Instead of using a temporary file to allow checks with `realpath()` to succeed, use the new `resolve_path()` helper added in a9a629b012 to replace the `realpath()` usage and allow for path resolution of files that don't exist yet.
This will allow new asset files to still be saved correctly, whilst still preventing paths outside of the assets directory to be used.
Replaces b1954e9258.
Previously, this was a self-closing tag with a value attribute. Neither are supported for the textarea tag in HTML5. It appears that browsers now are actually checking this and/or won't work with it.
Fixes#5222.
When 500 options or more are presented in a group filter, PHP `max_input_vars` limits may prevent the filter from working. This fix passes selected options through as a JSON string to get around the limits.
When using the taglist field type, the input isn't cleared after a tag has been created. This problem is described here: https://github.com/select2/select2/issues/4698
This change fixes that issue.
A field widget that allows for entering of sensitive information that can be revealed at the user's request - ie. API keys, secrets.
When a sensitive field that has been previously populated is loaded again, a placeholder is used instead of the real value, until the user opts to reveal the value. The real value is loaded via AJAX.
Credit to @tomaszstrojny for the original implementation.
Replaces #5062. Fixes#5061, #1850, perhaps #1061.
Co-authored-by: Tomasz Strojny <tomasz@init.biz>
Co-authored-by: Luke Towers <github@luketowers.ca>
The bug occurred because if specific fields aren't detected in onRefresh(), the entire Form widget HTML will be returned as the result instead of specific fields. This created a problem because the october.form.js JS is not setup to gracefully handle having the entire root form DOM node completely replaced in the middle of a request being completed. Specifically, this would cause problems when trying to detect empty tabs, and then the problems would cascade from there as there would be an instance of october.form.js attached to the page with broken references to no-longer existing DOM nodes.
This fix solves the immediate issue of `field@context` using the `dependsOn` feature breaking by ensuring that the actual final field name for a given field is used instead of the name used in the configuration of the field. Future work should probably be done to better support an entire form being re-rendered if no fields are detected in onRefresh however.
Allow plugin autoloaders to load, even on restricted pages. This allows (enabled) plugins to load their autoloaders on any pages, allowing includes in migration files to run.
Fixes#5110.
