3.6.6

cacert.pem

@@ -1,7 +1,7 @@
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla as of: Tue Mar 29 03:12:05 2022 GMT
+## Certificate data from Mozilla as of: Tue Apr 26 03:12:05 2022 GMT
 ##
 ## This is a bundle of X.509 certificates of public Certificate Authorities
 ## (CA). These were automatically extracted from Mozilla's root certificates
@@ -14,7 +14,7 @@
 ## Just configure this file as the SSLCACertificateFile.
 ##
 ## Conversion done with mk-ca-bundle.pl version 1.29.
-## SHA256: d59c5c83ce7a7635fa95521d8d245677949b86d5574bfcc6f855b6a48f2d5566
+## SHA256: 34a54d5191775c1bd37be6cfd3f09e831e072555dc3a2e51f4a2c4b0f8ada5cc
 ##
 
 
@@ -3279,3 +3279,69 @@ PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/C
 r8deVl5c1RxYIigL9zC2L7F8AjEA8GE8p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh
 4rsUecrNIdSUtUlD
 -----END CERTIFICATE-----
+
+Telia Root CA v2
+================
+-----BEGIN CERTIFICATE-----
+MIIFdDCCA1ygAwIBAgIPAWdfJ9b+euPkrL4JWwWeMA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYT
+AkZJMRowGAYDVQQKDBFUZWxpYSBGaW5sYW5kIE95ajEZMBcGA1UEAwwQVGVsaWEgUm9vdCBDQSB2
+MjAeFw0xODExMjkxMTU1NTRaFw00MzExMjkxMTU1NTRaMEQxCzAJBgNVBAYTAkZJMRowGAYDVQQK
+DBFUZWxpYSBGaW5sYW5kIE95ajEZMBcGA1UEAwwQVGVsaWEgUm9vdCBDQSB2MjCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBALLQPwe84nvQa5n44ndp586dpAO8gm2h/oFlH0wnrI4AuhZ7
+6zBqAMCzdGh+sq/H1WKzej9Qyow2RCRj0jbpDIX2Q3bVTKFgcmfiKDOlyzG4OiIjNLh9vVYiQJ3q
+9HsDrWj8soFPmNB06o3lfc1jw6P23pLCWBnglrvFxKk9pXSW/q/5iaq9lRdU2HhE8Qx3FZLgmEKn
+pNaqIJLNwaCzlrI6hEKNfdWV5Nbb6WLEWLN5xYzTNTODn3WhUidhOPFZPY5Q4L15POdslv5e2QJl
+tI5c0BE0312/UqeBAMN/mUWZFdUXyApT7GPzmX3MaRKGwhfwAZ6/hLzRUssbkmbOpFPlob/E2wnW
+5olWK8jjfN7j/4nlNW4o6GwLI1GpJQXrSPjdscr6bAhR77cYbETKJuFzxokGgeWKrLDiKca5JLNr
+RBH0pUPCTEPlcDaMtjNXepUugqD0XBCzYYP2AgWGLnwtbNwDRm41k9V6lS/eINhbfpSQBGq6WT0E
+BXWdN6IOLj3rwaRSg/7Qa9RmjtzG6RJOHSpXqhC8fF6CfaamyfItufUXJ63RDolUK5X6wK0dmBR4
+M0KGCqlztft0DbcbMBnEWg4cJ7faGND/isgFuvGqHKI3t+ZIpEYslOqodmJHixBTB0hXbOKSTbau
+BcvcwUpej6w9GU7C7WB1K9vBykLVAgMBAAGjYzBhMB8GA1UdIwQYMBaAFHKs5DN5qkWH9v2sHZ7W
+xy+G2CQ5MB0GA1UdDgQWBBRyrOQzeapFh/b9rB2e1scvhtgkOTAOBgNVHQ8BAf8EBAMCAQYwDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAoDtZpwmUPjaE0n4vOaWWl/oRrfxn83EJ
+8rKJhGdEr7nv7ZbsnGTbMjBvZ5qsfl+yqwE2foH65IRe0qw24GtixX1LDoJt0nZi0f6X+J8wfBj5
+tFJ3gh1229MdqfDBmgC9bXXYfef6xzijnHDoRnkDry5023X4blMMA8iZGok1GTzTyVR8qPAs5m4H
+eW9q4ebqkYJpCh3DflminmtGFZhb069GHWLIzoBSSRE/yQQSwxN8PzuKlts8oB4KtItUsiRnDe+C
+y748fdHif64W1lZYudogsYMVoe+KTTJvQS8TUoKU1xrBeKJR3Stwbbca+few4GeXVtt8YVMJAygC
+QMez2P2ccGrGKMOF6eLtGpOg3kuYooQ+BXcBlj37tCAPnHICehIv1aO6UXivKitEZU61/Qrowc15
