indico/indico: v3.3.10

:warning: Security fixes Fix potential SSRF issues by disallowing outgoing requests to private/internal/local IP addresses when the URL is user-provided (CVE-2026-25738) Note: There was only one place where this would have allowed returning data retrieved from such a URL to the client, and this was only accessible to authenticated users with event management privileges. Also, this vulnerability is only problematic if sensitive information is accessible via an unauthenticated HTTP GET request (e.g. in AWS cloud environments). Fix an open redirect which could help making harmful URLs look more trustworthy by linking to Indico and having it redirect the user to a malicious site Fix an XSS vulnerability related to uploaded materials (CVE-2026-25739) :tada: Improvements Log changes to event reminders in the event log (#7242) Allow sending account creation notifications to specific email addresses (#7166, #7233, thanks @duartegalvao) Support markdown in survey introduction text (#7260) Add Content-Security-Policy support (opt-in via the CSP_ENABLED setting) and send a strict CSP for material downloads (#5486, #7257, #7303, #7308) Allow admins to disable Gravatar/Identicon profile pictures via the DISABLE_GRAVATAR config option (#7210, #7251, thanks @duartegalvao, @unconventionaldotdev) Add a UI for managing predefined affiliations (#7183, #7278, thanks @duartegalvao, @unconventionaldotdev) Add support for configurable file types in Paper Peer Reviewing (#7162, #7156) Use the event's default language (or system default if not set) when creating abstract notifications instead of the user's current language (#7294) Allow cloning registration forms within an event (#3229, #6822, thanks @adam-parker1, @Emilijus-M) Allow removing countries and providing custom translated names for countries via config (#7292, #7299, thanks @jbtwist) Add link from log entry details to the related object's page where applicable (#7269, thanks @vtran99) :bug: Bugfixes Fix error when adding a user to a material ACL in a subcontribution (#7209) Fix timezone selector behaving incorrectly when choosing a custom timezone (#7214) Fix error when using shibboleth for authentication (#7213, #7215) Fix error when sending scheduled reminders using an event time placeholder (#7238) Fix rendering static text/images in poster templates (#7239) Do not revert to defaults when disabling all optional event cloners (#6833, #7245) Fix changing tracks for invited abstracts (#7061, #7240) Disallow local account passwords longer than 72 characters instead of truncating them (#7254) Fix recurrence information not being correctly included in room booking ical export (#7255) Fix weird indentation on list items in markdown field preview (#7260) Fix unique title validation for disabled regform fields (#7277) Fix DatePicker min/max limits being affected by client timezone (#7273, #7280, thanks @jbtwist) Fix validation error when choosing exactly the maximum date in a regform date field (#7288) Fix submit buttons not being enabled when modifying a markdown field using only the button bar or a keyboard shortcut (#7310) Enforce DNS checks on emails only when inviting a new user, and not when importing from CSV (#7291, thanks @duartegalvao, @unconventionaldotdev) Hide "This field is required" error while uploading files on single-file upload fields (#7325, thanks @duartegalvao, @unconventionaldotdev) :wheelchair: Accessibility Add accessible labels and tooltips to icon-only toolbar buttons in the contribution list (#7316, thanks @foxbunny) Screen reader users can now discover the page footer and conference side menu as a landmark region (#7312, thanks @foxbunny) :wrench: Internal Changes Require at least Postgres 14 during new installations. This check can be forced on older Postgres versions (even though they are end-of-life), but we make no guarantees that nothing is broken (#7232) Disallow server-side requests to private, loopback, reserved and link-local IP ranges in places where the URL is user-provided (Mastodon URL check, LaTeX image retrieval, static site generation) (#7244) Log requests to the legacy export API to indico.log (#7290) Disallow concurrent generation of category statistics (#7307)