v4.6.1 to v4.6.2 · Crafty Controller / Crafty 4

Commits on Source 49

Prepare 4.6.2 release base · 68fa6ffa
Iain Powrie authored Nov 23, 2025

68fa6ffa
Update API doc reference in base API index · e6a9c656
Iain Powrie authored Nov 24, 2025

e6a9c656
Update changelog !921 · e3906639
Iain Powrie authored Nov 24, 2025

e3906639

ShiroNeko_99 authored Nov 29, 2025 and

Weblate committed Nov 29, 2025

Currently translated at 100.0% (717 of 717 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/th/

e3058cb3

Merge remote-tracking branch 'origin/dev' into dev · b2de3143
Weblate authored Nov 29, 2025

b2de3143
Bump Orjson to 3.11.4 · e4a45772
Wout Bouckaert authored Nov 29, 2025

e4a45772
Merge branch 'weblate-crafty-controller-crafty-controller' into 'dev' · a34206b6
Iain Powrie authored Nov 30, 2025
```
Translations update from Weblate

See merge request !923
```
a34206b6

Translated (French) · 8b81f96a

Hugues Cheguillaume authored Dec 01, 2025 and

Weblate committed Dec 01, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/fr/

8b81f96a

Merge remote-tracking branch 'origin/dev' into dev · 11e98156
Weblate authored Dec 01, 2025

11e98156

Translated (Dutch) · 664805ff

Naim V authored Dec 01, 2025 and

Weblate committed Dec 01, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/nl/

664805ff

Translated (Thai) · c71701f3

ShiroNeko_99 authored Dec 01, 2025 and

Weblate committed Dec 01, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/th/

c71701f3

Translated (Thai) · d055cd6f

ShiroNeko_99 authored Dec 01, 2025 and

Weblate committed Dec 01, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/th/

d055cd6f

Fix translation parsing on creation pages to limit JS injection · f19dce4b
Andrew authored Dec 01, 2025

f19dce4b
Fix translation · 8f07b806
Andrew authored Dec 01, 2025

8f07b806

Translated (Chinese (Simplified Han script)) · 065434b4

ThrRip authored Dec 03, 2025 and

Weblate committed Dec 03, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/zh_Hans/

065434b4

Merge branch 'tweak/update-api-docs-reference' into 'dev' · adc4e439
Iain Powrie authored Dec 12, 2025
```
Update API docs reference

See merge request !921
```
adc4e439
Merge branch 'dev' into maintenance/bump-orjson · 39b4a8a9
Iain Powrie authored Dec 12, 2025

39b4a8a9
Update changelog !922 · 3b8ad216
Iain Powrie authored Dec 12, 2025

3b8ad216
Merge branch 'maintenance/bump-orjson' into 'dev' · 2620c199
Iain Powrie authored Dec 12, 2025
```
Maintenance: Bump Orjosn for Python 3.14

See merge request !922
```
2620c199
Merge branch 'weblate-crafty-controller-crafty-controller' into 'dev' · 255aba67
Iain Powrie authored Dec 12, 2025
```
Translations update from Weblate

See merge request !924
```
255aba67
Merge branch 'dev' into security/server-creation · 6868f5e0
Iain Powrie authored Dec 12, 2025

6868f5e0
Update changelog !925 · 0bc0b934
Iain Powrie authored Dec 12, 2025

0bc0b934
Merge branch 'security/server-creation' into 'dev' · df65758e
Iain Powrie authored Dec 12, 2025
```
Refactor translation parsing on creation pages

See merge request crafty-controller/crafty-4!925
```
df65758e
Replace generic Jinja `Environment` with an `ImmutableSandboxedEnvironment` · c045bfd3
Iain Powrie authored Dec 13, 2025
```
Resolves users being able to access unsafe builtin attributes w/ jinja expressions

Co-Authored-By: @rchar
```
c045bfd3
Update changelog !927 · 2e1c007c
Iain Powrie authored Dec 13, 2025

