Sulu releases 2.6.25 and 3.0.8

Both releases close three security issues, all rated medium severity. They affect Sulu 2.6.24, Sulu 3.0.7 and all earlier versions of these branches, so we recommend upgrading your projects.

The details, the affected setups and the workarounds for projects that cannot upgrade right away are described in the advisories: an authorization bypass when moving media, an authorization bypass when creating preview links and stored cross site scripting in media downloads.

The parameters that pre-filter the snippet, article and page selection overlays have been renamed so they match the naming already used by Smart Content. Article selections now use groups for template groups and templateKeys for concrete templates. Snippet and page selections use templateKeys.

If your templates configure these filters, you need to rename the parameters before upgrading. Sulu now checks this while building the container and stops with a message naming the parameter, the property and the file, so a missed occurrence will not go unnoticed. The types parameter of media selections filters mime types, is unrelated to this change and stays as it is.

You can find the full parameter mapping and an example in UPGRADE-3.x.md.

In Sulu 3.0, text that editors placed inside a global block was never written to the search index, so searching for it returned nothing. Sulu 3.0.8 now resolves the referenced block when indexing articles and pages.

On the 2.6 branch, global blocks were indexed as expected, unless the global block used sections. Fields inside such a section never reached the index. This case is fixed in both releases.

Because this changes what ends up in the index, existing content only benefits after a reindex. On Sulu 3.0.8 run php bin/console cmsig:seal:reindex --drop after upgrading, on Sulu 2.6.25 run php bin/console massive:search:reindex.

Moving a page kept its old URL instead of placing it under its new parent, and copying a page produced no URL at all. Both are fixed. The previous address now redirects to the new one, and pages further down the tree follow along as expected.

Internal links pointing at another webspace generated broken URLs, because the target webspace was accepted but not actually used when building the address. On top of that, articles served through an additional webspace now point their canonical URL back to the main webspace again. This restores the Sulu 2.6 behavior and avoids duplicate content in search engines. The canonical URL fix was contributed by Amoifr.

Locales without their own content caused a range of problems for pages and articles. Publishing a shadow could fail outright when its source locale was not published yet, and now reports a clear message instead. Opening a page or article in a locale that has not been translated shows the default template of the webspace rather than an empty form.

Saving a new locale for the first time no longer reports a conflict that was not there, and the settings and permission tabs stay hidden until that locale has actually been saved. Articles that only exist as a ghost no longer disappear from the list when filtering by template, and the preview works again for locales such as de_ch.

Copying articles and snippets is possible again. The action was available in Sulu 2.6, went missing after the 3.0 rewrite, and is now back in the toolbar of the edit view, including copying a single locale.

Versions are only created once publishing has actually succeeded. Previously a failed publish could leave entries behind that showed up in the list of restorable versions without ever being usable. Deep links now also work when a media or content selection sits inside an overlay, which previously led nowhere.

The AI writing assistant accepts configurable field types, so custom editor fields can offer the writing and translation tools as well.

Sulu 3.0.8 adds a consent screen to the admin. It asks a logged in user to approve or deny an external application that wants to act with their permissions, and shows what is being requested before anything is granted. The screen is built to be reused, so bundles that connect external applications to Sulu can rely on it instead of building their own.

Both releases also clean up the address bar after a successful login via SSO. The one time code from the identity provider stayed in the URL, so reloading the page tried to use it a second time and failed. This was contributed by therouv.

Sorting a list by a column that counts or combines values produced an error, most noticeably on PostgreSQL, and now works. Validation messages for fields that are grouped under a prefix, such as the SEO and excerpt tabs, now reach the field they belong to instead of being dropped silently. Templates that are defined in more than one directory keep their group when merged, contributed by FlorianKoerner, and a missing default webspace for articles is now reported while building the project instead of when an editor creates the first article.

The RequestParametersTrait has been deprecated in favor of reading from the request directly, contributed by mamazu. The replacement is described in UPGRADE-2.x.md. Both releases further update the test and build toolchain to Jest 30, npm 10 and PHP 8.4 for linting.

For the full changelog, see the release notes for Sulu 2.6.25 and Sulu 3.0.8.