LoginSign Up
← Back to all sparks
G

Grav

DEVOPS
Velocity5.0

Modern flat-file CMS that runs without a database

getgrav.org ↗

Grav's 1.7 line keeps taking small patches after its security backport burst.

cmsflat-filephpsecurity-fixesbackportsweb-server-config
◆Current state
Grav's 1.7 branch shipped four patches between 10-31 and 11-04. 1.7.53.7 and 1.7.53.8 backported Grav 2 security fixes and web-server protection rules; 1.7.53.9 fixed :80 redirects behind HTTPS proxies; 1.7.53.10 makes cache purges report which file failed and why.
◆Where it's heading
Security work lands on Grav 2 first and is then carried back to 1.7, and the pace of that carry-back jumped: one patch on 10-24, three within about four hours. The fixes moved from individual code paths to the web-server rules that sit in front of the application. Among web servers, only Apache sites get those rules on upgrade; IIS, nginx, Caddy and lighttpd sites must copy them by hand, so protection on 1.7 now depends on the host's web server.
◆Prediction
Expect more 1.7.53.x patches mirroring 2.x security fixes, plus small follow-up fixes like the proxy redirect in 1.7.53.9. The entries don't show how long 1.7 support continues.

◆Recent moves

  1. 10d ago

    Grav 1.7.53.10: cache purge names the file it can't delete

    Cache purges now name the file that could not be deleted and the reason, and keep going instead of stopping. A small operations fix that follows the security backports on the 1.7 branch.

    View source ↗
  2. 13d ago

    Grav 1.7.53.9: no more :80 redirects behind HTTPS proxies

    A single fix: sites behind a proxy that ends HTTPS, such as Cloudflare, no longer redirect visitors to an address with :80 added. A narrow patch that follows the two security releases by a few hours.

    View source ↗
  3. 13d ago

    Grav 1.7.53.8: Grav 2 protection rules for all bundled web servers

    Backports the Grav 2 deny rules to the bundled Apache, IIS, nginx, Caddy and lighttpd configs and the php -S router, keeping folders like tmp/ private and refusing scripts in images/ and assets/. Upgrades update .htaccess, but IIS, nginx, Caddy and lighttpd sites must copy the rules by hand.

    View source ↗
  4. 13d ago

    Grav 1.7.53.7: five security fixes backported from 2.2.18

    Backports five Grav 2.2.18 security fixes found by Anthropic's OSS Scanner, including stricter image conversion, private cookie responses and media .meta.yaml files that can no longer redirect a medium. It opens a run of three 1.7 patches in about four hours.

    View source ↗
  5. 21d ago

    Grav 1.7.53.6: profiler token now required, slug encoding fix

    A security backport from 2.1.7: Clockwork profiler data now needs a debugger.token, closing access through same-server reverse proxies that look local. Sites on 1.7 using the profiler must set a token after upgrading.

    View source ↗