Ingo Schommer
15c7252af0
beforeMemberLoggedIn/beforeMemberLoggedOut hooks
...
Required to save/restore parts of the session information,
which Member nukes indiscriminately on logout.
Specific use case is restoring linkages to temporary databases
on Behat test runs.
2013-12-18 18:26:01 +01:00
Sean Harvey
70c23f37de
Merge pull request #2608 from andrewvt/3.1
...
added removeFromGroupByCode() function to Member.php
2013-11-03 12:27:10 -08:00
andrewvt
953dec8863
Updated group filter
...
Updated group filter
2013-11-01 07:22:13 -04:00
Devlin
6c6ab7b0ce
Bad redirect in ChangePasswordForm->doChangePassword()
2013-10-30 09:57:28 +01:00
andrewvt
9a11c643da
added removeFromGroupByCode() function to Member.php
...
I was using the addToGroupByCode() function today and it would have been handy to have a removeFromGroupByCode() so I decided to add one.
2013-10-24 16:57:00 -04:00
Mateusz Uzdowski
1a39f61598
BUG Fix the password reset message to be shown consistently.
...
If we detect any of the password reset GET params, it's safe to assume
that someone intended a password reset, regardless of other conditions.
2013-10-25 09:29:21 +13:00
Ingo Schommer
d7e10e620a
Merge pull request #2537 from wilr/membervalidator
...
FIX: Use Injector API for managing Member_Validator instance.
2013-10-23 03:01:15 -07:00
Will Rossiter
813d34b15e
FIX: Use Injector API for managing Member_Validator instance.
...
Updates the CMS profile page and SecurityAdmin to give developers a few ways to customise the required fields.
Added extension hook updateValidator for getValidator for things like modules to inject required fields to go along with Injector for replacing the entire class for project specific use.
2013-10-16 11:29:43 +13:00
Devlin
5ea314d012
FIX PasswordValidator->characterStrength() Documentation
2013-10-15 12:44:50 +02:00
Will Rossiter
b0f38f4990
Change default message to be credential agnostic.
2013-10-11 11:22:15 +13:00
Ingo Schommer
cd225f0fa4
No HTML entities in "Groups" ListboxField ( fixes #2513 )
2013-10-10 12:08:16 +02:00
Damian Mooyman
5bbea12b45
BUG Issue with login form failing to login in certain situations. Fixes issue #2424
2013-10-03 17:12:30 +13:00
Ingo Schommer
0ea7042443
$privileged_permissions visibility ( fixes #2464 )
2013-09-27 18:56:38 +02:00
Ingo Schommer
03d1d58148
Merge remote-tracking branch 'origin/3.0' into 3.1
...
Conflicts:
admin/code/SecurityAdmin.php
css/AssetUploadField.css
docs/en/topics/configuration.md
security/PermissionRole.php
2013-09-12 17:33:36 +02:00
Ingo Schommer
c2b312d76f
Merge remote-tracking branch 'origin/3.1.0' into 3.1
2013-09-12 17:24:42 +02:00
Ingo Schommer
f803704d91
FIX Disallow permissions assign for APPLY_ROLES (SS-2013-005)
...
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:43 +02:00
Ingo Schommer
05757efceb
FIX Privilege escalation through APPLY_ROLES assignment (SS-2013-005)
...
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:43 +02:00
Ingo Schommer
720c149aee
FIX Privilege escalation through Group hierarchy setting (SS-2013-003)
...
See http://www.silverstripe.org/ss-2013-003-privilege-escalation-through-group-hierarchy-setting/
2013-09-12 15:42:42 +02:00
Ingo Schommer
091c096dbf
FIX Disallow permissions assign for APPLY_ROLES (SS-2013-005)
...
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:36 +02:00
Ingo Schommer
cfa88adf4b
FIX Privilege escalation through APPLY_ROLES assignment (SS-2013-005)
...
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:36 +02:00
Ingo Schommer
68ca47b0dd
FIX Privilege escalation through Group hierarchy setting (SS-2013-003)
...
See http://www.silverstripe.org/ss-2013-003-privilege-escalation-through-group-hierarchy-setting/
2013-09-12 15:42:35 +02:00
Sean Harvey
e43ca931d6
Merge pull request #2343 from chillu/pulls/security-404
...
