Skip to content

Commit 6718725

Browse files
thorstenthorsten
committed
4.0.14
1 parent f80416f commit 6718725

File tree

9 files changed

+670
-639
lines changed

9 files changed

+670
-639
lines changed

‎content/news/2025.md‎

Lines changed: 8 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,14 @@ canonical: news/2025
55
layout: news_md.hbs
66
---
77

8-
### 2025-10-12
8+
### 2025-11-15
99

10-
---
10+
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.0.14](/download),
11+
the "Ace Frehley" release.
12+
This release fixes a security vulnerability, fixes the reported bugs, and we updated our third party dependencies.
13+
[Click here to find a detailed security advisory](/security/advisory-2025-11-15).
14+
15+
### 2025-10-12
1116

1217
After eleven years we finally re-built our website from scratch.
1318
The content is still the same, but the design is now modern and responsive.
@@ -16,8 +21,6 @@ We made heavy use of Anthropic's Claude Code to help us with the content migrati
1621

1722
### 2025-10-04
1823

19-
---
20-
2124
We’re excited to announce the release of [phpMyFAQ 4.1.0-alpha.3](/download), the "Jane Goodall" release.
2225
This version introduces several new features and experimental improvements.
2326
You can now edit the llms.txt configuration file and benefit from full EU Data Act 2025 compliance.
@@ -27,45 +30,33 @@ updates via the command line, .env file configuration, and Mago.
2730

2831
### 2025-10-03
2932

30-
---
31-
3233
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.13](/download), the "Claudia Cardinale" release.
3334
This release fixes a security vulnerability, fixes the reported bugs, and we updated our third party dependencies.
3435
[Click here to find a detailed security advisory](/security/advisory-2025-10-03).
3536

3637
### 2025-09-23
3738

38-
---
39-
4039
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.0.12](/download),
4140
the "Robert Redford" release.
4241
This release fixes all reported bugs, and we updated our third party dependencies.
4342

4443
### 2025-09-13
4544

46-
---
47-
4845
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.11](/download), the "Brent Hinds" release.
4946
This release re-adds the rewrite rules for ISS, fixes the reported bugs, and we updated our third party dependencies.
5047

5148
### 2025-08-02
5249

53-
---
54-
5550
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.0.10](/download), the "Laura Dahlmeier" release.
5651
This release fixes all reported bugs, and we updated our third party dependencies.
5752

5853
### 2025-07-06
5954

60-
---
61-
6255
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.9](/download), the "Brian Wilson" release.
6356
This release fixes a lot of reported bugs, and we updated our third party dependencies.
6457

6558
### 2025-06-01
6659

67-
---
68-
6960
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.1.0-alpha.2](/download),
7061
the "Rick Derringer" release.
7162
The second alpha release of phpMyFAQ 4.1.0 changes the PHP requirement to PHP 8.3 or later,
@@ -78,29 +69,21 @@ We also migrated our unittests to PHPUnit 12.
7869

7970
### 2025-05-10
8071

81-
---
82-
8372
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.8](/download), the "Val Kilmer" release.
8473
This release fixes a lot of reported bugs, and we updated third party dependencies.
8574

8675
### 2025-03-24
8776

88-
---
89-
9077
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.0.7](/download), the "Eddie Jordan" release.
9178
This release fixes all reported bugs, and we updated our third party dependencies.
9279

9380
### 2025-02-23
9481

95-
---
96-
9782
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.6](/download), the "Horst Köhler" release.
9883
This release updates the French translation, we fixed all reported bugs, and we updated third party dependencies.
9984

10085
### 2025-02-12
10186

102-
---
103-
10487
We’re excited to announce the release of [phpMyFAQ 4.1.0-alpha](/download), the "Marianne Faithfull" release.
10588
This version introduces several important improvements for our 24th birthday.
10689
You can now edit the robots.txt configuration. The administration backend now uses Symfony Routing.
@@ -111,30 +94,22 @@ from Webpack to Vite v6 and from Jest to Vitest v3.
11194

11295
### 2025-01-19
11396

114-
---
115-
11697
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.0.5](/download), the "David Lynch" release.
11798
This release updates the Hellenic translation, we fixed all reported bugs, and we updated third party dependencies.
11899

119100
### 2025-01-09
120101

121-
---
122-
123102
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.4](/download), the "Robert Paul Wolff" release.
124103
This release improves the update from v3 installations,
125104
we updated third party dependencies, and we fixed all reported bugs.
126105

127106
### 2025-01-03
128107

129-
---
130-
131108
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.0.3](/download), the "Teddy de Baer" release.
132-
This release fixes an installation issue, that was introduced in phpMyFAQ 4.0.2.
109+
This release fixes an installation issue that was introduced in phpMyFAQ 4.0.2.
133110

134111
### 2025-01-02
135112

136-
---
137-
138113
Happy new year!
139114

140115
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.2](/download), the "Jimmy Carter" release.

