mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
Merge pull request #9971 from creative-commoners/pulls/4.8/480-log
DOC Changelog for 4.8.0
This commit is contained in:
Steve Boyd
GitHub
commit
e950494a62
@ -1,41 +1,70 @@
|
||||
# 4.8.0 (Unreleased)
|
||||
|
||||
## Security patches
|
||||
|
||||
This release contains security patches. Some of those patches might require some
|
||||
updates to your project.
|
||||
|
||||
* [CVE-2020-25817 XXE Vulnerability in CSSContentParser](https://www.silverstripe.org/download/security-releases/CVE-2020-25817)
|
||||
|
||||
### CVE-2020-25817 XXE Vulnerability in CSSContentParser {#CVE-2020-25817}
|
||||
|
||||
A tool intended for dev-only use CSSContentParser parses HTML using a the SimpleXML parser. Older versions
|
||||
of libxml do not have external entity loading disabled by default. This security patches explicitly
|
||||
disables external entity loading. It can be re-enabled if required via [configuration](/_config/dev.yml)
|
||||
# 4.8.0
|
||||
|
||||
## Overview
|
||||
|
||||
- [Support for silverstripe/graphql v4](#graphql-v4)
|
||||
- [Security considerations](#security-considerations)
|
||||
- [Features and enhancements](#features-and-enhancements)
|
||||
- [Support for silverstripe/graphql v4](#graphql-v4)
|
||||
- [GraphQL 3 code moved to _legacy folder](#graphql-v3-legacy)
|
||||
- [Improvements to the login form template and signed in period](#default-period)
|
||||
- [Other new features](#other-features)
|
||||
- [Bugfixes](#bugfixes)
|
||||
|
||||
## New features
|
||||
A full list of module versions included in CMS Recipe 4.8.0 is provided below. We recommend referencing recipes in your dependencies, rather than individual modules, to simplify version tracking. See [Recipes](/getting_started/).
|
||||
|
||||
* [Added a `chunkedFetch()` method to `DataList`](/Developer_Guides/Model/Lists#chunkedFetch) to avoid loading large result sets in memory all at once.
|
||||
<details>
|
||||
<summary>Included module versions</summary>
|
||||
|
||||
| Module | Version |
|
||||
| ------ | ------- |
|
||||
| silverstripe/admin | 1.8.0 |
|
||||
| silverstripe/asset-admin | 1.8.0 |
|
||||
| silverstripe/assets | 1.8.0 |
|
||||
| silverstripe/campaign-admin | 1.8.0 |
|
||||
| silverstripe/cms | 1.8.0 |
|
||||
| silverstripe/config | 1.1.0 |
|
||||
| silverstripe/errorpage | 1.8.0 |
|
||||
| silverstripe/framework | 4.8.0 |
|
||||
| silverstripe/graphql | 3.5.0 |
|
||||
| silverstripe/login-forms | 4.4.1 |
|
||||
| silverstripe/mimevalidator | 2.1.1 |
|
||||
| silverstripe/reports | 4.8.0 |
|
||||
| silverstripe/siteconfig | 4.8.0 |
|
||||
| silverstripe/versioned | 1.8.0 |
|
||||
| silverstripe/versioned-admin | 1.8.0 |
|
||||
|
||||
</details>
|
||||
|
||||
Upgrading to Recipe {{ version }} is recommended for all sites. This upgrade can be carried out by any development team familiar with Silverstripe.
|
||||
|
||||
## Security considerations {#security-considerations}
|
||||
|
||||
This release includes security fixes. Please see the release announcements for more detailed
|
||||
descriptions of each. We highly encourage upgrading your project to include the latest security patches nonetheless.
|
||||
|
||||
We have provided a high-level severity rating of the vulnerabilities below based on the CVSS score, however please note this could vary based on the specifics of each project. You can [read the severity rating definitions in the Silverstripe CMS release process](/contributing/release_process/#severity-rating).
|
||||
|
||||
* [CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth](https://www.silverstripe.org/download/security-releases/CVE-2020-26136) Severity: Medium
|
||||
* [CVE-2020-25817 XXE Vulnerability in CSSContentParser](https://www.silverstripe.org/download/security-releases/CVE-2020-25817) Severity: Low
|
||||
* [CVE-2020-26138 Validate custom multi-file uploads](https://www.silverstripe.org/download/security-releases/CVE-2020-26138) Severity: Low
|
||||
|
||||
## Features and enhancements {#features-and-enhancements}
|
||||
|
||||
### Support for silverstripe/graphql v4 {#graphql-v4}
|
||||
|
||||
The [silverstripe/graphql](http://github.com/silverstripe/silverstripe-graphql/issues) module
|
||||
The [silverstripe/graphql](http://github.com/silverstripe/silverstripe-graphql/issues) module is used
|
||||
to drive various parts of the CMS UI, as well as building your own GraphQL APIs in Silverstripe projects.
|
||||
|
||||
The CMS currently ships with `silverstripe/graphql:^3`, which is stable but slow for larger schemas.
