silverstripe-framework/docs/en/04_Changelogs/3.7.0.md

# 3.7.0

## SilverStripe 3.7 and PHP 7.2 and Object subclasses

### For Project Code

SilverStripe 3.7 now supports PHP 7.2, which is exciting, but PHP 7.2 introduces an `object` keyword.
To use it, you can replace any uses of `Object` with `SS_Object` in your own project code.

```diff
-class MyClass extends Object
+class MyClass extends SS_Object
{
	public function myFunction()
	{
-		$foo = Object::has_extension('MyExtension');
+		$foo = SS_Object::has_extension('MyExtension');
	}
}
```

You are also reliant on any SilverStripe modules directly using `Object` to upgrade their codebase.
Matches for `SS_Object` in the module codebase will tell you it's been upgraded.
A search for `extends Object` or `Object::` isn't fool proof, but will give you an indication
that the module still needs to be upgraded. If in doubt, check the module README.

### For Module Authors

If you are publishing a 3.x-compatible module that directly references the `Object` class,
we recommend that you replace all references to `Object` with `SS_Object`,
and add the following line to your module's `_config.php`
in order to support both current SilverStripe 3.x and SilverStripe 3.7 releases running on PHP 7.2:

```php
// Ensure compatibility with PHP 7.2 ("object" is a reserved word),
// with SilverStripe 3.6 (using Object) and SilverStripe 3.7 (using SS_Object)
if (!class_exists('SS_Object')) class_alias('Object', 'SS_Object');
```

Don't forget to mention explicit PHP 7.2 and SilverStripe 3.7 compatibility in your module README.

Note that in SilverStripe 4.x, the `Object` class was deleted so there isn’t an `SS_Object` class there either
(see [https://docs.silverstripe.org/en/4/changelogs/4.0.0/](changelog))

## Versioned cache segmentation

`SS_Cache` now maintains separate cache pools for each versioned stage. This prevents developers from caching draft data and then accidentally exposing it on the live stage without potentially required authorisation checks. Unless you rely on caching across stages, you don't need to change your own code for this change to take effect. Note that cache keys will be internally rewritten, causing any existing cache items to become invalid when this change is deployed.

```php
// Before:
$cache = SS_Cache::factory('myapp');
Versioned::set_reading_mode('Stage.Stage');
$cache->save('Some draft content. Not for public viewing yet.', 'my_key');
Versioned::set_reading_mode('Stage.Live');
$cache->load('my_key'); // 'Some draft content. Not for public viewing yet'

// After:
$cache = SS_Cache::factory('myapp');
Versioned::set_reading_mode('Stage.Stage');
$cache->save('Some draft content. Not for public viewing yet.', 'my_key');
Versioned::set_reading_mode('Stage.Live');
$cache->load('my_key'); // null
```
Data that is not content sensitive can be cached across stages by simply opting out of the segmented cache with the `disable-segmentation` argument.

```php
$cache = SS_Cache::factory('myapp', 'Output', array('disable-segmentation' => true));
``` 

## HTTP Cache Header changes

### Overview

In order to support developers in making safe choices around HTTP caching,
we've introduced a `HTTPCacheControl` class to control if a response
should be considered public or private. This is an abstraction on existing
lowlevel APIs like `HTTP::add_cache_headers()` and `SS_HTTPResponse->addHeader()`.

This change introduces smaller but necessary changes to HTTP caching headers
sent by SilverStripe. If you are relying on HTTP caching in your implementation,
or use modules such as [silverstripe/controllerpolicy](https://github.com/silverstripe/silverstripe-controllerpolicy),
please review the implications of these changes below. 

In short, these APIs make it easier to express your caching preferences
without running the risk of overriding essential core safety measures.
Most commonly, these APIs will prevent HTTP caching of draft content.

It will also prevent caching of content generated with an active session,
since the system can't tell whether session data was used to vary the output.
In this case, it's up to the developer to opt-in to caching,
after ensuring that certain execution paths are safe despite of using sessions.

The system behaviour does not guard against accidentally caching "private" content,
since there are too many variations under which output could be considered private
(e.g. a custom "approval" flag on a comment object). It is up to
the developer to ensure caching is used appropriately there.

