Merge branch '5.4' into 5

Author: github-actions[bot]

Diff for: en/02_Developer_Guides/01_Templates/11_Partial_Template_Caching.md

@@ -9,6 +9,11 @@ icon: tags
 Partial template caching is a feature that allows caching of rendered portions of templates. Cached content
 is fetched from a [cache backend](../performance/caching), instead of being regenerated for every request.
 
+> [!WARNING]
+> Accidental caching of sensitive data can lead to security vulnerabilities. Notable examples include user-specific data, CSRF tokens, and form submissions.
+> Templates can include other templates and call methods on objects, so it's not always obvious when sensitive data is cached further down in the hierarchy.
+> Ensure that you are aware of the potential data that is being cached and that it is safe to cache.
+
 ## Base syntax
 
 ```ss

Diff for: en/02_Developer_Guides/03_Forms/04_Form_Security.md

@@ -88,6 +88,12 @@ forms that have validators or security tokens (all of them by default) applied t
 (and browsers) will not cache these pages.
 See [Performance: HTTP Cache Headers](/developer_guides/performance/http_cache_headers/).
 
+## Data disclosure through template caching
+
+Forms can also be cached by the Silverstripe template caching system when the rendered `<form>` HTML tag is contained within a `<% cached %>` block. This can lead to the same data disclosure issues as HTTP caching if a form response containing user data is cached and served to another user.
+
+Templates can include other templates, as well as call methods on objects. This means it's not always obvious when using a `<% cached %>` block that a `<form>` further down in the hierarchy is being cached. Because of this you need to be mindful when using a `<% cached %>` block in your templates about the potential content that is being cached.
+
 ## Related documentation
 
 - [Security](../security)

Diff for: en/08_Changelogs/5.4.0.md

@@ -305,13 +305,13 @@ The exception was made for the following reasons:
 - [`LeftAndMain::Modals()`](api:SilverStripe\Admin\LeftAndMain::Modals()) has been deprecated. It will be removed without equivalent functionality to replace it.
 - [`ModalController::getController()`](api:SilverStripe\Admin\ModalController::getController()) has been deprecated. It will be removed without equivalent functionality to replace it.
 - [`ModalController::getName()`](api:SilverStripe\Admin\ModalController::getName()) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`CampaignAdminExtension`](api:SilverStripe\AssetAdmin\Extensions\CampaignAdminExtension) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`CMSPageEditController::addtocampaign()`](api:SilverStripe\CMS\Controllers\CMSPageEditController::addtocampaign()) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`CMSPageEditController::AddToCampaignForm()`](api:SilverStripe\CMS\Controllers\CMSPageEditController::AddToCampaignForm()) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`CMSPageEditController::getAddToCampaignForm()`](api:SilverStripe\CMS\Controllers\CMSPageEditController::getAddToCampaignForm()) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`AssetAdmin::addtocampaign()`](api:SilverStripe\AssetAdmin\Controller\AssetAdmin::addtocampaign()) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`AssetAdmin::AddToCampaignForm()`](api:SilverStripe\AssetAdmin\Controller\AssetAdmin::AddToCampaignForm()) has been deprecated. It will be removed without equivalent functionality to replace it.
-- [`AssetAdmin::getAddToCampaignForm()`](api:SilverStripe\AssetAdmin\Controller\AssetAdmin::getAddToCampaignForm()) has been deprecated. It will be removed without equivalent functionality to replace it.
+- [`CampaignAdminExtension`](api:SilverStripe\AssetAdmin\Extensions\CampaignAdminExtension) has been deprecated. It will be replaced with `SilverStripe\CampaignAdmin\Extensions\FileFormFactoryExtension`.
+- [`CMSPageEditController::addtocampaign()`](api:SilverStripe\CMS\Controllers\CMSPageEditController::addtocampaign()) has been deprecated. It will be moved to `SilverStripe\CampaignAdmin\Extensions\AddToCampaignExtension`.
+- [`CMSPageEditController::AddToCampaignForm()`](api:SilverStripe\CMS\Controllers\CMSPageEditController::AddToCampaignForm()) has been deprecated. It will be moved to `SilverStripe\CampaignAdmin\Extensions\AddToCampaignExtension`.
+- [`CMSPageEditController::getAddToCampaignForm()`](api:SilverStripe\CMS\Controllers\CMSPageEditController::getAddToCampaignForm()) has been deprecated. It will be moved to `SilverStripe\CampaignAdmin\Extensions\AddToCampaignExtension`.