+h2Er3oBXRb9n8ZuRXqWk7FlIEA04x7D6w0RtBPV4UBySllva9bguulvP5fBqnUsvWHMtTy3EHD70
+sz+rFQ47GUGKpMFXEmZxTPpT41frYpUJnlTd0cI8Vzy9OK2YZLe4A5pTVmBds9hCG1xLEooc6+t9
+xnppxyd/pPiL8uSUZodL6ZQHCRJ5irLrdATczvREWeAWysUsWNc8e89ihmpQfTU2Zqf7N+cox9jQ
+raVplI/owd8k+BsHMYeB2F326CjYSlKArBPuUBQemMc=
+-----END CERTIFICATE-----
+
+D-TRUST BR Root CA 1 2020
+=========================
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAmCgAwIBAgIQfMmPK4TX3+oPyWWa00tNljAKBggqhkjOPQQDAzBIMQswCQYDVQQGEwJE
+RTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSIwIAYDVQQDExlELVRSVVNUIEJSIFJvb3QgQ0EgMSAy
+MDIwMB4XDTIwMDIxMTA5NDUwMFoXDTM1MDIxMTA5NDQ1OVowSDELMAkGA1UEBhMCREUxFTATBgNV
+BAoTDEQtVHJ1c3QgR21iSDEiMCAGA1UEAxMZRC1UUlVTVCBCUiBSb290IENBIDEgMjAyMDB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABMbLxyjR+4T1mu9CFCDhQ2tuda38KwOE1HaTJddZO0Flax7mNCq7
+dPYSzuht56vkPE4/RAiLzRZxy7+SmfSk1zxQVFKQhYN4lGdnoxwJGT11NIXe7WB9xwy0QVK5buXu
+QqOCAQ0wggEJMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHOREKv/VbNafAkl1bK6CKBrqx9t
+MA4GA1UdDwEB/wQEAwIBBjCBxgYDVR0fBIG+MIG7MD6gPKA6hjhodHRwOi8vY3JsLmQtdHJ1c3Qu
+bmV0L2NybC9kLXRydXN0X2JyX3Jvb3RfY2FfMV8yMDIwLmNybDB5oHegdYZzbGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwQlIlMjBSb290JTIwQ0ElMjAxJTIwMjAyMCxP
+PUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDAKBggqhkjOPQQD
+AwNpADBmAjEAlJAtE/rhY/hhY+ithXhUkZy4kzg+GkHaQBZTQgjKL47xPoFWwKrY7RjEsK70Pvom
+AjEA8yjixtsrmfu3Ubgko6SUeho/5jbiA1czijDLgsfWFBHVdWNbFJWcHwHP2NVypw87
+-----END CERTIFICATE-----
+
+D-TRUST EV Root CA 1 2020
+=========================
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAmCgAwIBAgIQXwJB13qHfEwDo6yWjfv/0DAKBggqhkjOPQQDAzBIMQswCQYDVQQGEwJE
+RTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSIwIAYDVQQDExlELVRSVVNUIEVWIFJvb3QgQ0EgMSAy
+MDIwMB4XDTIwMDIxMTEwMDAwMFoXDTM1MDIxMTA5NTk1OVowSDELMAkGA1UEBhMCREUxFTATBgNV
+BAoTDEQtVHJ1c3QgR21iSDEiMCAGA1UEAxMZRC1UUlVTVCBFViBSb290IENBIDEgMjAyMDB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABPEL3YZDIBnfl4XoIkqbz52Yv7QFJsnL46bSj8WeeHsxiamJrSc8
+ZRCC/N/DnU7wMyPE0jL1HLDfMxddxfCxivnvubcUyilKwg+pf3VlSSowZ/Rk99Yad9rDwpdhQntJ
+raOCAQ0wggEJMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFH8QARY3OqQo5FD4pPfsazK2/umL
+MA4GA1UdDwEB/wQEAwIBBjCBxgYDVR0fBIG+MIG7MD6gPKA6hjhodHRwOi8vY3JsLmQtdHJ1c3Qu
+bmV0L2NybC9kLXRydXN0X2V2X3Jvb3RfY2FfMV8yMDIwLmNybDB5oHegdYZzbGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwRVYlMjBSb290JTIwQ0ElMjAxJTIwMjAyMCxP
+PUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDAKBggqhkjOPQQD
+AwNpADBmAjEAyjzGKnXCXnViOTYAYFqLwZOZzNnbQTs7h5kXO9XMT8oi96CAy/m0sRtW9XLS/BnR
+AjEAkfcwkz8QRitxpNA7RJvAKQIFskF3UfN5Wp6OFKBOQtJbgfM0agPnIjhQW+0ZT0MW
+-----END CERTIFICATE-----

