fix(security): backport SQL injection + auth fixes to 26.04.28 (hotfix)#35608

Closed

sfreudenthaler wants to merge 11 commits into

release-26.04.28-02from

release-26.04.28-03

Commits on May 7, 2026

fix(publisher): parameterize getPublishAuditStatuses bundle-id query

mbiuki
authored and
sfreudenthaler
committed
test(publisher): regression tests for getPublishAuditStatuses parameterization

mbiuki
authored and
sfreudenthaler
committed
Apply suggestions from code review

authored and
sfreudenthaler
committed
fix: remove duplicate placeholders block from accidental suggestion apply

mbiuki
authored and
sfreudenthaler
committed
fix(rest): require backend user + publishing-queue portlet on AuditPublishingResource

mbiuki
authored and
sfreudenthaler
committed
test: use dotCMS-specific SecurityException in AuditPublishingResourceTest

mbiuki
authored and
sfreudenthaler
committed
add AuditPublishingResourceTest to the MainSuite2a

dario-daza
authored and
sfreudenthaler
committed
use PP authorization in AuditPublishingResource instead of WebResource.InitBuilder

dario-daza
authored and
sfreudenthaler
committed
fix(publisher): add PP auth header to audit poll and prevent 500 on missing token

authored and
sfreudenthaler
committed
🏁 Publishing release version [26.04.28-03]
dotCMS-Machine-User
committed
fix(cicd): backport workflow_dispatch trigger to release-26.04.28-03

sfreudenthaler
and
claude
committed