Update Examine to 3.8.0.

Bumped version to 13.15.0-rc
Merge branch 'release/13.14.0' into v13/dev
2026-06-07 21:17:09 +02:00 · 2026-04-30 08:07:45 +02:00 · 2026-04-30 08:06:57 +02:00 · 2026-04-30 06:36:08 +02:00 · 2026-04-23 16:40:12 +02:00 · 2026-04-23 16:39:31 +02:00
5 changed files with 10 additions and 10 deletions
@@ -46,8 +46,8 @@
    <PackageVersion Include="Asp.Versioning.Mvc" Version="7.1.1" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="7.1.0" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.7.1" />
-    <PackageVersion Include="Examine.Core" Version="3.7.1" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.11.74" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
    <PackageVersion Include="MailKit" Version="4.8.0" />
@@ -87,7 +87,7 @@
    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.2" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
    <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
@@ -51,8 +51,8 @@ public class UmbLoginStatusController : SurfaceController

        TempData["LogoutSuccess"] = true;

-        // If there is a specified path to redirect to then use it.
-        if (model.RedirectUrl.IsNullOrWhiteSpace() == false)
+        // If there is a specified path to redirect to and it is validated as a local URL, then use it.
+        if (model.RedirectUrl.IsNullOrWhiteSpace() is false && Url.IsLocalUrl(model.RedirectUrl!))
        {
            return Redirect(model.RedirectUrl!);
        }
@@ -70,8 +70,8 @@ public class UmbProfileController : SurfaceController

        TempData["FormSuccess"] = true;

-        // If there is a specified path to redirect to then use it.
-        if (model.RedirectUrl.IsNullOrWhiteSpace() == false)
+        // If there is a specified path to redirect to and it is validated as a local URL, then use it.
+        if (model.RedirectUrl.IsNullOrWhiteSpace() is false && Url.IsLocalUrl(model.RedirectUrl!))
        {
            return Redirect(model.RedirectUrl!);
        }
@@ -59,8 +59,8 @@ public class UmbRegisterController : SurfaceController
        {
            TempData["FormSuccess"] = true;

-            // If there is a specified path to redirect to then use it.
-            if (model.RedirectUrl.IsNullOrWhiteSpace() == false)
+            // If there is a specified path to redirect to and it is validated as a local URL, then use it.
+            if (model.RedirectUrl.IsNullOrWhiteSpace() is false && Url.IsLocalUrl(model.RedirectUrl!))
            {
                return Redirect(model.RedirectUrl!);
            }
@@ -1,6 +1,6 @@
 {
  "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/main/src/NerdBank.GitVersioning/version.schema.json",
-  "version": "13.14.0-rc",
+  "version": "13.15.0-rc",
  "assemblyVersion": {
    "precision": "build"
  },
Author	SHA1	Message	Date
Andy Butland	0a98a47db0	Update Examine to 3.8.0.	2026-06-07 21:17:09 +02:00
Andy Butland	18a9da080a	Bumped version to 13.15.0-rc	2026-04-30 08:07:45 +02:00
Andy Butland	6104efdd47	Merge branch 'release/13.14.0' into v13/dev	2026-04-30 08:06:57 +02:00
Andy Butland	7d400e7742	Bumped version to 13.14.0	2026-04-30 06:36:08 +02:00
Andy Butland	8295f833f8	Bump version to 13.14.0-rc3.	2026-04-23 16:40:12 +02:00
NguyenThuyLan Andy Butland Lan Nguyen Thuy	8d6645b0ef	Surface controllers: validate redirect url in public surface controllers (v13) (#22565 ) * Fix: prevent open redirect in public surface controllers by validating RedirectUrl with Url.IsLocalUrl * Fixed spacing in comment. --------- Co-authored-by: Lan Nguyen Thuy <lnt@umbraco.dk> Co-authored-by: Andy Butland <abutland73@gmail.com>	2026-04-23 16:39:31 +02:00
NguyenThuyLan GitHub Lan Nguyen Thuy Andy Butland	a0cb9b2826	Surface controllers: validate redirect url in public surface controllers (v13) (#22565 ) * Fix: prevent open redirect in public surface controllers by validating RedirectUrl with Url.IsLocalUrl * Fixed spacing in comment. --------- Co-authored-by: Lan Nguyen Thuy <lnt@umbraco.dk> Co-authored-by: Andy Butland <abutland73@gmail.com>	2026-04-23 16:37:53 +02:00
Andy Butland	b2ff910a92	Bumped version to 13.14.0-rc2.	2026-04-17 14:03:37 +02:00
GinoandAndy Butland	b70d2b482d	Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning (Umbraco 13) (#22513 ) * Update System.Security.Cryptography.Xml - fix vulnerability * Update Directory.Packages.props use correct/latest version of the system.security.cryptohraphy.xml package. Co-authored-by: Andy Butland <abutland73@gmail.com> --------- Co-authored-by: Andy Butland <abutland73@gmail.com>	2026-04-17 14:02:46 +02:00
Gino GitHub Andy Butland	ac22eef92f	Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning (Umbraco 13) (#22513 ) * Update System.Security.Cryptography.Xml - fix vulnerability * Update Directory.Packages.props use correct/latest version of the system.security.cryptohraphy.xml package. Co-authored-by: Andy Butland <abutland73@gmail.com> --------- Co-authored-by: Andy Butland <abutland73@gmail.com>	2026-04-17 11:59:55 +00:00