silverstripe-framework/docs/en/changelogs/3.0.6.md

# 3.0.6 (Not yet released)

## Overview

 * Security: Require ADMIN for `?flush=1` (stop denial of service attacks)
 ([#1692](https://github.com/silverstripe/silverstripe-framework/issues/1692))

## Details

### Security: Require ADMIN for ?flush=1

Flushing the various manifests (class, template, config) is performed through a GET
parameter (`flush=1`). Since this action requires more server resources than normal requests,
it can facilitate [denial-of-service attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack).

To prevent this, main.php now checks and only allows the flush parameter in the following cases:

 * The [environment](/topics/environment-management) is in "dev mode"
 * A user is logged in with ADMIN permissions
 * An error occurs during startup

This applies to both `flush=1` and `flush=all` (technically we only check for the existence of any parameter value)
but only through web requests made through main.php - CLI requests, or any other request that goes through
a custom start up script will still process all flush requests as normal.

## Upgrading

 * If you have created your own composite database fields, then you should amend the setValue() to allow the passing of
   an object (usually DataObject) as well as an array.

 * If you have provided your own startup scripts (ones that include core/Core.php) that can be accessed via a web
   request, you should ensure that you limit use of the flush parameter
NEW: Added DataObject::getQueriedDatabaseFields() as faster alternative to toMap() API: CompositeDBField::setValue() may be passed an object as its second argument, in addition to array. These changes provide a 15% - 20% performance improvement, and as such justify an small API change in the 3.0 branch. It will likely affect anyone who has created their own composite fields, which is fortunately not all that common. 2013-04-21 03:18:18 +02:00			`# 3.0.6 (Not yet released)`

FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692) 2013-07-18 07:09:21 +02:00			`## Overview`

			* Security: Require ADMIN for `?flush=1` (stop denial of service attacks)
			`([#1692](https://github.com/silverstripe/silverstripe-framework/issues/1692))`

			`## Details`

			`### Security: Require ADMIN for ?flush=1`

			`Flushing the various manifests (class, template, config) is performed through a GET`
			parameter (`flush=1`). Since this action requires more server resources than normal requests,
			`it can facilitate [denial-of-service attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack).`

			`To prevent this, main.php now checks and only allows the flush parameter in the following cases:`

			`* The [environment](/topics/environment-management) is in "dev mode"`
			`* A user is logged in with ADMIN permissions`
			`* An error occurs during startup`

			This applies to both `flush=1` and `flush=all` (technically we only check for the existence of any parameter value)
			`but only through web requests made through main.php - CLI requests, or any other request that goes through`
			`a custom start up script will still process all flush requests as normal.`

NEW: Added DataObject::getQueriedDatabaseFields() as faster alternative to toMap() API: CompositeDBField::setValue() may be passed an object as its second argument, in addition to array. These changes provide a 15% - 20% performance improvement, and as such justify an small API change in the 3.0 branch. It will likely affect anyone who has created their own composite fields, which is fortunately not all that common. 2013-04-21 03:18:18 +02:00			`## Upgrading`

FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692) 2013-07-18 07:09:21 +02:00			`* If you have created your own composite database fields, then you should amend the setValue() to allow the passing of`
			`an object (usually DataObject) as well as an array.`

			`* If you have provided your own startup scripts (ones that include core/Core.php) that can be accessed via a web`
			`request, you should ensure that you limit use of the flush parameter`