Mobile: Improved security by limiting the mobile Transaction Detail block to the giver, their giving group, owners of the giving business and people with Edit access to the block or transaction.
Finance: Fixed the Contribution Statement List Lava, Transaction Report and Transaction Yearly Summary Lava blocks not showing another person's giving to people with View access to financial transactions (by default Rock Administration, Finance Administration and Finance Worker) when Use Person Context is enabled.
CMS: Improved the Universal Search block so it uses Smart Search settings only when the new Allow Smart Search Requests setting is enabled.
Lava: Fixed block shortcodes so the content between a shortcode's tags runs with the Lava commands enabled where the shortcode is used, not the shortcode's own commands.
Group: Fixed the Group Type Map block so it only maps group types selected in its now-required Group Type setting.
API: Fixed an issue where creating or moving a step through the v1 and v2 REST APIs failed with "The step type identifier is invalid" for a valid step type.
Core: Improved the Rock Update block with a note recommending a direct update to the latest secure version.
Security: Improved security by building links in sign-in, account confirmation and password reset emails from the site's configured domains or the Public Application Root.
Other: Improved security by encoding stored text shown in several staff views, including the SMS Conversations, Group Members and Signature Document Detail blocks.
Security: Improved security by encrypting stored OpenID Connect signing keys and Spark Connected Services secrets. The OpenID Connect signing key is replaced once after updating.
CMS: Improved security by tightening file name and folder checks for uploads to asset storage providers.
Core: Improved security by encoding addresses and person names shown in pickers, popups and several blocks, including the FormattedHtmlAddress Lava property.
API: Improved security by applying permission checks to the user login REST API endpoints.
Mobile: Improved security by strengthening permission checks in the mobile Transaction Detail block.
Reporting: Improved security by requiring Administrate access to change a metric's SQL or Lava source.
Communication: Improved security by validating email addresses for passwordless sign-in and limiting Lava in recipient addresses to System Communications.
Reporting: Improved security by encoding the values shown in the Interaction blocks.
Communication: Improved security by removing scripts from saved email sections in the email editor.
API: Improved security by strengthening permission checks and validation when saving records through the REST API.
Workflow: Improved security by treating workflow attribute values as plain text in several workflow actions, including Entity Property Set, Entity Attribute Set and Redirect to Page.
API: Improved security by limiting REST API changes to workflow action types to Rock administrators by default.
Group: Improved security by requiring the Limit Group Type setting on the Group Member Add From URL and Group Member Remove From URL blocks and blocking changes to security roles.
Mobile: Improved security by limiting the SMS numbers and recipient lists available in the mobile Communication Entry block.
API: Improved security by applying group and data view permission checks to the attendance chart API.
Workflow: Improved security by applying workflow type permission checks when launching workflows through the REST API.
API: Improved security by requiring Administrate access to change blocks, attributes and REST security through the REST API.
Communication: Improved security by fully removing Lava from every message field when the Communication Entry block has Lava turned off.
CMS: Improved security by strengthening permission checks and link validation in the Personal Link List block.
Workflow: Improved security by limiting the Workflow Launch block to workflow types the person can view.
Reporting: Improved security by limiting the Metrics REST API to rendering only Lava Dashboard Widget blocks the person can view.
Core: Improved security by limiting the HTML the Markdown field type displays to a list of safe tags and links.
Engagement: Improved security by strengthening permission checks in the Person Signal Type Detail, Step Program List and Step Program Detail blocks.
Mobile: Improved security by strengthening permission checks in the mobile Attribute Values block.
Communication: Improved security by limiting sign-in tokens in email previews and sends from the Registrant Wait List Move, Registration Instance Send Payment Reminder, System Communication Detail and Communication Flow Detail blocks.
Core: Improved security by only accepting block actions sent as POST requests, including Log Viewer, Bulk Import and CSV Import downloads.
Finance: Improved security by protecting gateway credentials and other sensitive attribute values in the REST API and the Financial Gateway Detail block.
Finance: Improved security by strengthening checks on the REST API payment processing endpoints.
Core: Improved security by requiring Edit or Administrate access on the Attributes block to change attributes and attribute values.
Group: Improved security by encoding names in the Electronic Signature Receipt email and group map info windows.
API: Improved security by requiring Administrate access to change persisted datasets, workflow triggers, person aliases and entity types through the REST API.
CMS: Improved security by keeping the File Editor block inside its Root Folder and requiring Edit access to save.
Core: Improved security by showing stored names and descriptions as plain text in WebForms item pickers and the Workflow Detail, Email Analytics and Sign-Up blocks.
Security: Improved security by requiring Administrate access to unlock access from the Verify Security block.
Reporting: Improved security by tightening how the Dynamic Data and Dynamic Chart blocks use page parameters in SQL and show database errors.
Mobile: Improved security by adding an Auth0 Require Verified Email setting for the mobile Log In block.
Core: Improved security by strengthening the HTML sanitizer used by connection requests, group member requirements, Modal Alert and Markdown display.
Core: Improved security by encoding stored values in History Log summaries.
API: Improved security by applying file security to the binary file data REST API endpoints.
Security: Improved security by only trusting JSON Web Token issuers an administrator has configured for REST API sign-in.
Security: Improved security by adding a Require Verified Email setting to the Auth0 and OpenID Connect authentication services.
LMS: Improved security by limiting who can see an activity's average grade in the Learning Class Activity Detail block.
API: Improved security by retiring several REST API endpoints for sign-in codes and AI provider settings. The AI provider secret key is now encrypted.
Check-in: Improved security by limiting failed supervisor and manager PIN attempts on check-in kiosks.
Group: Improved security by limiting RSVP Response block responses to people invited to the occurrence or in its group.
Security: Improved security by restricting the OpenID Connect password grant for accounts that use two-factor authentication.
Communication: Improved security by verifying SendGrid event webhook signatures when a verification key is set.
API: Improved security by applying family permission checks to the People REST API endpoints for adding family members.
Core: Improved security by encoding values and validating links in the URL Link, Audio URL, Video URL, Email, Audio File and Video File field types.
API: Improved security by protecting binary file storage settings from changes through the REST API.
Workflow: Improved security by validating recipient addresses in Form Builder emails and the Email Send with Events workflow action.
Core: Improved security by tightening note permission checks for notes with no recorded author, which affects Notes blocks that allow anonymous notes.
Core: Improved security by removing the Presence REST login that is included with Rock, so any check-in kiosk or integration using its key will need a new REST key.