2e1c007c
replace unsafe .innerHTML calls in motd.js · a0e7915c
Scott authored Dec 13, 2025

a0e7915c
replace unsafe .innerHTML calls in details_stats.html · dbe847e5
Scott authored Dec 13, 2025

dbe847e5
restructure MOTD building in status.html to prevent injection · 18a69515
Scott authored Dec 13, 2025

18a69515
correct casing typo in status.html · 26970820
Scott authored Dec 13, 2025

26970820
add var keyword to new variables - Sonar finding · 89b7b6ca
Scott authored Dec 13, 2025

89b7b6ca
Update changelog !927 · f78e1fdf
Iain Powrie authored Dec 14, 2025

f78e1fdf

Merge branch 'security/jinja-immutable-env' into 'dev' · 42e77404

Iain Powrie authored Dec 14, 2025

Security: Prevent users being able to access unsafe builtin attributes w/ jinja expressions - CVE-2025-14700

See merge request !927

42e77404

Translated (Korean) · 59dc769f

Nam SangIk authored Dec 14, 2025 and

Weblate committed Dec 14, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/ko/

59dc769f

Translated (Russian) · 8b3a1c48

Sivel authored Dec 14, 2025 and

Weblate committed Dec 14, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/ru/

8b3a1c48

Merge remote-tracking branch 'origin/dev' into dev · 21c583e2
Weblate authored Dec 14, 2025

21c583e2
Add dummy event_data and template rendering to test webhook · 8847d35e
Iain Powrie authored Dec 14, 2025

8847d35e
Remove unused webhook event_data · ca9b6a3a
Iain Powrie authored Dec 14, 2025

ca9b6a3a
Update changelog !930 · be820ddc
Iain Powrie authored Dec 14, 2025

be820ddc
Merge branch 'bugfix/test-webhook-payload' into 'dev' · b75c3274
Iain Powrie authored Dec 14, 2025
```
Fix functionality of the webhook test button

See merge request !930
```
b75c3274
Merge branch 'weblate-crafty-controller-crafty-controller' into 'dev' · 0fbb2807
Iain Powrie authored Dec 14, 2025
```
Translations update from Weblate

See merge request !929
```
0fbb2807
Merge branch 'dev' into security/motd-parsing · 875bb7c2
Iain Powrie authored Dec 14, 2025

875bb7c2
Update changelog !928 · 20d4b52c
Iain Powrie authored Dec 14, 2025

20d4b52c

Translated (French) · 0a024588

Hugues Cheguillaume authored Dec 15, 2025 and

Weblate committed Dec 15, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/fr/

0a024588

Merge remote-tracking branch 'origin/dev' into dev · a1adfce2
Weblate authored Dec 15, 2025

a1adfce2

Translated (Russian) · edc59d82

Sivel authored Dec 15, 2025 and

Weblate committed Dec 15, 2025

Currently translated at 100.0% (721 of 721 strings)

Translation: Crafty Controller/Crafty Controller
Translate-URL: https://translate.arcadiatech.org/projects/crafty-controller/crafty-controller/ru/

edc59d82

Merge branch 'security/motd-parsing' into 'dev' · 0a30ec4f
Iain Powrie authored Dec 15, 2025
```
Security: Prevent MOTDs from being able to inject HTML - CVE-2025-14701

See merge request !928
```
0a30ec4f
Close changelog 4.6.2 · 33b7dad0
Iain Powrie authored Dec 15, 2025

33b7dad0
Merge branch 'weblate-crafty-controller-crafty-controller' into 'dev' · 9d61924d
Iain Powrie authored Dec 15, 2025
```
Translations update from Weblate

See merge request !931
```
9d61924d
Merge branch 'dev' into 'master' · 221b808e
Iain Powrie authored Dec 16, 2025
```
v4.6.2

See merge request !932
```
221b808e