Joomla! 4.4.14 Stable

MacJoom · MacJoom · commit e215057c5e76 · 2025-09-23T21:56:14.000+02:00
diff --git a/administrator/language/en-GB/install.xml b/administrator/language/en-GB/install.xml
@@ -3,7 +3,7 @@
 	<name>English (en-GB)</name>
 	<tag>en-GB</tag>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/administrator/language/en-GB/langmetadata.xml b/administrator/language/en-GB/langmetadata.xml
@@ -2,7 +2,7 @@
 <metafile client="administrator">
 	<name>English (en-GB)</name>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/administrator/manifests/files/joomla.xml b/administrator/manifests/files/joomla.xml
@@ -6,8 +6,8 @@
 	<authorUrl>www.joomla.org</authorUrl>
 	<copyright>(C) 2019 Open Source Matters, Inc.</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
-	<version>4.4.14-dev</version>
-	<creationDate>2025-04</creationDate>
+	<version>4.4.14</version>
+	<creationDate>2025-09</creationDate>
 	<description>FILES_JOOMLA_XML_DESCRIPTION</description>
 
 	<scriptfile>administrator/components/com_admin/script.php</scriptfile>
diff --git a/administrator/manifests/packages/pkg_en-GB.xml b/administrator/manifests/packages/pkg_en-GB.xml
@@ -3,7 +3,7 @@
 	<name>English (en-GB) Language Pack</name>
 	<packagename>en-GB</packagename>
 	<version>4.4.14.1</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/api/language/en-GB/install.xml b/api/language/en-GB/install.xml
@@ -3,7 +3,7 @@
 	<name>English (en-GB)</name>
 	<tag>en-GB</tag>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/api/language/en-GB/langmetadata.xml b/api/language/en-GB/langmetadata.xml
@@ -2,7 +2,7 @@
 <metafile client="api">
 	<name>English (en-GB)</name>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/build/composer_patches/4.4.14-2025-09-23_php-InputFilter.patch b/build/composer_patches/4.4.14-2025-09-23_php-InputFilter.patch
@@ -0,0 +1,12 @@
+--- a/src/InputFilter.php
++++ b/src/InputFilter.php
+@@ -276,6 +276,9 @@ class InputFilter
+ 		$attrSubSet[0] = strtolower($attrSubSet[0]);
+ 		$attrSubSet[1] = html_entity_decode(strtolower($attrSubSet[1]), ENT_QUOTES | ENT_HTML401, 'UTF-8');
+ 
++		// Remove common XSS-evasion characters
++		$attrSubSet[1] = str_replace(["\t", "\n", " ", "\0"], "", $attrSubSet[1]);
++
+ 		return (strpos($attrSubSet[1], 'expression') !== false && $attrSubSet[0] === 'style')
+ 			|| preg_match('/(?:(?:java|vb|live)script|behaviour|mocha)(?::|&colon;|&column;)/', $attrSubSet[1]) !== 0;
+ 	}
diff --git a/composer.json b/composer.json
@@ -123,6 +123,9 @@
     "patches": {
       "laminas/laminas-diactoros": {
         "Fixes HTTP Multiline Header Termination": "./build/composer_patches/4.4.4-2024-04-13_php-laminas-diactoros.patch"
+      },
+      "joomla/filter": {
+        "InputFilter:remove XSS evasion chars in attribute": "./build/composer_patches/4.4.14-2025-09-23_php-InputFilter.patch"
       }
     }
   },
diff --git a/installation/language/en-GB/langmetadata.xml b/installation/language/en-GB/langmetadata.xml
@@ -2,7 +2,7 @@
 <metafile client="installation">
 	<name>English (United Kingdom)</name>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<copyright>(C) 2005 Open Source Matters, Inc.</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
diff --git a/language/en-GB/install.xml b/language/en-GB/install.xml
@@ -3,7 +3,7 @@
 	<name>English (en-GB)</name>
 	<tag>en-GB</tag>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/language/en-GB/langmetadata.xml b/language/en-GB/langmetadata.xml
@@ -2,7 +2,7 @@
 <metafile client="site">
 	<name>English (en-GB)</name>
 	<version>4.4.14</version>
-	<creationDate>2025-04</creationDate>
+	<creationDate>2025-09</creationDate>
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
diff --git a/libraries/src/Version.php b/libraries/src/Version.php
@@ -66,15 +66,15 @@ final class Version
      * @var    string
      * @since  3.8.0
      */
-    public const EXTRA_VERSION = 'dev';
+    public const EXTRA_VERSION = '';
 
