mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
DOCS: Add FileShortcodeProvider change to changelog
This commit is contained in:
parent
3659f2888d
commit
1f92b21a04
22
docs/en/04_Changelogs/4.3.5.md
Normal file
22
docs/en/04_Changelogs/4.3.5.md
Normal file
@ -0,0 +1,22 @@
|
||||
# 4.3.5
|
||||
|
||||
Embedding files with shortcodes (`FileShortcodeProvider`) no longer provides a session grant
|
||||
by default. This is because it has the potential to escalate file access
|
||||
to users who otherwise should not have viewing permissions for the file.
|
||||
|
||||
There is a minor performance trade-off for disabling these grants. If you have a page with a lot of
|
||||
images that are in a draft state or have custom viewing permissions, it adds an extra database
|
||||
query for each embedded image. With session grants enabled, the first permission check persists
|
||||
the grant into the session, meaning there is no need to query the database on every single file.
|
||||
|
||||
Unless you have a lot of shortcode images embedded with protected or draft status on a single page,
|
||||
this setting is best left to its default value of `false`.
|
||||
|
||||
To revert to the old behaviour:
|
||||
|
||||
```
|
||||
SilverStripe\Assets\Shortcodes\FileShortcodeProvider:
|
||||
allow_session_grant: true
|
||||
```
|
||||
|
||||
<!--- Changes below this line will be automatically regenerated -->
|
Loading…
Reference in New Issue
Block a user