Merge branch '4.x' into 4.15

Author: brandonkelly

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Release Notes for Craft CMS 4
 
+## 4.14.9 - 2025-02-25
+
+- Added `craft\base\ElementTrait::$isNewSite`.
+- Added `craft\queue\jobs\PropagateElements::$isNewSite`.
+- Fixed an error that could occur when saving elements, if any dependencies defined global functions whose names conflicted with Yii’s built-in validator names, such as `string()`.
+- Fixed an error that could occur when applying field config changes if the field class didn’t exist.
+- Fixed a bug where `ancestors` and `parent` eager-loading wasn’t working on some environments. ([#16381](https://github.com/craftcms/cms/issues/16381), [#16382](https://github.com/craftcms/cms/issues/16382), [#16341](https://github.com/craftcms/cms/issues/16341))
+- Fixed a bug where asset, category, and tag relations weren’t propagating to newly-created sites for global sets. ([#16752](https://github.com/craftcms/cms/issues/16752))
+
 ## 4.14.8.1 - 2025-02-20
 
 - Fixed a bug where newly-created custom fields wouldn’t have their full settings intact for `afterSave()`.
@@ -128,7 +137,7 @@
 
 - Fixed a bug where custom fields could cause validation errors when running the `users/create` command.
 - Fixed a bug where deleting a volume folder wasn’t fully deleting asset data in descendant folders.
-- Fixed a bug where `ancestors`, `children`, `descendants`, and `parent` eager-loading wasn’t working on some environments. ([#16381](https://github.com/craftcms/cms/issues/16381), [#16382](https://github.com/craftcms/cms/issues/16382))
+- Fixed a bug where `children` and `descendants` eager-loading wasn’t working on some environments. ([#16381](https://github.com/craftcms/cms/issues/16381), [#16382](https://github.com/craftcms/cms/issues/16382))
 
 ## 4.13.8 - 2025-01-02
 
@@ -137,7 +146,7 @@
 - Fixed a bug where the password input on the Set Password page wasn’t including the “Show” button.
 - Fixed a SQL error that could occur if an element was saved with a title longer than 255 characters.
 - Fixed a bug where some UI messages began with a lowercase letter in some languages. ([#16354](https://github.com/craftcms/cms/issues/16354))
-- Fixed an RCE vulnerability.
+- Fixed an RCE vulnerability. ([CVE-2025-23209](https://www.cve.org/CVERecord?id=CVE-2025-23209))
 
 ## 4.13.7 - 2024-12-17
 

src/base/Element.php

@@ -1562,7 +1562,7 @@ private static function _mapAncestors(array $sourceElements, bool $parents): ?ar
         foreach ($elementStructureData as $elementStructureDatum) {
             foreach ($ancestorStructureData as $ancestorStructureDatum) {
                 if (
-                    $ancestorStructureDatum['structureId'] === $elementStructureDatum['structureId'] &&
+                    $ancestorStructureDatum['structureId'] == $elementStructureDatum['structureId'] &&
                     $ancestorStructureDatum['lft'] < $elementStructureDatum['lft'] &&
                     $ancestorStructureDatum['rgt'] > $elementStructureDatum['rgt'] &&
                     (!$parents || $ancestorStructureDatum['level'] == $elementStructureDatum['level'] - 1)
@@ -2323,6 +2323,8 @@ public function attributes(): array
             $names['propagating'],
             $names['propagateAll'],
             $names['newSiteIds'],
+            $names['isNewForSite'],
+            $names['isNewSite'],
             $names['resaving'],
             $names['duplicateOf'],
             $names['mergingCanonicalChanges'],
@@ -2602,7 +2604,10 @@ private function _normalizeFieldValidator(string $attribute, mixed $rule, FieldI
             array_unshift($rule, $attribute);
         }
 
