Back to the changelog

• Security

  The entity link can no longer run code

  The external address associated with a flow — the button that opens the entity in a new tab — now accepts only http/https web addresses or relative paths. An address crafted to run code on click is rejected when you save or import it, and is no longer shown as a clickable link even if it had been saved in the past.

• Improvement

  Type checking on start data

  When a flow has data validation enabled, in addition to the presence of required fields their type is now checked too: for example an amount must be a number. Clearly wrong values are rejected with a clear message, while undeclared fields stay free as before.

• Improvement

  Clearer errors on events

  Creating an event subscriber without a name, or deleting an event that already has recorded occurrences, now returns an understandable message instead of a generic server error. An event's display name is also cleaned of any HTML code on save.