Merge branch '4.x' into 4.14

CHANGELOG.md

@@ -3,6 +3,8 @@
 ## Unreleased
 
 - Fixed a bug where the control panel could display a notice about the Craft CMS license belonging to a different domain, even when accessing the control panel from the correct domain. ([#16396](https://github.com/craftcms/cms/issues/16396))
+- Fixed a bug where Unicode special characters weren’t getting stripped out of search keywords. ([#16430](https://github.com/craftcms/cms/issues/16430))
+- Fixed an error that could occur when setting `relatedTo*` GraphQL arguments to `null`. ([#16431](https://github.com/craftcms/cms/issues/16431))
 
 ## 4.13.9 - 2025-01-06
 

src/config/GeneralConfig.php

@@ -2642,12 +2642,23 @@ class GeneralConfig extends BaseConfig
     /**
      * @var string A private, random, cryptographically-secure key that is used for hashing and encrypting data in [[\craft\services\Security]].
      *
-     * This value should be the same across all environments. If this key ever changes, any data that was encrypted with it will be inaccessible.
+     * ::: warning
+     * **Do not** share this key publicly. If exposed, it could lead to a compromised system.
+     * :::
+     *
+     * In the event that the key is compromised, a new secure key can be generated with the command:
+     *
+     * ```sh
+     * php craft setup/security-key
+     * ```
+     *
+     * Note that if the key changes, any data that is encrypted with it (e.g. user session cookies) will be inaccessible.
      *
      * ```php Static Config
      * ->securityKey('2cf24dba5...')
      * ```
      *
+     * @see https://craftcms.com/knowledge-base/securing-craft
      * @group Security
      */
     public string $securityKey = '';
@@ -6164,7 +6175,17 @@ public function sanitizeSvgUploads(bool $value = true): self
     /**
      * A private, random, cryptographically-secure key that is used for hashing and encrypting data in [[\craft\services\Security]].
      *
-     * This value should be the same across all environments. If this key ever changes, any data that was encrypted with it will be inaccessible.
+     * ::: warning
+     * **Do not** share this key publicly. If exposed, it could lead to a compromised system.
+     * :::
+     *
+     * In the event that the key is compromised, a new secure key can be generated with the command:
+     *
+     * ```sh
+     * php craft setup/security-key
+     * ```
+     *
+     * Note that if the key changes, any data that is encrypted with it (e.g. user session cookies) will be inaccessible.
      *
      * ```php
      * ->securityKey('2cf24dba5...')
@@ -6174,6 +6195,7 @@ public function sanitizeSvgUploads(bool $value = true): self
      * @param string $value
      * @return self
      * @see $securityKey
+     * @see https://craftcms.com/knowledge-base/securing-craft
      * @since 4.2.0
      */
     public function securityKey(string $value): self

src/gql/ElementQueryConditionBuilder.php

@@ -221,6 +221,8 @@ private function _extractArgumentValue(Node $argumentNode): mixed
                         $extractedValue[$fieldNode->name->value] = $this->_extractArgumentValue($fieldNode);
                     }
                     return $extractedValue;
+                case 'NullValue':
+                    return null;
                 default:
                     return $argumentNodeValue->value;
             }

src/helpers/Search.php

@@ -66,6 +66,10 @@ public static function normalizeKeywords(array|string $str, array $ignore = [],
             }
         }
 
+        // Get rid of Unicode special characters
+        // (see https://github.com/craftcms/cms/issues/16430)
+        $str = preg_replace('/[\x{80}-\x{10FFFF}]/u', '', $str);
+
         // Strip out new lines and superfluous spaces
         return trim(preg_replace(['/[\n\r]+/u', '/\s{2,}/u'], ' ', $str));
     }

src/services/Assets.php

@@ -334,7 +334,7 @@ public function deleteFoldersByIds(int|array $folderIds, bool $deleteDir = true)
         $assetQuery = Asset::find()->folderId($allFolderIds);
         $elementService = Craft::$app->getElements();
 
-        foreach ($assetQuery->each() as $asset) {
+        foreach (Db::each($assetQuery) as $asset) {
             /** @var Asset $asset */
             $asset->keepFileOnDelete = !$deleteDir;
             $elementService->deleteElement($asset, true);

tests/unit/helpers/SearchHelperTest.php

@@ -49,7 +49,7 @@ public function normalizeKeywordsDataProviders(): array
             ['', '&#11aa;'],
             ['test test', 'TEST TEST'],
             ['', ['♠', '♣', '♥', '♦']],
-            ['♠ ♣ ♥ ♦', ['♠', '♣', '♥', '♦'], [], false],
+            ['', ['♠', '♣', '♥', '♦'], [], false],
             ['test', 'test                       '],
             ['', 'test', ['test']],
             ['test', 'test👍'],