• # LaraAdmin 1.13.1
  • # Security fixes
  • # Bug fixes
  • # Tests for every role
• # LaraAdmin 1.13
  • # Behaviour changes
• # Known issues

LaraAdmin 1.13.1

A security and bug-fix release. Update every site built on LaraAdmin 1.1 or 1.13. The Upgrading page explains how.

Security fixes

• Anyone could register as Super Admin. The registration form is hidden once a user exists, but POST /register with context_type=Employee still created a Super Admin. It is now refused (403) once any user exists. Check the users table of your sites for accounts you don't recognise.
• Any user with the admin panel permission could change any employee's password, the Super Admin's included. Only the employee themself or a Super Admin can now.
• These actions now check the user's module access: every module's listing data (*_dt_ajax), LA Logs details, the role hierarchy, checklist updates, quick add forms, the unique value check and refreshing upload paths.
• Field access is enforced when saving: a role can no longer write a field it may only view, even with a crafted request.
• Employee forms can no longer grant the Super Admin role.
• Renaming an upload can no longer move the file out of storage/uploads.
• Uploaded HTML and SVG files are downloaded instead of shown as pages of the site.
• Downloading a backup needs create access to Backups (view access was enough).
• Draft blog posts are no longer public.

if ($data['context_type'] == 'Employee' && \App\Models\User::count() != 0) { abort(403); }

Bug fixes

• Logins and logouts are written to LA Logs again (the listeners were never registered).
• Blog post pages failed with Undefined array key "gallery". Views that show a field the module doesn't have now render nothing for it instead of failing.
• Editing an employee removed all their roles, and the Add Employee form never assigned them.
• Customers added in the admin never got their login user.
• Creating backups failed with spatie/laravel-backup 10. config/backup.php is now included: it backs up the database and storage/uploads, and leaves the code and .env out.
• Role and permission changes now apply immediately on Redis and Memcached caches.
• New custom menus and menu access settings had no effect for roles other than Super Admin.
• Quick add (the + next to a dropdown) never reported success.
• Pages that crashed now return 404 or work: unknown records and blog categories, the password confirmation page, module search, and resource routes that had no controller method (users/create, uploads/{id} and others).
• An empty optional dropdown linked to a table no longer fails to save.
• The CRUD generator writes files as 0644 instead of world-writable 0777.

Tests for every role

The test suite now opens every page and submits every form and action as six kinds of users: a guest, a customer, an admin without module access, a read-only role, a full-access role and the Super Admin. RouteCoverageTest fails when a route is added without a test. See Customizing & Testing.

LaraAdmin 1.13

LaraAdmin 1.13 moves from Laravel 8 to Laravel 13 and runs on PHP 8.3+ (tested on PHP 8.4).

• Roles and permissions use laraadmin/entrust 7.0.
• Forms use laraadmin/html 7.0, a maintained fork of the abandoned laravelcollective/html. The Form:: and HTML:: API is unchanged.
• fruitcake/laravel-cors, doctrine/dbal and facade/ignition are no longer needed. Column changes use Laravel's native schema builder.
• Fixed: CRUD generation and module deletion, editing File, Image and Datetime fields, creating JSON fields on MySQL 8, and the Module Manager module page.
• The application keeps the Laravel 8 directory structure (app/Http/Kernel.php and so on), which Laravel 13 still supports.

Behaviour changes

• MAIL_FROM_ADDRESS must be set in .env.
• New Currency columns are DOUBLE instead of DOUBLE(15,2).
• Changing a field's type to Integer makes the column NOT NULL, the same as creating one.
• Sessions keep PHP serialization, so users stay logged in across the upgrade.

Known issues

Known issues and planned follow-ups are listed in engg-debt.md. The ones you are most likely to meet:

• Saving a Multiselect field again in Module Manager changes its column default from [] to [""].
• php artisan la:crud doesn't give the Super Admin access to the new module. Grant it in Roles or the module's Access tab. Module Manager's buttons do grant it.
• Deleting a module leaves its log types in config/laraadmin.php.
• Required fields are only validated when the form sends them.

What's Next ?