composer.json

@@ -3,7 +3,7 @@
   "description": "The Kirby 3 core",
   "license": "proprietary",
   "type": "kirby-cms",
-  "version": "3.6.5",
+  "version": "3.6.6",
   "keywords": [
     "kirby",
     "cms",

config/areas/site/dialogs.php

@@ -16,8 +16,7 @@
     'page.changeSort' => [
         'pattern' => 'pages/(:any)/changeSort',
         'load' => function (string $id) {
-            $page     = Find::page($id);
-            $position = null;
+            $page = Find::page($id);
 
             if ($page->blueprint()->num() !== 'default') {
                 throw new PermissionException([

panel/src/fiber/index.js

@@ -220,6 +220,14 @@ export default class Fiber {
 
     try {
       const url = this.url(path, options.query);
+
+      // don't even try to request a cross-origin url
+      // redirect instead.
+      if (new URL(url).origin !== location.origin) {
+        this.redirect(url);
+        return false;
+      }
+
       const response = await this.fetch(url, {
         method: options.method,
         body: this.body(options.body),

src/Cms/Blueprint.php

@@ -289,13 +289,16 @@ public static function find(string $name): array
             $file = $kirby->extension('blueprints', $name);
         }
 
+        // callback option can be return array or blueprint file path
+        if (is_callable($file) === true) {
+            $file = $file($kirby);
+        }
+
         // now ensure that we always return the data array
         if (is_string($file) === true && F::exists($file) === true) {
             return static::$loaded[$name] = Data::read($file);
         } elseif (is_array($file) === true) {
             return static::$loaded[$name] = $file;
-        } elseif (is_callable($file) === true) {
-            return static::$loaded[$name] = $file($kirby);
         }
 
         // neither a valid file nor array data

src/Cms/Roles.php

@@ -97,14 +97,20 @@ public static function factory(array $roles, array $inject = [])
      */
     public static function load(string $root = null, array $inject = [])
     {
+        $kirby = App::instance();
         $roles = new static();
 
         // load roles from plugins
-        foreach (App::instance()->extensions('blueprints') as $blueprintName => $blueprint) {
+        foreach ($kirby->extensions('blueprints') as $blueprintName => $blueprint) {
             if (substr($blueprintName, 0, 6) !== 'users/') {
                 continue;
             }
 
+            // callback option can be return array or blueprint file path
+            if (is_callable($blueprint) === true) {
+                $blueprint = $blueprint($kirby);
+            }
+
             if (is_array($blueprint) === true) {
                 $role = Role::factory($blueprint, $inject);
             } else {

src/Http/Uri.php

@@ -130,7 +130,7 @@ public function __clone()
      * Creates a new URI object
      *
      * @param array|string $props
-     * @param array $inject
+     * @param array $inject Additional props to inject if a URL string is passed
      */
     public function __construct($props = [], array $inject = [])
     {
@@ -144,10 +144,7 @@ public function __construct($props = [], array $inject = [])
 
         // parse the path and extract params
         if (empty($props['path']) === false) {
-            $extract           = Params::extract($props['path']);
-            $props['params'] ??= $extract['params'];
-            $props['path']     = $extract['path'];
-            $props['slash']  ??= $extract['slash'];
+            $props = static::parsePath($props);
         }
 
