Accent CMS 0.27.5 — safer diagrams and licence command fixes

Accent CMS 0.27.5 is available. It is a security and bug-fix release for the 0.27 line, and it does not contain the 0.28 development work. A licence with a 0.27 ceiling covers it.

You do not have to change your site or theme. Diagrams that were cached before the upgrade are rendered again once, so the first build or page view after it can take a little longer.

Security

Diagrams cannot carry script into a page. A Mermaid style, classDef or linkStyle value with a quote in it could add an event handler to the rendered diagram, and a click link could use any scheme, javascript: included. If you publish pages from a remote mount, its raw HTML is escaped, but diagrams render after that step, so a third party could publish script through a mermaid block. The Mermaid renderer now refuses such values and links. Accent also filters every server-rendered diagram, from Mermaid, Svgbob or a plugin, before it reaches the page: only SVG drawing elements are kept, and event handlers, unsafe links and stylesheets that load from other hosts are removed. If you write a diagram plugin, emit plain SVG with <text> labels: HTML inside the SVG, <foreignObject> included, is removed.

Webhook signatures are compared in constant time again. A dependency could turn the comparison behind git and CDN webhook signatures and preview tokens into code whose timing depends on the data. That timing is what an attempt to forge a signature measures. Accent now uses the fixed version.

Fixes

• accent license activate fails when it refuses a key. An empty or invalid key printed an error but exited with status 0, so a CI job that installs a key could not tell it failed. It now exits with status 1. buy and renew do the same when the key they receive is refused or never arrives.
• accent license deactivate removes any key in config.yaml. An invalid or expired key was reported as “no licence key configured” and stayed in the file. When ACCENTCMS_LICENSE is set, the command now says the server keeps using that key.
• accent license renew and refund work outside a site directory, with the key in ACCENTCMS_LICENSE, as status already did.
• accent license refund opens the right customer portal. It opened an address that does not exist.
• The accent license buy edition prompt no longer chooses for you. An empty or unknown answer selected Standard; the prompt now asks again, and a run without a terminal must pass --edition.
• Docs pages are described as technical articles. Pages under /docs/ with a date and an author were marked up as blog posts for search engines; they are now TechArticle.

Install or upgrade

curl -fsSL https://accentcms.dev/install.sh | sh

Binaries for all platforms, checksums and signatures are on the GitHub release page.