3.4.0

Fixed

• Consider image size IDs when overriding the default image size (see #7470).
• Do not require to set a media query in the image sizes.
• Fixed a potential directory traversal vulnerability.
• Fixed a severe XSS vulnerability. In this context, the insert tag flags base64_encode and base64_decode have - been removed.
• Also use simple tokens for the newsletter subscription modules (see #7446).
• Only show the root page languages in the meta wizard (see #7112).
• Correctly create the initial version in the personal data module (see #7415).
• Check if a DB driver has been configured in Config::isComplete() (see #7412).
• Correctly mark deleted versions in Versions::addToTemplate() (see #7442).
• Replace insert tags of RTE fields in the back end preview (see #7428).
• Handle nested insert tags in strip_insert_tags().
• Correctly store the model in Dbafs::addResource() (see #7440).
• Send the request token when toggling the visibility of an element (see #7406).
• Always apply the IE security fix in the Environment class (see #7453).
• Added the CSS units vw, vh, vmin and vmax (see #7417).
• Replace leafo/lessphp with oyejorge/less.php (see 7012).
• Show the correct root icon in the page/file picker (see #7409).
• Add an empty option to the image size select menu (see #7436).
• Nest wrapper elements in the back end preview (see #7434).
• Correctly handle archives being part of multiple RSS feeds (see #7398).
• Correctly handle 0 in utf8_convert_encoding() (see #7403).
• Send a 301 redirect to forward to the language root page (see #7420).
• Handle SVG images in the default back end uploader.