     /**
      * Development status.
      *
      * @var    string
      * @since  3.5
      */
-    public const DEV_STATUS = 'Development';
+    public const DEV_STATUS = 'Stable';
 
     /**
      * Code name.
@@ -90,15 +90,15 @@ final class Version
      * @var    string
      * @since  3.5
      */
-    public const RELDATE = '8-April-2025';
+    public const RELDATE = '30-September-2025';
 
     /**
      * Release time.
      *
      * @var    string
      * @since  3.5
      */
-    public const RELTIME = '16:01';
+    public const RELTIME = '16:00';
 
     /**
      * Release timezone.
diff --git a/plugins/system/webauthn/src/Authentication.php b/plugins/system/webauthn/src/Authentication.php
@@ -431,10 +431,10 @@ private function getUserEntity(User $user): PublicKeyCredentialUserEntity
         $repository = $this->credentialsRepository;
 
         return new PublicKeyCredentialUserEntity(
-            $user->username,
-            $repository->getHandleFromUserId($user->id),
-            $user->name,
-            $this->getAvatar($user, 64)
+            (string) $user->username,
+            (string) $repository->getHandleFromUserId($user->id),
+            (string) $user->name,
+            $user->username ? $this->getAvatar($user, 64) : ''
         );
     }
 
diff --git a/plugins/system/webauthn/src/PluginTraits/AjaxHandlerChallenge.php b/plugins/system/webauthn/src/PluginTraits/AjaxHandlerChallenge.php
@@ -73,27 +73,11 @@ public function onAjaxWebauthnChallenge(AjaxChallenge $event): void
 
         // Is the username valid?
         try {
-            $userId = UserHelper::getUserId($username);
-        } catch (\Exception $e) {
-            $userId = 0;
-        }
-
-        if ($userId <= 0) {
-            $event->addResult(false);
-
-            return;
-        }
-
-        try {
-            $myUser = Factory::getContainer()->get(UserFactoryInterface::class)->loadUserById($userId);
+            $userId = UserHelper::getUserId($username) ?: 0;
+            $myUser = $userId ? Factory::getContainer()->get(UserFactoryInterface::class)->loadUserById($userId) : new User();
         } catch (\Exception $e) {
             $myUser = new User();
-        }
-
-        if ($myUser->id != $userId || $myUser->guest) {
-            $event->addResult(false);
-
-            return;
+            $userId = 0;
         }
 
         $publicKeyCredentialRequestOptions = $this->authenticationHelper->getPubkeyRequestOptions($myUser);

Original file line number	Diff line number	Diff line change
`@@ -123,6 +123,9 @@`
`123`	`123`	`"patches": {`
`124`	`124`	`"laminas/laminas-diactoros": {`
`125`	`125`	`"Fixes HTTP Multiline Header Termination": "./build/composer_patches/4.4.4-2024-04-13_php-laminas-diactoros.patch"`
	`126`	`+ },`
	`127`	`+ "joomla/filter": {`
	`128`	`+ "InputFilter:remove XSS evasion chars in attribute": "./build/composer_patches/4.4.14-2025-09-23_php-InputFilter.patch"`
`126`	`129`	`}`
`127`	`130`	`}`
`128`	`131`	`},`