Pimcore

What's Changed

• [Bug]: Fix defaultValue cannot be set/is no longer set to null, causing unique index violation by @kingjia90 in https://github.com/pimcore/pimcore/pull/19254
• Add explicit ORDER BY column allowlist to Redirect\Listing by @robertSt7 in https://github.com/pimcore/pimcore/pull/19262
• Escape FieldCollection fieldname in DataObject Listing JOIN condition by @robertSt7 in https://github.com/pimcore/pimcore/pull/19266
• Reject unwhitelisted filter properties in NotificationServiceFilterParser by @robertSt7 in https://github.com/pimcore/pimcore/pull/19267
• Bind CSV export files to the requesting user in CustomReportController by @robertSt7 in https://github.com/pimcore/pimcore/pull/19269
• Validate field-collection type in Listing::addFieldCollection() by @robertSt7 in https://github.com/pimcore/pimcore/pull/19272
• Fix workspace permission path-boundary matching (and make it index-usable) by @mcop1 in https://github.com/pimcore/pimcore/pull/19273
• Set owner classId by @morgannilsson in https://github.com/pimcore/pimcore/pull/19150
• Add string return type to Twig/TokenParser/BlockParser and Twig/TokenParser/ManualBlockParser by @jdreesen in https://github.com/pimcore/pimcore/pull/18853
• Fix/link-get-html-fallback by @IronSean in https://github.com/pimcore/pimcore/pull/19004
• [Video field] isEqual returns false when poster = null by @BlackbitDevs in https://github.com/pimcore/pimcore/pull/18882
• [Bug, EC] PEES-1217: TypeError: Cannot assign null to property Link::$string_property of type string when loading DataObject with Link field containing legacy null values #854 by @jcPimcore in https://github.com/pimcore/pimcore/pull/19283
• [Bug] Prevent database access in ReverseObjectRelation by @astehlik in https://github.com/pimcore/pimcore/pull/19002
• Fix SimpleBackendSearch Error 414 - Request-URI Too Large by @t-engl in https://github.com/pimcore/pimcore/pull/18955
• [Bug]: Accept classification store key names that are not valid identifiers by @mcop1 in https://github.com/pimcore/pimcore/pull/19284
• Messenger handlers: clean up temporary files after each iteration / jobs by @brusch in https://github.com/pimcore/pimcore/pull/18785
• [Security] Restrict Custom Report update to an explicit field allowlist by @mcop1 in https://github.com/pimcore/pimcore/pull/19289
• [Security] Do not return raw DB exception messages from Custom Report column-config by @mcop1 in https://github.com/pimcore/pimcore/pull/19291
• [Bug, EC] PEES-1369: Fix: do not regenerate thumbnails without crop box on upgrade (#18317) by @kingjia90 in https://github.com/pimcore/pimcore/pull/19294
• Bump checkout to v5.0.1 by @bluvulture in https://github.com/pimcore/pimcore/pull/19300
• [Bug] Fix classes-rebuild with db-only for empty instance (PaaS) by @astehlik in https://github.com/pimcore/pimcore/pull/19003
• security: restrict allowed_classes in DataObject field unserialize() calls to prevent PHP Object Injection by @XananasX7 in https://github.com/pimcore/pimcore/pull/19161
• Add enabled_adapters config to enable/disable Custom Reports adapters (12.3 backport) by @robertSt7 in https://github.com/pimcore/pimcore/pull/19306
• Fix: getByPath() falls back to NFC-normalized path candidates to resolve elements with accented names (12.3 backport) by @robertSt7 in https://github.com/pimcore/pimcore/pull/19298
• [Bug, EC] PEES-1176: Cache permission-filtered Required By total count by @jcPimcore in https://github.com/pimcore/pimcore/pull/19257
• [Security] Harden Serialize::unserialize() callers and deprecate the permissive default by @mcop1 in https://github.com/pimcore/pimcore/pull/19293
• Make Twig sandbox object/function access policy configurable (blocklist + allowlist) by @robertSt7 in https://github.com/pimcore/pimcore/pull/19303

New Contributors

• @morgannilsson made their first contribution in https://github.com/pimcore/pimcore/pull/19150

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.11...v12.3.12