By default, SilverStripe sends headers which signal to HTTP caches
that the response should be considered not cacheable.

See [Developer Guide: Performance > HTTP Cache Headers](/developer_guide/performance/http_cache_headers)
for details on the new API.

### Example Usage

#### Global opt-in for page content 

Enable caching for all page content (through `Page_Controller`).

```diff
class Page_Controller extends ContentController
{
    public function init()
    {
-        HTTP::set_cache_age(60);
+        HTTPCacheControl::inst()
+           ->enableCache()
+           ->setMaxAge(60); // 1 minute

        
        parent::init();
    }
}
```

Note: SilverStripe will still override this preference when a session is active,
a [CSRF token](/developer_guides/forms/form_security) token is present,
or draft content has been requested.

#### Opt-out for a particular controller action

If a controller output relies on session data, cookies,
permission checks or other triggers for conditional output,
you can disable caching either on a controller level
(through `init()`) or for a particular action.

```diff
class MyPage_Controller extends Page_Controller
{
    public function myprivateaction($request)
    {
        $response = $this->myPrivateResponse();
-        HTTP::set_cache_age(0);
+        HTTPCacheControl::inst()
+           ->disableCache();

        
        return $response;
    }
}
```

Note: SilverStripe will still override this preference when a session is active,
a [CSRF token](/developer_guides/forms/form_security) token is present,
or draft content has been requested.

#### Global opt-in, ignoring session (advanced)

This can be helpful in situations where forms are embedded on the website.
SilverStripe will still override this preference when draft content has been requested.
CAUTION: This mode relies on a developer examining each execution path to ensure
that no session data is used to vary output. 

Use case: By default, forms include a [CSRF token](/developer_guides/forms/form_security)
which starts a session with a value that's unique to the visitor, which makes the output uncacheable.
But any subsequent requests by this visitor will also carry a session, leading to uncacheable output
for this visitor. This is the case even if the output does not contain any forms,
and does not vary for this particular visitor.

```diff
class Page_Controller extends ContentController
{
    public function init()
    {
-        HTTP::set_cache_age(60);
+        HTTPCacheControl::inst()
+           ->enableCache($force=true) // DANGER ZONE
+           ->setMaxAge(60); // 1 minute

        
        parent::init();
    }
}
```

### Detailed Changes

 * Added `Cache-Control: no-store` header to default responses,
   to prevent intermediary HTTP proxies (e.g. CDNs) from caching unless developers opt-in
 * Removed `Cache-Control: no-transform` header from default responses
 * Removed `Vary: Cookie` as an unreliable cache buster,
   rely on the existing `Cache-Control: no-store` defaults instead
 * Removed `Vary: Accept`, since it's very uncommon to vary content on
   the `Content-Type` headers submitted through the request,
   and it can significantly decrease the likelyhood of a cache hit.
   Note this is different from `Vary: Accept-Encoding`,
   which is important for compression (e.g. gzip), and usually added by
   other layers such as Apache's mod_gzip.
<!--- Changes below this line will be automatically regenerated -->

## Change Log

### Security

 * 2018-04-24 [e4c0f271b](https://github.com/silverstripe/silverstripe-framework/commit/e4c0f271b00765b46ce85e614d0c48aad4e72630) Ensure passwords do not get added to session on submission failure (Aaron Carlino) - See [ss-2018-013](https://www.silverstripe.org/download/security-releases/ss-2018-013)

### API Changes

 * 2017-06-10 [413b4936a](https://github.com/silverstripe/silverstripe-framework/commit/413b4936a1cfe6447832c08c26a4fceb9a3a36a6) Add extension hook to FormField::extraClass() (Damian Mooyman)
 * 2016-11-28 [f16d7e183](https://github.com/silverstripe/silverstripe-framework/commit/f16d7e1838d834575738086326d1191db3a5cfd8) Deprecate unused / undesirable create_new_password implementation (Damian Mooyman)

