tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-09-30 05:09:06 +02:00
Code Issues Projects Releases Wiki Activity

Reword upgrading notes

Browse Source
This commit is contained in:
Damian Mooyman 2015-01-15 11:56:46 +13:00
parent 7b20f775f2
commit 87d6250ea7
1 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/en/04_Changelogs/3.1.9.md
View File

@ -5,18 +5,11 @@
### File permissions
This release makes an important change to File DataObject permissions in order to close a vulnerability in
file modification privileges. In 3.1.8 and below, any part of a website where user interaction could
potentially modify a file (such as an UploadField being used on the frontend) permissions may not be
adequately checked, meaning in some cases non-authorised (or even non-authenticated) users could
make changes to assets. This is because the File DataObject reports that any user has canEdit
privileges on it.
file modification privileges.
By default the minimum necessary permission required by any user to modify files has been changed
to CMS_ACCESS_AssetAdmin. This permission value was historically required in 3.0 and has now been restored.
In order to update a site to 3.1.9 it may be necessary to make sure that this permission requirement still makes
sense to any business logic, and it may also be necessary to apply another permission. This can be
done by creating an extension to File which applies the custom permission.
to CMS_ACCESS_AssetAdmin. If you need unauthenticated users, or users with other rights, to edit certain
files, then you will need to customise this.
E.g.
@ -28,6 +21,10 @@ E.g.
}
}
An example use case is when you want to use UploadField on the frontend, where files could be uploaded
by non-admin users, and your above logic will need to ensure that those users can edit their own files
after they have uploaded it.
## Security
This release includes an important security fix.