This release includes 2 security fixes for security teams reviewing exposed deployments.
Affected surfaces
ReleasePort's take
Moderate signalThe release adds autocomplete filters and read‑only fields across admin panels while fixing a critical XSS vulnerability in participation summaries.
Why it matters: Escaping organizer-controlled names prevents stored XSS (severity 90) that could compromise admin sessions; new autocomplete filters improve usability for developers, SREs, and security engineers managing large datasets.
Summary
AI summaryAdmin panel overhaul improves list views, adds autocomplete filters and read‑only refund lifecycle details.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Escapes organizer-controlled names in admin participation summaries to prevent stored XSS Escapes organizer-controlled names in admin participation summaries to prevent stored XSS Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Breaking | High |
Restricts organization ownership transfer to superusers only Restricts organization ownership transfer to superusers only Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Breaking | High |
Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Feature | Low |
Adds missing enum filters for event status, ticket tier price type/visibility/payment method, refund status, poll result timing, notification read/unread Adds missing enum filters for event status, ticket tier price type/visibility/payment method, refund status, poll result timing, notification read/unread Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Feature | Low |
Replaces unbounded dropdown filters with autocomplete filters in admin panel Replaces unbounded dropdown filters with autocomplete filters in admin panel Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Feature | Low |
Makes payment refund lifecycle fields (`refund_status`, amount, Stripe ID, failure reason) read‑only in admin panel Makes payment refund lifecycle fields (`refund_status`, amount, Stripe ID, failure reason) read‑only in admin panel Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Feature | Low |
Organizes ticket money and audit fields into read‑only fieldsets in admin panel Organizes ticket money and audit fields into read‑only fieldsets in admin panel Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Feature | Low |
Registers Telegram `AccountOTP` and `EmailVerificationReminderTracking` as read‑only for support triage in admin panel Registers Telegram `AccountOTP` and `EmailVerificationReminderTracking` as read‑only for support triage in admin panel Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Performance | Low |
Optimizes admin changelists by removing per-row queries and paginating high‑volume tables at 50 rows Optimizes admin changelists by removing per-row queries and paginating high‑volume tables at 50 rows Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
Prevents 500 error on payment admin change page by fixing editable `expires_at` field rendering Prevents 500 error on payment admin change page by fixing editable `expires_at` field rendering Source: llm_adapter@2026-07-17 Confidence: high |
— |
Full changelog
Added
- Admin panel overhaul (staff-facing): richer list views, filters, and field coverage across all apps
- Missing enum filters added (event status/visibility, ticket-tier price type/visibility/payment method, payment refund status, poll result timing, notification read/unread); unbounded dropdown filters replaced with autocomplete filters
- Payment refund lifecycle (
refund_status, refund amount, Stripe refund id, failure reason) now visible read-only; ticket money/audit fields organized into read-only fieldsets; ticket-tier lists show price, availability, and sales configuration LegalandSiteSettingsnow use singleton admin pages with a browsable, revertable change history- Telegram
AccountOTP(secret hidden) andEmailVerificationReminderTrackingregistered read-only for support triage - User page gains read-only referral-code and global-ban inlines; notifications show per-channel delivery status inline; file-upload questions manageable from the questionnaire page
- User list: organization owners marked with 👑 plus an owner filter, name-first columns,
mailto:email links
Changed
- Admin changelists no longer issue per-row queries (~30 admins optimized with
select_related/annotations); high-volume tables paginate at 50 rows without full-table counts
Fixed
- Payment admin change page no longer returns a 500 (
expires_atwas rendered as editable despite being a non-editable field)
Security
- Admin participation summaries now escape organizer-controlled event/organization names (admin-only stored XSS)
- Organization ownership transfer in the admin restricted to superusers; payment base amounts (
amount,currency,platform_fee) made read-only
What's Changed
- feat(admin): overhaul admin panel — performance, filters, field coverage by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/714
- chore(release): v1.72.1 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/715
Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.72.0...v1.72.1
Security Fixes
- Admin participation summaries now escape organizer‑controlled names to prevent stored XSS (admin‑only)
- Organization ownership transfer restricted to superusers; payment base amounts made read‑only
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]