tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

Merge branch '4.8' into 4

Browse Source
This commit is contained in:
Steve Boyd 2021-06-08 12:52:47 +12:00
commit 54d832d963
1 changed files with 99 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

151
docs/en/04_Changelogs/4.8.0.md
View File

@ -1,92 +1,125 @@
# 4.8.0 (Unreleased) # 4.8.0
## Security patches
This release contains security patches. Some of those patches might require some
updates to your project.
* [CVE-2020-25817 XXE Vulnerability in CSSContentParser](https://www.silverstripe.org/download/security-releases/CVE-2020-25817)
### CVE-2020-25817 XXE Vulnerability in CSSContentParser {#CVE-2020-25817}
A tool intended for dev-only use CSSContentParser parses HTML using a the SimpleXML parser. Older versions
of libxml do not have external entity loading disabled by default. This security patches explicitly
disables external entity loading. It can be re-enabled if required via [configuration](/_config/dev.yml)
## Overview ## Overview
- [Support for silverstripe/graphql v4](#graphql-v4) - [Security considerations](#security-considerations)
- [Features and enhancements](#features-and-enhancements)
- [Support for silverstripe/graphql v4](#graphql-v4)
- [GraphQL 3 code moved to _legacy folder](#graphql-v3-legacy)
- [Improvements to the login form template and signed in period](#default-period)
- [Other new features](#other-features)
- [Bugfixes](#bugfixes)
## New features A full list of module versions included in CMS Recipe 4.8.0 is provided below. We recommend referencing recipes in your dependencies, rather than individual modules, to simplify version tracking. See [Recipes](/getting_started/).
* [Added a `chunkedFetch()` method to `DataList`](/Developer_Guides/Model/Lists#chunkedFetch) to avoid loading large result sets in memory all at once. <details>
<summary>Included module versions</summary>
| Module | Version |
| ------ | ------- |
| silverstripe/admin | 1.8.0 |
| silverstripe/asset-admin | 1.8.0 |
| silverstripe/assets | 1.8.0 |
| silverstripe/campaign-admin | 1.8.0 |
| silverstripe/cms | 1.8.0 |
| silverstripe/config | 1.1.0 |
| silverstripe/errorpage | 1.8.0 |
| silverstripe/framework | 4.8.0 |
| silverstripe/graphql | 3.5.0 |
| silverstripe/login-forms | 4.4.1 |
| silverstripe/mimevalidator | 2.1.1 |
| silverstripe/reports | 4.8.0 |
| silverstripe/siteconfig | 4.8.0 |
| silverstripe/versioned | 1.8.0 |
| silverstripe/versioned-admin | 1.8.0 |
</details>
Upgrading to Recipe {{ version }} is recommended for all sites. This upgrade can be carried out by any development team familiar with Silverstripe.
## Security considerations {#security-considerations}
This release includes security fixes. Please see the release announcements for more detailed
descriptions of each. We highly encourage upgrading your project to include the latest security patches nonetheless.
We have provided a high-level severity rating of the vulnerabilities below based on the CVSS score, however please note this could vary based on the specifics of each project. You can [read the severity rating definitions in the Silverstripe CMS release process](/contributing/release_process/#severity-rating).
* [CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth](https://www.silverstripe.org/download/security-releases/CVE-2020-26136) Severity: Medium
* [CVE-2020-25817 XXE Vulnerability in CSSContentParser](https://www.silverstripe.org/download/security-releases/CVE-2020-25817) Severity: Low
* [CVE-2020-26138 Validate custom multi-file uploads](https://www.silverstripe.org/download/security-releases/CVE-2020-26138) Severity: Low
## Features and enhancements {#features-and-enhancements}
### Support for silverstripe/graphql v4 {#graphql-v4} ### Support for silverstripe/graphql v4 {#graphql-v4}
The [silverstripe/graphql](http://github.com/silverstripe/silverstripe-graphql/issues) module The [silverstripe/graphql](http://github.com/silverstripe/silverstripe-graphql/issues) module is used
to drive various parts of the CMS UI, as well as building your own GraphQL APIs in Silverstripe projects. to drive various parts of the CMS UI, as well as to build your own GraphQL APIs in your Silverstripe CMS projects.
