Skip to content

Security: Restrict blog post attachments to the post author - #9199

Merged
AngelFQC merged 1 commit into
chamilo:masterfrom
AngelFQC:security/auto-fix-GHSA-958p-rxgr-q423-author
Oct 9, 2026
Merged

AngelFQC merged 1 commit into
chamilo:masterfrom
AngelFQC:security/auto-fix-GHSA-958p-rxgr-q423-author

Conversation

@AngelFQC

@AngelFQC AngelFQC commented Oct 9, 2026

Copy link
Copy Markdown
Member

Only the author of a blog post can upload attachments to it, matching 1.11.x, where attachments are only added by the author when creating the post. The blog UI only uploads attachments right after creating a post, so the normal flow is unchanged.

Refs GHSA-958p-rxgr-q423

@AngelFQC
AngelFQC merged commit f30df11 into chamilo:master Oct 9, 2026
3 of 6 checks passed
@AngelFQC
AngelFQC deleted the security/auto-fix-GHSA-958p-rxgr-q423-author branch October 9, 2026 21:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant