Fixed: Pages answered from the HTTP cache carry the security headers too

The HTTP cache kept each page with its Content-Type alone, and its answer is put together without the kernel - Velocity asks the cache contract directly - so a page from the cache had none of the security headers a rendered page is sent with (nosniff, frame options, referrer and permissions policy). The configured security headers are now stored with the page. The key carries the scheme, so a header meant for HTTPS only never reaches an HTTP answer.

Updated: The file manifest carries the checksums of the security fixes of the default installation.

Fixed: Velocity serves only preview images from the package store, as Apache does

Velocity's list of static paths let every file below var/storage/packages
out as a file, so package.xml, the SQL, templates and settings that
imported packages carry were readable on :8080 (package.xml answered 200
with its real content), while Apache only hands out their preview images.

The package store entry of STATIC_PATHS is now limited to png, jpeg, gif,
svg and webp files, the same set the Apache document root rules allow.
Everything else there goes to the front controller and gets its not
found page. The list is shared by the pooled server, the PHP built-in
server router and FrankenPHP, so all three change together.

Fixed: A kickstart installation no longer ends with a guessable administrator password

The kickstart.ini generator filled in "publish" as the administrator
password, the example kickstart file shipped a concrete password, and a
kickstart file without an email for the administrator skipped the account
altogether, leaving the site data's own password in place. In each case
the new site opened with a login anyone could look up.

When the kickstart file sets no password, or one of the well-known
defaults ("publish", "admin", "password", "changeme" and similar), setup
now generates a random 20-character password. It is printed once on the
console and written to var/log/initial-admin-password, readable by the
owner only, with the instruction to change it after the first login and
delete the file; the debug log only records that it happened. The
password is applied even when no administrator email is given. The
generator defaults to an empty password, and the example and dist
kickstart files no longer carry one.

Fixed: Forgot password no longer tells whether an email address has an account

The forgot password form answered an unknown address with "There is no
registered user with that email address", and the admin login's form does
the same, so anyone could test addresses one by one and learn which have
an account.

An unknown but valid address now gets the same page as a known one: the
standard template says that a mail has been sent if an account is
registered with the address. Only input that is not an email address at
all is refused, with a message that says just that. Because the page now
echoes an address that was never stored, the standard template washes
every address it prints, and the kernel only echoes a plain address with
no quoted local part or markup characters, so older designs that print
it unescaped stay safe.

Fixed: A failed login takes as long for an unknown name as for a known one

A login with a name that has no account returned at once, while a known
name with a wrong password first ran the password hash check. With the
default hash that is a quarter of a second, measured on both the site and
the admin login, so three requests per name were enough to tell which
login names exist - the first half of any password guessing attack.

When no account matches, eZUser now computes a hash of the submitted
password with the configured hash type, which costs the same as the check
it stands in for. Nothing else about the login changes.

Fixed: Every page is sent with baseline security headers by default

A default installation answered every page, the admin included, with no
X-Content-Type-Options, no framing restriction, no Referrer-Policy and no
Permissions-Policy, on Apache and on Velocity alike. The admin could be
framed by any site (clickjacking on publish and delete buttons), and
uploaded files could be sniffed into a different type by the browser.

The kernel now adds the headers configured in site.ini [HTTPHeaderSettings]
SecurityHeaders[] to its defaults: nosniff, SAMEORIGIN plus
frame-ancestors 'self', strict-origin-when-cross-origin, and a
Permissions-Policy that turns off camera, microphone, payment and USB.
An empty value drops a header, HeaderList overrides still win, names and
values that could split the response are ignored, and
Strict-Transport-Security is only sent over HTTPS and stays off until a
site opts in.