Bump getkirby/cms from 3.2.2 to 3.3.6

[dependabot]

Bumps getkirby/cms from 3.2.2 to 3.3.6.

Release notes

Sourced from getkirby/cms's releases.

3.3.6

While we are busy working on 3.4, this release is a security patch for a minor issue related to .dev domains and reverse proxies.

About our registration block

In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server.

In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk.

To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site.

The issue

As noted by Jukka Rautanen, this installation block still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site. We've also used the chance to improve the local installation check if your site is behind a reverse proxy.

Am I affected?

You are only affected if:

1. you use a .dev domain or your site is behind a reverse proxy &
2. you have not yet registered your first Panel account on the public server &
3. someone finds your site and tries to login at yourdomain.dev/panel before you register your first account.

You are not affected if you have already created one or multiple Panel accounts (no matter if on a .dev domain or behind a reverse proxy).

3.3.5

New Features

$page->isPublished()

You can use the new $page->isPublished() method as the opposite of $page->isDraft(), which will include $page->isListed() and $page->isUnlisted() states. getkirby/ideas#375

New translation selectors

The panel DOM has new CSS multi-lang selectors, which you can use to customize the panel based on the currently selected translation.

.k-panel[data-translation=en] {}
.k-panel[data-translation-default] {}
.k-panel:not([data-translation-default]) {}
.k-panel:not([data-translation-default]) .k-field:not([data-translate]) {}

Custom collection for siblings methods

You can now pass a collection to all sibling methods to get more useful results #2321

$prevPage = $page->prev(
  $page
     ->index()
     ->listed()
     ->filterBy('template', 'text-note')
     ->sortBy('date', 'desc')  
</tr></table> 

... (truncated)

Commits

• fa549aa Update Swedish translation
• 45ceaf9 3.3.6 preparation
• 790ffbc Fix install check when a reverse proxy is used
• 91e6d07 Don't allow installation from .dev domain
• a7f2f96 Merge pull request #2526 from getkirby/release/3.3.5
• 1ad77af Release stuff
• 77e06ea New badges
• b8d7e2f Release stuff
• c51f7ff Update translations
• d6cdf29 Avoid uploading shtml files
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.