         $this->setProperties($this->props = $props);
@@ -372,11 +369,17 @@ public function setHost(string $host = null)
     }
 
     /**
-     * @param \Kirby\Http\Params|string|array|null $params
+     * @param \Kirby\Http\Params|string|array|false|null $params
      * @return $this
      */
     public function setParams($params = null)
     {
+        // ensure that the special constructor value of `false`
+        // is never passed through as it's not supported by `Params`
+        if ($params === false) {
+            $params = [];
+        }
+
         $this->params = is_a($params, 'Kirby\Http\Params') === true ? $params : new Params($params);
         return $this;
     }
@@ -539,4 +542,33 @@ public function unIdn()
         }
         return $this;
     }
+
+    /**
+     * Parses the path inside the props and extracts
+     * the params unless disabled
+     *
+     * @param array $props
+     * @return array Modified props array
+     */
+    protected static function parsePath(array $props): array
+    {
+        // extract params, the rest is the path;
+        // only do this if not explicitly disabled (set to `false`)
+        if (isset($props['params']) === false || $props['params'] !== false) {
+            $extract           = Params::extract($props['path']);
+            $props['params'] ??= $extract['params'];
+            $props['path']     = $extract['path'];
+            $props['slash']  ??= $extract['slash'];
+
+            return $props;
+        }
+
+        // use the full path;
+        // automatically detect the trailing slash from it if possible
+        if (is_string($props['path']) === true) {
+            $props['slash'] = substr($props['path'], -1, 1) === '/';
+        }
+
+        return $props;
+    }
 }

src/Toolkit/A.php

@@ -335,6 +335,29 @@ public static function last(array $array)
         return array_pop($array);
     }
 
+    /**
+     * Returns a number of random elements from an array,
+     * either in original or shuffled order
+     *
+     * @param array $array
+     * @param int $count
+     * @param bool $shuffle
+     * @return array
+     */
+    public static function random(array $array, int $count = 1, bool $shuffle = false): array
+    {
+        if ($shuffle) {
+            return array_slice(self::shuffle($array), 0, $count);
+        }
+
+        if ($count === 1) {
+            $key = array_rand($array);
+            return [$key => $array[$key]];
+        }
+
+        return self::get($array, array_rand($array, $count));
+    }
+
     /**
      * Fills an array up with additional elements to certain amount.
      *

src/Toolkit/Collection.php

@@ -870,6 +870,25 @@ public function query(array $arguments = [])
         return $result;
     }
 
+    /**
+     * Returns a new collection consisting of random elements,
+     * from the original collection, shuffled or ordered
+     *
+     * @param int $count
+     * @param bool $shuffle
+     * @return static
+     */
+    public function random(int $count = 1, bool $shuffle = false)
+    {
+        if ($shuffle) {
+            return $this->shuffle()->slice(0, $count);
+        }
+
+        $collection = clone $this;
+        $collection->data = A::random($collection->data, $count);
+        return $collection;
+    }
+
     /**
      * Removes an element from the array by key
      *

src/Toolkit/Obj.php

@@ -2,6 +2,7 @@
 
 namespace Kirby\Toolkit;
 
+use Kirby\Exception\InvalidArgumentException;
 use stdClass;
 
 /**
@@ -62,14 +63,31 @@ public function __get(string $property)
     }
 
     /**
-     * Property Getter
+     * Gets one or multiple properties of the object
      *
-     * @param string $property
-     * @param mixed $fallback
+     * @param string|array $property
+     * @param mixed $fallback If multiple properties are requested:
+     *                        Associative array of fallback values per key
      * @return mixed
      */
-    public function get(string $property, $fallback = null)
+    public function get($property, $fallback = null)
     {
+        if (is_array($property)) {
+            if ($fallback === null) {
+                $fallback = [];
+            }
+
+            if (!is_array($fallback)) {
+                throw new InvalidArgumentException('The fallback value must be an array when getting multiple properties');
+            }
+
+            $result = [];
+            foreach ($property as $key) {
+                $result[$key] = $this->$key ?? $fallback[$key] ?? null;
+            }
+            return $result;
+        }
+
         return $this->$property ?? $fallback;
     }