This version fixes a Download ID disclosure vulnerability. This could potentially allow a registered (not Guest) user to view the Download ID of a different user.
For more information, please consult our security advisory.
Rewritten Bleeding Edge releases. The Bleeding Edge model has been rewritten from the ground up. The scan of a Bleeding Edge category is now skipped entirely when its directory has not changed since the last scan, which removes the bulk of the per-request filesystem and database work on busy sites. Release notes are now generated automatically from a CHANGELOG file placed in the release's directory, rendered as Bootstrap 5 and Font Awesome 6 markup; the CHANGELOG file itself is consumed for that purpose, and is no longer listed as a downloadable item. This is controlled by the new “Generate changelog for BleedingEdge releases” option in the component's Options page, and replaces the old “Colorise Changelog” option, which has been removed.
Security severity flag in update streams. Joomla! 6.2 reads a akeeba.ars.common.securitybadge layout, so you can override it from your site or administrator template.
The Latest Release content plugin understands Joomla! versions past 4.x. plg_content_arslatest used to match environments against hardcoded Joomla! 3 and Joomla! 4 prefixes. It now distributes the latest items by Joomla! major version, so releases targeting Joomla! 5, 6, and later are matched correctly.
Save as Copy replaces the Copy button. The Copy toolbar button duplicated the selected records straight from the list view, with no opportunity to review the result before it was written. It has been replaced by a Save as Copy button in the edit pages of Categories, Releases, Update Streams, Automatic Item Descriptions, and Environments. You now land on the edit form, adjust whatever needs adjusting, and save. Joomla's own batch copy and move is a different feature, and is unaffected. Note that this is also the change which addresses the security issue described above.
Update streams work again in several previously broken cases. Update streams returned an error page whenever a Download ID was included in the request. Asking for an update stream as JSON returned XML instead. The literal text Array was appended to the output when the URL had no format parameter. The URLs in the update stream indices, and in the JSON update stream, had double-escaped or HTML-escaped ampersands which made them unusable. All of these are fixed.
Resumable and partial downloads no longer serve corrupt data. Every HTTP Range request — the kind made by download managers, and by browsers resuming an interrupted download — appended a fragment of Joomla's error page to the file bytes, corrupting the download. This is fixed, and covered by tests.
Joomla! 7.0 readiness. We have addressed the Joomla! APIs which are removed in Joomla! 7.0, while keeping compatibility with Joomla! 4.4 and later. mod_arsdownloads has been modernised to the module dispatcher and DI service provider pattern, matching mod_arsgraph.
Hardening. We have gone over the component with a fine-toothed comb, tightening a number of things which were not exploitable, but were closer to the line than we are comfortable with. This includes authorisation on the JSON:API read and write endpoints, the control panel housekeeping task, and the frontend Download ID edit view, as well as defence-in-depth against SQL injection in the list models. Please see the CHANGELOG below for the full list.
Bug fixes and minor improvements. Please take a look at the CHANGELOG below.