Wagtail 7.4.3 release notes¶

Security fix: Improper restriction handling on Pages admin API¶

The internal Pages admin API incorrectly returned page fields without access control when they were declared in api_fields. A user with access to the Wagtail admin could use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

Many thanks to xuliang@QAX for reporting this issue. For further details, please see security advisory GHSA-3vrh-m9w7-v94f.

Security fix: Identification of documents by SHA1 hash¶

By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library.

Many thanks to Anand Himanshu for reporting this issue. For further details, please see security advisory GHSA-92hv-j533-69wc.

Security fix: Improper restriction handling on descendant collections in Documents and Images API¶

The Documents and Images API incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.

Many thanks to Ta Duc Thien for reporting this issue. For further details, please see security advisory GHSA-c2xx-cjmh-9q8f.

Security fix: Improper permission handling when copying snippets¶

A CMS user with “add” permission over a snippet model, but not “change” or “view” permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.

Many thanks to tinyb0y for reporting this issue. For further details, please see security advisory GHSA-x5cx-w6p2-mxf2.

Security fix: Improper restriction handling on Page translation API endpoint¶

A CMS user with the “submit translations” permission, could use the Admin API’s “copy for translation” endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

Many thanks to tinyb0y for reporting this issue. For further details, please see security advisory GHSA-jm5p-837g-rv8g.

Bug fixes¶

• Ensure models with a UUID primary key can be previewed when creating a new instance (Sébastien Corbin)

• Ensure the checks side panel recognises custom ContentCheckerItem subclasses (Robert Rollins)

• Ensure form field clean_name is consistently set on form pages if autosave runs prematurely (Joey Jurjens)

• Set last_published_at noon alias pages on first publish (Kevin Howbrook)

Maintenance¶

• Update base managers for Page and Collection to avoid warnings from django-treebeard 5.3 (Samir Shah)