Safer panel listings and actions
Two flaws found while rewriting the documentation were fixed: a possible SQL injection in the panel listing, and delete and status actions without CSRF protection.
Rewriting the documentation from the code meant reading all of the code, and the reading produced a list of security findings. The first two were in the library that builds the panel screens.
Listing
The AJAX listing accepted column and ordering names from the browser. They now come only from the server session, go through a column-name check, and the search term is escaped, with % and _ treated as text.
Delete and status change
Both actions happened through a plain link. Such a link, opened by a logged-in user, ran the action. They now require the CSRF token, which the buttons and the confirmation modal send.
The library documentation lost its warnings and gained the description of the new behaviour.
Source: Core · req-189 · BATCH-193