+- [`AssetAdmin::addtocampaign()`](api:SilverStripe\AssetAdmin\Controller\AssetAdmin::addtocampaign()) has been deprecated. It will be moved to `SilverStripe\CampaignAdmin\Extensions\AddToCampaignExtension`.
+- [`AssetAdmin::AddToCampaignForm()`](api:SilverStripe\AssetAdmin\Controller\AssetAdmin::AddToCampaignForm()) has been deprecated. It will be moved to `SilverStripe\CampaignAdmin\Extensions\AddToCampaignExtension`.
+- [`AssetAdmin::getAddToCampaignForm()`](api:SilverStripe\AssetAdmin\Controller\AssetAdmin::getAddToCampaignForm()) has been deprecated. It will be moved to `SilverStripe\CampaignAdmin\Extensions\AddToCampaignExtension`.
 - [`ModalController::EditorExternalLink()`](api:SilverStripe\Admin\ModalController::EditorExternalLink()) has been deprecated. It will be replaced with `SilverStripe\Admin\ModalController::linkModalForm()`.
 - [`ModalController::EditorEmailLink()`](api:SilverStripe\Admin\ModalController::EditorEmailLink()) has been deprecated. It will be replaced with `SilverStripe\Admin\ModalController::linkModalForm()`.
 - [`RemoteFileModalExtension::getRequest()`](api:SilverStripe\AssetAdmin\Extensions\RemoteFileModalExtension::getRequest()) has been deprecated. Use `RemoteFileModalExtension::getOwner()->getRequest()` instead.
@@ -411,6 +411,17 @@ The exception was made for the following reasons:
 - [`CMSSiteTreeFilter::mapIDs()`](api:SilverStripe\CMS\Controllers\CMSSiteTreeFilter::mapIDs()) has been deprecated. It will be removed without equivalent functionality to replace it.
 - [`ElementSiteTreeFilterSearch`](api:DNADesign\Elemental\Controllers\ElementSiteTreeFilterSearch) has been deprecated. It will be replaced with `DNADesign\Elemental\ORM\Search\ElementalSiteTreeSearchContext`.
 - [`ElementalCMSMainExtension`](api:DNADesign\Elemental\Extensions\ElementalCMSMainExtension) has been deprecated. It will be removed without equivalent functionality to replace it.
+- The [`HTMLEditorField.fixed_row_height`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorField->fixed_row_height) configuration property has been deprecated. It will be replaced with `SilverStripe\Forms\HTMLEditor\HTMLEditorConfig.fixed_row_height`.
+- [`HTMLEditorSanitiser::patternToRegex()`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::patternToRegex()) has been deprecated. It will be replaced with `SilverStripe\Forms\HTMLEditor\HTMLEditorRuleSet::patternToRegex()`.
+- [`HTMLEditorSanitiser::addValidElements()`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::addValidElements()) has been deprecated. It will be replaced with `SilverStripe\Forms\HTMLEditor\HTMLEditorRuleSet`.
+- [`HTMLEditorSanitiser::getRuleForElement()`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::getRuleForElement()) has been deprecated. It will be replaced with `SilverStripe\Forms\HTMLEditor\HTMLEditorRuleSet::getRuleForElement()`.
+- [`HTMLEditorSanitiser::getRuleForAttribute()`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::getRuleForAttribute()) has been deprecated. It will be replaced with logic in `SilverStripe\Forms\HTMLEditor\HTMLEditorElementRule`.
+- [`HTMLEditorSanitiser::elementMatchesRule()`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::elementMatchesRule()) has been deprecated. It will be replaced with `SilverStripe\Forms\HTMLEditor\HTMLEditorRuleSet::isElementAllowed()`.
+- [`HTMLEditorSanitiser::attributeMatchesRule()`](api:SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::attributeMatchesRule()) has been deprecated. It will be replaced with `SilverStripe\Forms\HTMLEditor\HTMLEditorElementRule::isAttributeAllowed()`.
+- [`TinyMCECombinedGenerator`](api:SilverStripe\Forms\HTMLEditor\TinyMCECombinedGenerator) has been deprecated. It will be replaced with `SilverStripe\TinyMCE\TinyMCECombinedGenerator`.
+- [`TinyMCEConfig`](api:SilverStripe\Forms\HTMLEditor\TinyMCEConfig) has been deprecated. It will be replaced with `SilverStripe\TinyMCE\TinyMCEConfig`.
+- [`TinyMCEScriptGenerator`](api:SilverStripe\Forms\HTMLEditor\TinyMCEScriptGenerator) has been deprecated. It will be replaced with `SilverStripe\TinyMCE\TinyMCEScriptGenerator`.
+- [`FixtureContext::iSelectValueInAnchorDropdown()`](api:SilverStripe\CMS\Tests\Behaviour\FixtureContext::iSelectValueInAnchorDropdown()) has been deprecated. It will be replaced with `SilverStripe\CMS\Tests\Behaviour\AnchorContext::iSelectValueInAnchorDropdown()`.
 
 ## Bug fixes