### Features and Enhancements

 * 2018-06-07 [2b4954035](https://github.com/silverstripe/silverstripe-framework/commit/2b4954035f950beef9be8ba8e36a2b620d6aa332) Add better HTTP cache-control manipulation (#8086) (Daniel Hensby)
 * 2018-06-06 [c639ffa9c](https://github.com/silverstripe/silverstripe-framework/commit/c639ffa9ce181cdb979a5c954e912ebfc4162f42) isPopulated method to allow StringField subclasses to check existence without RAW (Aaron Carlino)
 * 2018-05-07 [dfdaac48](https://github.com/silverstripe/silverstripe-cms/commit/dfdaac48ca38e179efcfb2cfd905baa577b379fd) Backport versioned querystring fix (#2153) (Damian Mooyman)
 * 2018-05-07 [47a9cdfd4](https://github.com/silverstripe/silverstripe-framework/commit/47a9cdfd49146e769760e8d8db3f01925597de41) Backport of querystring work to 3.x (#8026) (Damian Mooyman)
 * 2017-11-30 [910381633](https://github.com/silverstripe/silverstripe-framework/commit/9103816333e790a9b7cd84994e00e0941e34de39) Add php 7.2 support (Daniel Hensby)
 * 2017-11-06 [2e43780a8](https://github.com/silverstripe/silverstripe-framework/commit/2e43780a8ae664ead109bd99c094f3873defbfea) Add sort columns to DB index automatically (Daniel Hensby)
 * 2017-09-28 [2f0a0cb63](https://github.com/silverstripe/silverstripe-framework/commit/2f0a0cb63f12c9428cce9403fdd11dd155f73116) Add (alt text) to title field for clarity (Robbie Averill)
 * 2017-08-28 [0b34066f0](https://github.com/silverstripe/silverstripe-framework/commit/0b34066f0cec8de2c1afdd717613ffab201d02a8) incorrect scalar types in doc blocks, add chainable returns in setters (Robbie Averill)
 * 2017-08-03 [8577ad128](https://github.com/silverstripe/silverstripe-framework/commit/8577ad128059f4c508f03df4e5566c09fe161be5) Added SSL support for MySQLi Connector (fixes #7242) (John)
 * 2017-08-02 [2f9bfae1f](https://github.com/silverstripe/silverstripe-framework/commit/2f9bfae1f9f6bb2d33e3f979601e0abae243a7f6) Added MySQL SSL PDO Support (John)
 * 2017-07-04 [b347ab86](https://github.com/silverstripe/silverstripe-cms/commit/b347ab866d50a589a598fa4f27fef787a24d9879) Add version provider configuration (Robbie Averill)
 * 2017-07-04 [ee4d8b4d4](https://github.com/silverstripe/silverstripe-framework/commit/ee4d8b4d4e22a25b86c90785c45cc480f8423861) Add new SilverStripeVersionProvider to provider module versions (Robbie Averill)
 * 2017-06-15 [a990c99d6](https://github.com/silverstripe/silverstripe-framework/commit/a990c99d6e6f477ab6e973ada13f9dff234682f5) suffix subfolder in silverstripe-cache with php-version (#6810) (Lukas)

