RELEASENOTES.html

<h3>What's new?</h3>

<p>
	<strong>Supported PHP and Joomla! versions have changed</strong>.
	This version requires Joomla! 5.4 to 6.2 and PHP 8.1 to 8.6. Support for Joomla! 4.x, Joomla! 5.0&ndash;5.3, PHP 7.4, and PHP 8.0 has been dropped. The installer now refuses to install on a Joomla! or PHP version outside this range, instead of installing and failing later.
</p>

<p>
	<strong>Security hardening</strong>.
	This release fixes several security issues, most notably: personal data exports no longer include the user's password hash; only Super Users can export another Super User's data; backend users without access to the component could no longer run its other tasks through the URL; and stored XSS issues in the backend lists and user trails have been fixed. See the CHANGELOG for the complete list of security fixes.
</p>

<p>
	<strong>Removed legacy error handler</strong>.
	We removed our legacy custom error handler. If you are met with an Exception or PHP error when using our software, please go to your site's administrator, System, Global Configuration, and set Debug Mode to Yes and Error Reporting to Developer. Then, reproduce the error. You will get the same level of information as our now-removed error handler. It is enough to help us help you.
</p>

<p>
	<strong>Maximalist export option</strong>.
	The personal data export no longer includes the user's password hash. A new component option, Maximalist Export, controls whether the rest of the authentication material is exported: Multi-factor Authentication configuration and backup codes, &ldquo;remember me&rdquo; tokens, the Joomla! API token, and download IDs. It is enabled by default, mirroring what Joomla's own privacy export does. Set it to No to remove this material from the export and mask download IDs. Moreover, only Super Users can now export the personal data of other Super Users.
</p>

<p>
	<strong>Please reset your Joomla! API tokens</strong>.
	Joomla! submits each user's API token back to the server whenever they save their user profile. Previous versions of Akeeba Data Compliance recorded it in the user changes audit trail, where anyone who can view the audit trails, or who has a copy of your site's database, could read it. By default, only Super Users have API tokens. This version no longer records the API token. However, tokens recorded by previous versions remain in the audit trail. We recommend that all Super Users reset their Joomla! API token: edit your user profile, go to the Joomla API Token tab, set Reset to Yes, and save.
</p>

<p>
	<strong>Check your template overrides</strong>.
	The Export button on the user's data options page is now a form which submits the request with POST, instead of a link. This keeps your site's anti-CSRF token out of URLs, where it could leak through the browser history, server logs, and referrers. The Delete button no longer carries the anti-CSRF token; the token is only needed when the user confirms the deletion, which already happens through a form. The same applies to the Update and Reset buttons of the Email Templates page. If you have created a template override for the data options page (<code>com_datacompliance/options/default.php</code>) the Export button will stop working with an invalid token error. Please delete your override, or recreate it from the new version of the file.
</p>