|
||||
The module was rewritten from scratch with performance in mind
|
||||
(see [goals](https://github.com/silverstripe/silverstripe-framework/issues/8824) and [pull request](https://github.com/silverstripe/silverstripe-graphql/pulls)).
|
||||
The resulting`silverstripe/graphql:^4` release is currently in a alpha stage.
|
||||
The resulting`silverstripe/graphql:^4` release is currently in an alpha stage.
|
||||
We encourage everyone to get started, read our new [GraphQL documentation](https://docs.silverstripe.org/en/4/developer_guides/graphql/),
|
||||
provide [feedback](https://github.com/silverstripe/silverstripe-graphql/issues) and help us stabilise the module.
|
||||
|
||||
In order to facilitate the new module release, most GraphQL helper classes to drive the CMS UI
|
||||
have been marked as deprecated, and moved to `GraphQL/_legacy` folders within core modules.
|
||||
The GraphQL schema under `admin/graphql` has been altered slightly to enable forwards compability,
|
||||
The GraphQL schema under `admin/graphql` has been altered slightly to enable forwards compatibility,
|
||||
with lower-camelcase field names, and a different filter argument structure.
|
||||
In the unlikely case that you are relying on those classes or queries directly,
|
||||
consider upgrading to `silverstripe/graphql:^4`.
|
||||
@ -44,7 +73,9 @@ if you choose to stay on `silverstripe/graphql:^3` for the time being.
|
||||
|
||||
We are planning to require the use of `silverstripe/graphql:^4` in a future CMS 4.x release.
|
||||
|
||||
#### GraphQL 3 code moved to _legacy folder
|
||||
If your project uses `silverstripe/recipe-cms`, please note that it is still locked to use `silverstripe/graphql:^3`. If you'd like to now use `silverstripe/graphql:^4` then you'll need remove `silverstripe/recipe-cms` from your root composer.json, and instead copy the contents of the composer.json in silverstripe/recipe-cms to your root composer.json and change `silverstripe/graphql` to `^4`.
|
||||
|
||||
### GraphQL 3 code moved to _legacy folder {#graphql-v3-legacy}
|
||||
|
||||
You will notice that many of the core modules now have a `_legacy` directory in their root.
|
||||
This is a temporary fix that we have applied to satisfy the competing interests of semver and
|
||||
@ -65,28 +96,21 @@ for GraphQL 3 code in the `_legacy` folder, alongside `code/` / `src/`.
|
||||
It is likely that in the future, we will mandate the use of GraphQL 4 in Silverstripe CMS, and
|
||||
remove this shim. We expect this happen within just one minor release, making `_legacy/` a very short-lived workaround.
|
||||
|
||||
## Enhancements
|
||||
### Improvements to the login form template and signed in period {#default-period}
|
||||
|
||||
### Default time period for log in form "remember me" checkbox reduced from 90 to 30 days
|
||||
We’ve reduced the time period of the “Keep me signed in” checkbox on the login form from
|
||||
90 to 30 days. This time period is now also visible in the label. This value is configurable via `SilverStripe\Security\RememberLoginHash::token_expiry_days`.
|
||||
|
||||
Based on feedback from users, we've reduced the time period of the "remember me" checkbox on the login form from
|
||||
90 to 30 days. This value is configurable via `SilverStripe\Security\RememberLoginHash::token_expiry_days`.
|
||||
This change has been made to more accurately reflect what action will be taken, and give the reader more information to make a safe and secure decision. In addition to this, the [login-forms](https://addons.silverstripe.org/add-ons/silverstripe/login-forms) module includes a new popover intended to provide further information to support using the "Keep me signed in" option safely.
|
||||
|
||||
## Security patches
|
||||
### Other new features {#other-features}
|
||||
|
||||
This release contains security patches. Some of those patches might require some
|
||||
updates to your project.
|
||||
* [Added a `chunkedFetch()` method to `DataList`](/Developer_Guides/Model/Lists#chunkedFetch) to avoid loading large result sets in memory all at once.
|
||||
|
||||
* [CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth](https://www.silverstripe.org/download/security-releases/CVE-2020-26136)
|
||||
## Bugfixes {#bugfixes}
|
||||
|
||||
### CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth {#CVE-2020-26136}
|
||||
This release includes a number of bug fixes to improve a broad range of areas. Check the change logs for full details of these fixes split by module. Thank you to the community members that helped contribute these fixes as part of the release!
|
||||
|
||||
The Silverstripe CMS graphql endpoint on `/admin/graphql` can be accessed via basic authentication and bypass Multi-Factor Authentication (MFA).
|
||||
The basic-auth authenticator is no longer enabled by default. The regular member authenticator is still enabled and
|
||||
protects the `/admin/graphql` endpoint.
|
||||
|
||||
If your site does not use MFA, or you understand that it can be bypassed, then the basic authenticator can be
|
||||
reinstalled with the [following configuration](/docs/en/02_Developer_Guides/19_GraphQL/04_security_and_best_practices/01_authentication.md#defining-your-own-authenticators).
|
||||
<!--- Changes below this line will be automatically regenerated -->## Change Log
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user