@strapi/admin 5.10.1 → 5.10.3

package/dist/server/index.js

@@ -957,7 +957,10 @@ var authentication$2 = [
         path: '/forgot-password',
         handler: 'authentication.forgotPassword',
         config: {
-            auth: false
+            auth: false,
+            middlewares: [
+                'plugin::email.rateLimit'
+            ]
         }
     },
     {
@@ -2113,7 +2116,11 @@ const email = utils$2.yup.string().email().lowercase();
 const firstname = utils$2.yup.string().trim().min(1);
 const lastname = utils$2.yup.string();
 const username = utils$2.yup.string().min(1);
-const password = utils$2.yup.string().min(8).matches(/[a-z]/, '${path} must contain at least one lowercase character').matches(/[A-Z]/, '${path} must contain at least one uppercase character').matches(/\d/, '${path} must contain at least one number');
+const password = utils$2.yup.string().min(8).test('required-byte-size', '${path} must be less than 73 bytes', function(value) {
+    if (!value) return true;
+    const byteSize = new TextEncoder().encode(value).length;
+    return byteSize <= 72;
+}).matches(/[a-z]/, '${path} must contain at least one lowercase character').matches(/[A-Z]/, '${path} must contain at least one uppercase character').matches(/\d/, '${path} must contain at least one number');
 const roles = utils$2.yup.array(utils$2.yup.strapiID()).min(1);
 const isAPluginName = utils$2.yup.string().test('is-a-plugin-name', 'is not a plugin name', function(value) {
     return [
@@ -5445,7 +5452,7 @@ const createHomepageService = ({ strapi })=>{
         });
         return readPermissions.map((permission)=>permission.subject).filter(Boolean);
     };
-    const getDocumentsMetaData = (allowedContentTypeUids, configurations)=>{
+    const getContentTypesMeta = (allowedContentTypeUids, configurations)=>{
         return allowedContentTypeUids.map((uid)=>{
             const configuration = configurations.find((config)=>config.uid === uid);
             const contentType = strapi.contentType(uid);
@@ -5507,6 +5514,11 @@ const createHomepageService = ({ strapi })=>{
             };
         }));
     };
+    const permissionCheckerService = strapi.plugin('content-manager').service('permission-checker');
+    const getPermissionChecker = (uid)=>permissionCheckerService.create({
+            userAbility: strapi.requestContext.get()?.state.userAbility,
+            model: uid
+        });
     return {
         async getRecentlyPublishedDocuments () {
             const permittedContentTypes = await getPermittedContentTypes();
@@ -5516,15 +5528,16 @@ const createHomepageService = ({ strapi })=>{
             // Fetch the configuration for each content type in a single query
             const configurations = await getConfiguration(allowedContentTypeUids);
             // Get the necessary metadata for the documents
-            const documentsMeta = getDocumentsMetaData(allowedContentTypeUids, configurations);
+            const contentTypesMeta = getContentTypesMeta(allowedContentTypeUids, configurations);
             // Now actually fetch and format the documents
-            const recentDocuments = await Promise.all(documentsMeta.map(async (meta)=>{
-                const docs = await strapi.documents(meta.uid).findMany({
+            const recentDocuments = await Promise.all(contentTypesMeta.map(async (meta)=>{
+                const permissionQuery = await getPermissionChecker(meta.uid).sanitizedQuery.read({
                     limit: MAX_DOCUMENTS,
                     sort: 'publishedAt:desc',
                     fields: meta.fields,
                     status: 'published'
                 });
+                const docs = await strapi.documents(meta.uid).findMany(permissionQuery);
                 return formatDocuments(docs, meta);
             }));
             const overallRecentDocuments = recentDocuments.flat().sort((a, b)=>{
@@ -5538,14 +5551,15 @@ const createHomepageService = ({ strapi })=>{
             // Fetch the configuration for each content type in a single query
             const configurations = await getConfiguration(allowedContentTypeUids);
             // Get the necessary metadata for the documents
-            const documentsMeta = getDocumentsMetaData(allowedContentTypeUids, configurations);
+            const contentTypesMeta = getContentTypesMeta(allowedContentTypeUids, configurations);
             // Now actually fetch and format the documents
-            const recentDocuments = await Promise.all(documentsMeta.map(async (meta)=>{
-                const docs = await strapi.documents(meta.uid).findMany({
+            const recentDocuments = await Promise.all(contentTypesMeta.map(async (meta)=>{
+                const permissionQuery = await getPermissionChecker(meta.uid).sanitizedQuery.read({
                     limit: MAX_DOCUMENTS,
                     sort: 'updatedAt:desc',
                     fields: meta.fields
                 });
+                const docs = await strapi.documents(meta.uid).findMany(permissionQuery);
                 return formatDocuments(docs, meta);
             }));
             const overallRecentDocuments = recentDocuments.flat().sort((a, b)=>{