The CMS currently ships with `silverstripe/graphql:^3`, which is stable but slow for larger schemas. The CMS currently ships with `silverstripe/graphql:^3.5`, which is stable but slow for larger schemas.
The module was rewritten from scratch with performance in mind The module was rewritten from scratch with performance in mind.
(see [goals](https://github.com/silverstripe/silverstripe-framework/issues/8824) and [pull request](https://github.com/silverstripe/silverstripe-graphql/pulls)).
The resulting`silverstripe/graphql:^4` release is currently in a alpha stage.
We encourage everyone to get started, read our new [GraphQL documentation](https://docs.silverstripe.org/en/4/developer_guides/graphql/),
provide [feedback](https://github.com/silverstripe/silverstripe-graphql/issues) and help us stabilise the module.
In order to facilitate the new module release, most GraphQL helper classes to drive the CMS UI If you want to learn more about the development of `silverstripe/graphql` v4:
have been marked as deprecated, and moved to `GraphQL/_legacy` folders within core modules. - review [Epic: Scaling decoupled CMS usage (GraphQL performance)](https://github.com/silverstripe/silverstripe-framework/issues/8824) to better understand the goals
The GraphQL schema under `admin/graphql` has been altered slightly to enable forwards compability, - look at the [`silverstripe/graphql` pull requests](https://github.com/silverstripe/silverstripe-graphql/pulls) to see exactly what has changed.
with lower-camelcase field names, and a different filter argument structure.
In the unlikely case that you are relying on those classes or queries directly, The resulting`silverstripe/graphql:^4` release is currently in an alpha stage.
consider upgrading to `silverstripe/graphql:^4`.
Your own GraphQL schemas outside of `admin/graphql` should not be affected by the changes
if you choose to stay on `silverstripe/graphql:^3` for the time being.
We are planning to require the use of `silverstripe/graphql:^4` in a future CMS 4.x release. We are planning to require the use of `silverstripe/graphql:^4` in a future CMS 4.x release.
#### Start using Silverstripe GraphQL v4 today
We encourage everyone to get started working with GraphQL v4 today:
- You can start by reading our new [GraphQL documentation](https://docs.silverstripe.org/en/4/developer_guides/graphql/).
- You can provide [feedback](https://github.com/silverstripe/silverstripe-graphql/issues) and help us stabilise the module.
If your project uses `silverstripe/recipe-cms`, it is still locked to `silverstripe/graphql:^3.5`.
To use `silverstripe/graphql:^4`, you'll need to "inline" the `silverstripe/recipe-cms` requirements
in your root `composer.json` and change `silverstripe/graphql` to `^4`.
You can inline `silverstripe/recipe-cms` by running this command:
```bash
composer update-recipe silverstripe/recipe-cms
```
Alternatively, you can remove `silverstripe/recipe-cms` from your root `composer.json` and replace
it with the the contents of the `composer.json` in `silverstripe/recipe-cms`.
#### GraphQL 3 code moved to _legacy folder #### GraphQL 3 code moved to _legacy folder
You will notice that many of the core modules now have a `_legacy` directory in their root. You will notice that many of the core modules now have a `_legacy` directory in their root.
In order to facilitate the new module release, most GraphQL helper classes to drive the CMS UI
have been marked as deprecated, and moved to `GraphQL/_legacy` folders within core modules.
This is a temporary fix that we have applied to satisfy the competing interests of semver and This is a temporary fix that we have applied to satisfy the competing interests of semver and
PSR-4 autoloading. PSR-4 autoloading.
