA==
  dependencies:
    graceful-fs "^4.2.4"
    tapable "^2.3.3"
@ -3587,9 +3587,9 @@ marked-mangle@^1.0.1:
  integrity sha512-phz1W/nYMr1T08Q7wqH2aj+PPiK85E69WQGfId+prvryfgjY/Idibx4YUvKaYMDV9rK1qo+/yC+Quu/3gdaBeA==

 marked@^18.0.0:
-  version "18.0.4"
-  resolved "https://registry.yarnpkg.com/marked/-/marked-18.0.4.tgz#7a54421f506c8729db32f852719972d2f939a77b"
-  integrity sha512-c/BTaKzg0G6ezQx97DAkYU7k0HM6ys0FqYeKBL6hlBByZwy+ycA1+f0vDdjMHKKeEjdgkx0GOv9Il6D+85cOqA==
+  version "18.0.5"
+  resolved "https://registry.yarnpkg.com/marked/-/marked-18.0.5.tgz#c229c0ac6ad1e275ae8e5037c6168f76d2f42e61"
+  integrity sha512-S6GcvALHg6K4ohtu4E7x0a1AqhAjp6cV8KhLSyN9qVapnzJkusVBxZRcIU9AeYsbe6P1hKDusSbEOzGyyuce6w==

 mdast-util-find-and-replace@^3.0.0:
  version "3.0.2"
@ -4733,9 +4733,9 @@ semver@^6.3.1:
  integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==

 semver@^7.3.2, semver@^7.3.4, semver@^7.6.3:
-  version "7.8.1"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.1.tgz#bf4970b5e70fda0686363cc18bfe8805d5ed957e"
-  integrity sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==
+  version "7.8.2"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.2.tgz#194bd65723a28cf82542d2bf176b91c26b343be1"
+  integrity sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==

 serialize-javascript@^6.0.2:
  version "6.0.2"
Author	SHA1	Message	Date
Jan Böhmer	c229208bd5	Rename phar files on upload Some checks are pending Build assets artifact / Build assets artifact (push) Waiting to run Details Docker Image Build / build (linux/amd64, amd64, ubuntu-latest) (push) Waiting to run Details Docker Image Build / build (linux/arm/v7, armv7, ubuntu-24.04-arm) (push) Waiting to run Details Docker Image Build / build (linux/arm64, arm64, ubuntu-24.04-arm) (push) Waiting to run Details Docker Image Build / merge (push) Blocked by required conditions Details Docker Image Build (FrankenPHP) / build (linux/amd64, amd64, ubuntu-latest) (push) Waiting to run Details Docker Image Build (FrankenPHP) / build (linux/arm/v7, armv7, ubuntu-24.04-arm) (push) Waiting to run Details Docker Image Build (FrankenPHP) / build (linux/arm64, arm64, ubuntu-24.04-arm) (push) Waiting to run Details Docker Image Build (FrankenPHP) / merge (push) Blocked by required conditions Details Static analysis / Static analysis (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, mysql) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, mysql) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, mysql) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, mysql) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, postgres) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, postgres) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, postgres) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, postgres) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, sqlite) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, sqlite) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, sqlite) (push) Waiting to run Details PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, sqlite) (push) Waiting to run Details	2026-06-07 20:45:43 +02:00
Jan Böhmer	6e5d1c967f	Block access to all php and phar files that are uploaded into the media folder	2026-06-07 20:40:15 +02:00
tonghuaroot	c2ec0ee12b	Escape user-controlled element/collection names in CollectionElementDeleted log rendering LogEntryExtraFormatter::getInternalFormat() escapes user-controlled strings with htmlspecialchars() in every branch except the CollectionElementDeleted one, which interpolates getOldName() and getCollectionName() into the returned HTML unescaped. That string is rendered as raw HTML by LogEntryExtraColumn in the activity-log and element-history DataTables, so a name set on a deleted sub-element (parameter/attachment/lot/orderdetail) by a low-privileged editor is parsed as live markup in a log viewer's browser (stored XSS / HTML injection). Wrap both values in htmlspecialchars(), matching the sibling branches (e.g. ElementDeletedLogEntry at the old_name line).	2026-06-07 18:04:40 +02:00
Jan Böhmer	6ae4381551	Fixed phpstan issues	2026-06-07 14:11:53 +02:00
Jan Böhmer	e018e1d821	Merge remote-tracking branch 'origin/master'	2026-06-07 14:08:48 +02:00
Jan Böhmer	4b6a3ba72b	Updated dependencies	2026-06-07 14:08:46 +02:00
Jan Böhmer	c547500031	Update KiCad symbols and footprints lists (#1395 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-07 14:08:00 +02:00