Jahia 8.2.2 Release Notes

Jahia 8.2.2 is a maintenance release primarily addressing security-related issues detailed in September security patch page.

Adopting this release is expected to be simple for environments already running Jahia 8.2.1.

This release includes two changes that could be considered breaking, depending on your environment.

Stricter file upload validations

This release introduces stricter file upload checks configurable via the property jahiaSecuredFileUpload in the jahia.properties file.

In Jahia 8.1.9.0, this property is set to true by default. Make sure to review the documentation available in the jahia.properties file to determine if and how you are impacted. This documentation is also accessible here. 

CSRF protection in /modules/api/bundles

In this release, we removed the ability for /modules/api/bundles to rely on sessions for authentication, which typically means that it will not be possible to call this endpoint from Web UIs.

We expect this use case to be extremely rare (if not inexistent) since this endpoint was primariraly created to support Jahia orchestration use cases, which are unaffected by this change. This endpoint is still reachable via other Jahia authentication mechanism (token, basic auth).

No modules were updated between Jahia 8.2.1.0 and Jahia 8.2.2.0

The following librairies were updated between Jahia 8.2.1.0 and Jahia 8.2.2.0

Docker

• ✨ Simplified Jahia configuration during startup of the Docker images and removed unnecessary dependencies

Security

• ✨ Introduced a stricter mechanism to validate file uploads, configurable using the jahiaSecuredFileUpload property. This configuration is true by default. Please see the "Breaking Changes" section of this document.