‎content/security/advisory-2025-11-15.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
title: Security Advisory 2025-11-15
3+
description: Authenticated SQL Injection in Configuration Update Functionality in phpMyFAQ
4+
canonical: security/advisory-2025-11-15
5+
layout: security.hbs
6+
---
7+
8+
## Authenticated SQL Injection in Configuration Update Functionality in phpMyFAQ
9+
10+
**Issued on::** 2025-11-15
11+
**Software::** phpMyFAQ <= 4.0.13
12+
**Risk::** High
13+
**Platforms::** all
14+
15+
The phpMyFAQ Team has learned of a security issue that'd been discovered in phpMyFAQ 4.0.12 and
16+
earlier.
17+
18+
## Description
19+
20+
An authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and
21+
prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands.
22+
Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all
23+
data, as well as potential remote code execution depending on the database configuration.
24+
25+
## Solution
26+
27+
The phpMyFAQ Team has released the new phpMyFAQ version 4.0.14, which fixes the vulnerability. All
28+
users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
29+
30+
## Workaround
31+
32+
There's no workaround except installing phpMyFAQ 4.0.14.
33+
34+
## Thanks
35+
36+
The phpMyFAQ team would like to thank Yihao Peng for the responsible disclosures of this vulnerability.

‎data/development.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@
88
"filesize": 13.63,
99
"md5": "c3979f5c17c31baab624670e5dbc5189"
1010
}
11-
}
11+
}

‎data/stable.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"version": "4.0.13",
2+
"version": "4.0.14",
33
"zip": {
44
"filesize": 18.11,
5-
"md5": "a7f006835a7cb4c89884435195071375"
5+
"md5": "1f2a8ee89355fecc2e3f4993a25bd9a8"
66
},
77
"targz": {
8-
"filesize": 14.81,
9-
"md5": "e98c42f890f070c2affb68a51c0b1987"
8+
"filesize": 14.82,
9+
"md5": "c374e1724624dce10de2dd886cf1d9ba"
1010
}
11-
}
11+
}

‎data/versions.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
2-
"stable": "4.0.13",
3-
"stable_released": "2025-10-03",
2+
"stable": "4.0.14",
3+
"stable_released": "2025-11-15",
44
"development": "4.1.0-alpha.3",
55
"development_released": "2025-10-04",
6-
"nightly": "nightly-2025-10-03",
7-
"nightly_released": "2025-10-03"
8-
}
6+
"nightly": "nightly-2025-11-14",
7+
"nightly_released": "2025-11-14"
8+
}

‎package.json‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,39 +29,39 @@
2929
"@types/marked": "^5.0.2",
3030
"bootstrap": "^5.3.8",
3131
"gray-matter": "^4.0.3",
32-
"marked": "^16.4.1",
32+
"marked": "^16.4.2",
3333
"next": "15.5.4",
3434
"react": "^19.2.0",
3535
"react-dom": "^19.2.0",
36-
"sass": "^1.93.2"
36+
"sass": "^1.94.0"
3737
},
3838
"devDependencies": {
3939
"@commitlint/cli": "^20.1.0",
4040
"@commitlint/config-conventional": "^20.0.0",
4141
"@commitlint/types": "^20.0.0",
42-
"@eslint/js": "^9.0.0",
42+
"@eslint/js": "^9.39.1",
4343
"@next/eslint-plugin-next": "15.5.4",
4444
"@playwright/test": "^1.56.1",
4545
"@testing-library/jest-dom": "^6.9.1",
4646
"@testing-library/react": "^16.3.0",
4747
"@testing-library/user-event": "^14.6.1",
48-
"@types/node": "^20.19.24",
49-
"@types/react": "^19.2.2",
50-
"@types/react-dom": "^19.2.2",
51-
"@typescript-eslint/eslint-plugin": "^8.0.0",
52-
"@typescript-eslint/parser": "^8.0.0",
53-
"@vitejs/plugin-react": "^5.1.0",
48+
"@types/node": "^20.19.25",
49+
"@types/react": "^19.2.5",
50+
"@types/react-dom": "^19.2.3",
51+
"@typescript-eslint/eslint-plugin": "^8.46.4",
52+
"@typescript-eslint/parser": "^8.46.4",
53+
"@vitejs/plugin-react": "^5.1.1",
5454
"@vitest/coverage-v8": "3.2.4",
5555
"conventional-changelog-atom": "^5.0.0",
56-
"eslint": "^9.0.0",
56+
"eslint": "^9.39.1",
5757
"eslint-config-next": "15.5.4",
58-
"eslint-config-prettier": "^9.1.0",
59-
"globals": "^15.12.0",
58+
"eslint-config-prettier": "^9.1.2",
59+
"globals": "^15.15.0",
6060
"husky": "^9.1.7",
61-
"jsdom": "^27.0.1",
61+
"jsdom": "^27.2.0",
6262
"lint-staged": "^16.2.6",
6363
"postcss": "^8.5.6",
64-
"prettier": "^3.3.3",
64+
"prettier": "^3.6.2",
6565
"tailwindcss": "^3.4.18",
6666
"typescript": "^5.9.3",
6767
"vitest": "^3.2.4"

0 commit comments

Comments
 (0)