publify_core 11.0.0 → 11.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ce0abf6a55254193cdc6475dd86481f250201069155275d9178b17f87fb5e9e
-  data.tar.gz: fe986ec81f387a6bd29a91a7be4d62d7f3655bbd19523ad12c02ba4e1b7cf292
+  metadata.gz: 54204326dfdc03206645e1fd7500d9bfa643d6dda4322ac507f274cb5f54f6f4
+  data.tar.gz: 707f57d3ee216361b5c8609dca39d9530a1028d88a7ad6074ada18ce54161339
 SHA512:
-  metadata.gz: 93aaa5759263e4e8fb3fe8cb56f33e3469a0ed085503e10d6b37c12c6ca45816c56f567424283ea171d8109b0968679b4cebf0fc97c0217db32172dcb095ca1d
-  data.tar.gz: 1d954da004caa610dd8f306f5c482a415887cde00f9b0a2ad4ea7e2d5ab67ade36bb3f90826071ac101d1f7e7525d435724e5f5bc89cc7ec52c97be19c0573cb
+  metadata.gz: 5f605221ed9190fa5cf50af34c8f0cde8d328bc5390a36fb251953d599b6ee2b307e6238a9d1f53379d87308562f33fb6d2bd2074afe5dcbb5096c6e727d0813
+  data.tar.gz: 43abbedcaa37557670340fbd8d6304404b758d1b860f62594b03ab48e4ee2278cbc1b197de224db29cb75b71a4232e4dd7439a7551603eff21b1efb31aef79de

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 11.0.1 / 2026-10-23
+
+This release fixes a security issue where a user with publisher role can update
+any other user's articles.
+
+* Support Rails 8.0 ([#270] by [mvz])
+* Update `mini_magick` dependency ([#271] by [mvz])
+* Support Rails 8.1 ([#272] by [mvz])
+* Check user update rights in admin article create action ([#274] by [mvz])
+
+[#270]: https://github.com/publify/publify_core/pull/270
+[#271]: https://github.com/publify/publify_core/pull/271
+[#272]: https://github.com/publify/publify_core/pull/272
+[#274]: https://github.com/publify/publify_core/pull/274
+
 ## 11.0.0 / 2026-10-04
 
 This major release updates Rails to version 7.2, and updates supported Ruby

data/app/controllers/admin/articles_controller.rb

@@ -37,7 +37,10 @@ class Admin::ArticlesController < Admin::BaseController
 
   def create
     article_factory = Article::Factory.new(this_blog, current_user)
-    @article = article_factory.get_or_build_from(params[:article][:id])
+    id = params[:article][:id].presence
+    return if id && !access_granted?(id)
+
+    @article = article_factory.get_or_build_from(id)
 
     update_article_attributes
 

data/lib/publify_core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PublifyCore
-  VERSION = "11.0.0"
+  VERSION = "11.0.1"
 end

data/lib/tasks/appraisal.rake

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+namespace :appraisal do
+  desc "Check appraisals"
+  task :check do
+    Appraisal::AppraisalFile.each do |appraisal|
+      existing = File.read(appraisal.gemfile_path)
+      signature = Appraisal::Customize.heading || "This file was generated by Appraisal"
+      header = appraisal.send :comment_lines, signature
+      body = appraisal.send :quoted_gemfile
+      expected = [header, body].join("\n\n")
+      raise "Outdated appraisal: #{appraisal.name}" unless existing.chomp == expected.chomp
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: publify_core
 version: !ruby/object:Gem::Version
-  version: 11.0.0
+  version: 11.0.1
 platform: ruby
 authors:
 - Matijs van Zuijlen
@@ -278,20 +278,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.9'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 4.9.4
+        version: '5.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.9'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 4.9.4
+        version: '5.4'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -329,7 +323,7 @@ dependencies:
         version: 7.1.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -339,7 +333,7 @@ dependencies:
         version: 7.1.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: rails_autolink
   requirement: !ruby/object:Gem::Requirement
@@ -882,6 +876,7 @@ files:
 - lib/sidebar_field.rb
 - lib/sidebar_registry.rb
 - lib/spam_protection.rb
+- lib/tasks/appraisal.rake
 - lib/tasks/publify_core_tasks.rake
 - lib/text_filter_plugin.rb
 - lib/theme.rb