-        if (is_callable($rule[1]) || $field->hasMethod($rule[1])) {
+        if (
+            (!is_string($rule[1]) || !isset(Validator::$builtInValidators[$rule[1]])) &&
+            (is_callable($rule[1]) || $field->hasMethod($rule[1]))
+        ) {
             // InlineValidator assumes that the closure is on the model being validated
             // so it won’t pass a reference to the element
             $rule['params'] = [

src/base/ElementTrait.php

@@ -189,6 +189,12 @@ trait ElementTrait
      */
     public bool $isNewForSite = false;
 
+    /**
+     * @var bool Whether this is for a newly-created site.
+     * @since 4.14.9
+     */
+    public bool $isNewSite = false;
+
     /**
      * @var bool Whether the element is being resaved by a ResaveElement job or a `resave` console command.
      * @since 3.1.22

src/config/app.php

@@ -3,7 +3,7 @@
 return [
     'id' => 'CraftCMS',
     'name' => 'Craft CMS',
-    'version' => '4.14.8.1',
+    'version' => '4.14.9',
     'schemaVersion' => '4.15.0.0',
     'minVersionRequired' => '3.7.11',
     'basePath' => dirname(__DIR__), // Defines the @app alias

src/elements/User.php

@@ -1634,7 +1634,7 @@ public function getPhoto(): ?Asset
     }
 
     /**
-     * Sets the entry’s author.
+     * Sets the user’s photo.
      *
      * @param Asset|null $photo
      */

src/fields/BaseRelationField.php

@@ -587,6 +587,7 @@ public function normalizeValue(mixed $value, ?ElementInterface $element = null):
             $value instanceof ElementQueryInterface &&
             $element?->propagating &&
             $element->isNewForSite &&
+            !$element->isNewSite &&
             !$this->targetSiteId &&
             !$this->showSiteMenu
         ) {

src/queue/jobs/PropagateElements.php

@@ -41,6 +41,12 @@ class PropagateElements extends BaseBatchedJob
      */
     public array|int|null $siteId = null;
 
+    /**
+     * @var bool Whether this is for a newly-added site.
+     * @since 4.14.9
+     */
+    public bool $isNewSite = false;
+
     /**
      * @inheritdoc
      */
@@ -81,6 +87,7 @@ protected function processItem(mixed $item): void
         /** @var ElementInterface $item */
         $item->setScenario(Element::SCENARIO_ESSENTIALS);
         $item->newSiteIds = [];
+        $item->isNewSite = $this->isNewSite;
         $supportedSiteIds = array_map(fn($siteInfo) => $siteInfo['siteId'], ElementHelper::supportedSitesForElement($item));
         $elementSiteIds = $this->siteId !== null ? array_intersect($this->siteId, $supportedSiteIds) : $supportedSiteIds;
         $elementsService = Craft::$app->getElements();

src/services/Fields.php

@@ -1606,7 +1606,7 @@ public function applyFieldSave(string $fieldUid, array $data, string $context):
             $oldColumnSuffix = !$isNewField ? $fieldRecord->getOldColumnSuffix() : null;
             $newColumns = [];
 
-            if ($class::hasContentColumn()) {
+            if (class_exists($class) && $class::hasContentColumn()) {
                 $columnType = $data['contentColumnType'];
 
                 if (is_array($columnType)) {
@@ -1629,7 +1629,7 @@ public function applyFieldSave(string $fieldUid, array $data, string $context):
             $db->getSchema()->refresh();
 
             // don't drop the field content column if the field is missing
-            if (!$isNewField && $class !== MissingField::class) {
+            if (!$isNewField && class_exists($class) && $class !== MissingField::class) {
                 $this->_dropOldFieldColumns($oldHandle, $oldColumnSuffix, $newColumns);
 
                 if ($data['handle'] !== $oldHandle || ($data['columnSuffix'] ?? null) !== $oldColumnSuffix) {

src/services/Sites.php

@@ -833,6 +833,7 @@ public function handleChangedSite(ConfigEvent $event): void
                         'siteId' => $oldPrimarySiteId,
                     ],
                     'siteId' => $site->id,
+                    'isNewSite' => true,
                 ]));
             }
         }