### Bugfixes

 * 2018-06-07 [4a0e5b636](https://github.com/silverstripe/silverstripe-framework/commit/4a0e5b63678cab6e62f175f61040bfda7ac0ab48) Fix crash on fixed_fields in default_sort (Damian Mooyman)
 * 2018-06-04 [85a712e1c](https://github.com/silverstripe/silverstripe-framework/commit/85a712e1c9288a398de03e374a8a3bb980486d82) postgres test (Damian Mooyman)
 * 2018-06-04 [41e601a03](https://github.com/silverstripe/silverstripe-framework/commit/41e601a036307065d9ea2ba8862f67be738d402f) Regression from #8009 (Daniel Hensby)
 * 2018-06-04 [a20b0a4aa](https://github.com/silverstripe/silverstripe-framework/commit/a20b0a4aa6ea7390f20513c3205debda652f5ca0) Remove use of deprecated each method (Daniel Hensby)
 * 2018-06-01 [05a519ecc](https://github.com/silverstripe/silverstripe-framework/commit/05a519ecc5c8f68e049b68714c2ea60d9abd0e54) code style / php 5.3 compat (Damian Mooyman)
 * 2018-06-01 [c5205ecc](https://github.com/silverstripe/silverstripe-cms/commit/c5205ecc1fe291ca453c94b28e31af296219b921) Ensure errorpage is built in live mode (Damian Mooyman)
 * 2018-06-01 [2756d60da](https://github.com/silverstripe/silverstripe-framework/commit/2756d60da28e371ea16bec7d478594c1579fc77b) Prevent stage querystring args during dev/build (Damian Mooyman)
 * 2018-05-29 [1cbf27e0f](https://github.com/silverstripe/silverstripe-framework/commit/1cbf27e0f47c3547914b03193d0f5f77c87ff8d5) PHP 5.3 compat for referencing $this in closure, and make method public for same reason (Robbie Averill)
 * 2018-05-23 [b6dbae8b](https://github.com/silverstripe/silverstripe-cms/commit/b6dbae8b07911f3e3a55babbb6c671ededa2d3b4) Make RedirectorPage::Link compatible with SiteTree::Link (Daniel Hensby)
 * 2018-04-17 [af3a9f3ec](https://github.com/silverstripe/silverstripe-framework/commit/af3a9f3ec8a5465f841c5aa8ee1faf40c1b76bf4) Duplicating many_many relationships looses the extra fields (fixes #7973) (UndefinedOffset)
 * 2018-03-20 [ebd3fb652](https://github.com/silverstripe/silverstripe-framework/commit/ebd3fb6526eb3ee9359111e548d9f6b6e0323e97) Don't auto-generate indexes for Text field types (fixes #7900) (Loz Calver)
 * 2018-03-15 [61ce4771f](https://github.com/silverstripe/silverstripe-framework/commit/61ce4771f91367cbb4b8a1bf61e2af51964714df) ing HTMLEditorField API documentation (3Dgoo)
 * 2018-03-15 [d17d93f7](https://github.com/silverstripe/silverstripe-cms/commit/d17d93f784a6e01f3d396c55adc623d69a90261a) Remove SearchForm results() function from allowed_actions (Steve Dixon)
 * 2018-03-14 [97f22cbaa](https://github.com/silverstripe/silverstripe-framework/commit/97f22cbaa5d683cca2f65370a9b827314317436d) ing FormAction API documentation (3Dgoo)
 * 2018-03-01 [6523d7a6e](https://github.com/silverstripe/silverstripe-framework/commit/6523d7a6eb3905d5e3cf24120d33232e1eb5d789) ing HTMLEditorField API documentation (3Dgoo)
 * 2018-02-27 [c755f7728](https://github.com/silverstripe/silverstripe-framework/commit/c755f77288bcbd5e6777f94d8499264446b456f0) indentation (Aaron Carlino)
 * 2018-02-16 [86addea1d](https://github.com/silverstripe/silverstripe-framework/commit/86addea1d2a7b2e28ae8115279ae358bcb46648a) Split HTML manipulation to onadd, so elements are not accidentally duplicated (Christopher Joe)
 * 2018-02-13 [c767e472d](https://github.com/silverstripe/silverstripe-framework/commit/c767e472dc494408460ef47c27b8d34475da4ac6) DataObject singleton creation (Jonathon Menz)
 * 2017-12-01 [74a3ba54a](https://github.com/silverstripe/silverstripe-framework/commit/74a3ba54ae3f02158ba81622bd9933ae3e98c665) count size of $relations (Daniel Hensby)
 * 2017-11-29 [2717f0134](https://github.com/silverstripe/silverstripe-framework/commit/2717f013447069fd1879b24140dd84145ece9cef) link to nginx.org wiki (JorisDebonnet)
 * 2017-08-08 [1a4a006d0](https://github.com/silverstripe/silverstripe-framework/commit/1a4a006d09e4397c3126fcf32c61692f90834b8a) PDOConnector ssl_cipher bug fixes #7258 (John)
 * 2017-04-12 [8999f70ac](https://github.com/silverstripe/silverstripe-framework/commit/8999f70acc0fa9853c94786da8c3b5c713f8a359) ing broken search in SecurityAdmin Groups field (Sean Harvey)