Because the semver contract precludes changing the fully-qualified names of any classes, The GraphQL schema under `admin/graphql` has been altered slightly to enable forwards compatibility,
we need to keep GraphQL 3 code untouched. But GraphQL 4 code often contains classes of similar with lower-camelcase field names, and a different filter argument structure.
or identical names, e.g. "ReadFilesResolver", or something to that effect. Further, this In the unlikely case that you are relying on those classes or queries directly,
backward compatibility creates a common demand for the canonical namespace "GraphQL.", e.g. consider upgrading to `silverstripe/graphql:^4`.
`SilverStripe\AssetAdmin\GraphQL`. It didn't seem appropriate to put _old_ code in the "GraphQL"
space, and _new_ code in a less obvious place, like `SilverStripe\AssetAdmin\GraphQL4`.
A simple fix would have been to stuff all the GraphQL 3 code into `code/GraphQL/_legacy` and use `classmap` to shim the PSR-4 autoloader, but this is [no longer supported](https://blog.packagist.com/composer-2-0-is-now-available/#3-backwards-compatibility-breaks) in Composer 2.0. Your own GraphQL schemas outside of `admin/graphql` should not be affected by the changes
if you choose to stay on `silverstripe/graphql:^3` for the time being.
Thus, we ended up with the "least bad" solution, which was to create a parallel path resolution
for GraphQL 3 code in the `_legacy` folder, alongside `code/` / `src/`.
It is likely that in the future, we will mandate the use of GraphQL 4 in Silverstripe CMS, and It is likely that in the future, we will mandate the use of GraphQL 4 in Silverstripe CMS, and
remove this shim. We expect this happen within just one minor release, making `_legacy/` a very short-lived workaround. remove this shim. We expect this will happen within just one minor release, making `_legacy/` a very
short-lived workaround.
## Enhancements ### Improvements to the login form template and signed in period {#default-period}
### Default time period for log in form "remember me" checkbox reduced from 90 to 30 days We’ve reduced the time period of the “Keep me signed in” checkbox on the login form from
90 to 30 days. This time period is now also visible in the label. This value is configurable via `SilverStripe\Security\RememberLoginHash::token_expiry_days`.
Based on feedback from users, we've reduced the time period of the "remember me" checkbox on the login form from This change has been made to more accurately reflect what action will be taken, and give the reader more information to make a safe and secure decision. In addition to this, the [login-forms](https://addons.silverstripe.org/add-ons/silverstripe/login-forms) module includes a new popover intended to provide further information to support using the "Keep me signed in" option safely.
90 to 30 days. This value is configurable via `SilverStripe\Security\RememberLoginHash::token_expiry_days`.
## Security patches ### Other new features {#other-features}
This release contains security patches. Some of those patches might require some * [Added a `chunkedFetch()` method to `DataList`](/Developer_Guides/Model/Lists#chunkedFetch) to avoid loading large result sets in memory all at once.
updates to your project.
* [CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth](https://www.silverstripe.org/download/security-releases/CVE-2020-26136) ## Bugfixes {#bugfixes}
### CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth {#CVE-2020-26136} This release includes a number of bug fixes to improve a broad range of areas. Check the change logs for full details of these fixes split by module. Thank you to the community members that helped contribute these fixes as part of the release!
The Silverstripe CMS graphql endpoint on `/admin/graphql` can be accessed via basic authentication and bypass Multi-Factor Authentication (MFA).
The basic-auth authenticator is no longer enabled by default. The regular member authenticator is still enabled and
protects the `/admin/graphql` endpoint.
If your site does not use MFA, or you understand that it can be bypassed, then the basic authenticator can be
reinstalled with the [following configuration](/docs/en/02_Developer_Guides/19_GraphQL/04_security_and_best_practices/01_authentication.md#defining-your-own-authenticators).
<!--- Changes below this line will be automatically regenerated -->## Change Log <!--- Changes below this line will be automatically regenerated -->## Change Log