Editing EPrints 3.4.3 (section)

==== Security and Privacy Improvements ====
* Makes JSON export respect value set for <tt>export_as_xml</tt> to avoid exporting unintended fields.
* Sets <tt>contact_email</tt> to not export by default for better GDPR compliance.
* Rate limits failed local login attempts for a particular user.  Defaults to 10 failed login attempts in 10 minutes (using <tt>$c->{max_login_attempts}</tt> and <tt>$c->{lockout_minutes}</tt> configuration options).
* Rate limits new account requests.  Defaults to 100 requests in an hour long period to avoid causing problems with planned mass sign up events.  Configured using <tt>$c->{max_account_requests}</tt> and <tt>$c->{max_account_requests_minutes}</tt> options.
* Limits the maximum length of a password (default 200 characters) to prevent specific Denial-of-Service attacks.
* Modifies <code>latex</code> invocation to make more secure and ensure it rights to the correct output directory.
* Removes legacy <code>/cgi/latex2png</code> script to prevent Remote Code Execution (RCE) from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3342 CVE-2021-3342].
* Validates parameters passed to <code>/cgi/cal</code> script to protect against RCE and Cross Site Scripting (XSS) from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26475 CVE-2021-26475] and [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26476 CVE-2021-26476].
* Validates <code>dataset</code> parameter passed to <code>/cgi/dataset_dictionary</code> to protect against XSS from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26702 CVE-2021-26702].
* Validates parameters passed to <code>/cgi/history_search</code> to protect against the possibility of XSS and MySQL injection vulnerabilities, although none currently exploitable.
* Validates <code>verb</code> passed to <code>/cgi/toolbox/toolbox</code> to protect against RCE from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26704 CVE-2021-26704].
* Allows <code>EPrints::XML::parse_string</code> to temporarily modify parser configuration to disable expanding of XML entities by the <code>/cgi/ajax/phrase</code> script to protect against [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26703 CVE-2021-26703].
* Ensure <code>eprints_lang</code> cookie explicitly sets <code>SameSite</code> attribute to <code>Lax</code> if HTTPS is not enabled or sets <code>secure</code> attribute to <code>1</code> if it is.
* Doubles (to 16) number of characters used for randomly generated password suggestions (e.g. for database user created by <code>epadmin</code>).