Returning 404 on /Security, instead of Controller.ss template
2013-09-05 18:56:23 -07:00
Ingo Schommer
1c31c098ee
FIX Correct Zend_Locale fallbacks in i18n/DateField/DateTimeField
...
Due to the recent change of translations to transifex, some
locales changed their names, which prompted a fix to
i18n::get_available_translations() (see 00ffe7294
).
This caused a regression where short locales are determined
from the YAML file names (e.g. "en"), but weren't matched up
with fully qualified locales from get_available_translations() (e.g. "en_US").
Since this list is used in the admin/myprofile dropdown for the Member.Locale value,
it didn't match up with any entries and defaulted to the first one ("Africaans").
Note that the behaviour of admin/myprofile is still a bit weird:
It defaults the locale on new members to the one set for the current administrator.
So if a site defaults to en_US in _config.php, but the admin happens to view
his backend in de_DE, all members he creates default to de_DE as well.
Thanks to @tractorcow for contributing and peer reviewing!
2013-08-30 10:18:00 +02:00
Ingo Schommer
20b49e215c
Merge pull request #2136 from nedmas/fix-remove-export-button-padding
...
FIX: GridField button styling
2013-08-30 00:24:21 -07:00
Simon Welsh
151baeede1
Correct line length and indentation
2013-08-21 18:54:05 +12:00
Ingo Schommer
18ae4c5db6
Returning 404 on /Security, instead of Controller.ss template
...
We shouldn't expose unsolicited content on public URLs,
mainly because it impacts SEO.
2013-08-20 21:12:55 +02:00
Mateusz Uzdowski
085d2e62cb
BUG MemberLoginForm fields should be tagged as required.
2013-08-12 09:32:03 +12:00
Julian Seidenberg
17e0432252
BUG adding a more descriptive message when the CMS session times out. It used to say "Forbidden", now it says "Not logged in".
2013-08-06 17:27:37 +12:00
Mateusz Uzdowski
d4a6f7304e
BUG First error should take precedence here. No further checks needed.
2013-07-19 08:54:52 +12:00
Ingo Schommer
d4a1e6d294
BUG Prevent clickjacking in CMS and Security controllers ( fixes #2215 )
2013-07-14 22:44:09 +02:00
Ingo Schommer
b58e2dbe3a
Member.lock_out_delay_mins configurable, password security docs
2013-07-11 09:47:28 +02:00
Simon Welsh
1d5ac5876b
Only redirect on logout if we're not already redirecting
2013-06-27 09:49:10 +12:00
Tom Densham
3596892001
FIX: GridField button styling
...
Remove all top/bottom margins from buttons and apply to GridFieldButtonRow component. Ensure that all buttons are added to a suitable GridFieldButtonRow in ModelAdmin, SecurityAdmin and Group.
2013-06-21 14:22:00 +01:00
Stig Lindqvist
2eafd63297
Merge pull request #2077 from halkyon/changepassword_validation_redirection_issue
...
BUG If BackURL set, validation errors send the user to wrong place.
2013-06-07 22:44:13 -07:00
Sean Harvey
83bff54ec2
BUG If BackURL set, validation errors send the user to wrong place.
...
If there's validation errors in the ChangePasswordForm, the user
is taken to the BackURL because redirectBack() will go there if
it's set.
Instead of this, just redirect back to the "changepassword" action
on the Security controller.
2013-06-08 11:34:58 +12:00
Sean Harvey
7862ececbd
Allow PasswordValidator to be translated
2013-06-08 10:48:27 +12:00
Will Morgan
1c0ae76f8e
Adding passwordless message instead of throwing an exception
2013-06-07 16:52:44 +02:00
Sam Minnée
628391e3f1
Merge pull request #1979 from nedmas/patch-1
...
BUGFIX: singleton('Group')->Members() fails
2013-05-24 19:45:54 -07:00
Ingo Schommer
016368afdc
Merge pull request #1994 from mateusz/logout-cleanup
...
BUG Clean up the logOut and session destructon routines.
2013-05-24 16:01:42 -07:00
Tom Densham
d36fbfb1b2
BUGFIX: singleton('Group')->Members() fails
...
Running Members() on a Group that has no Db record causes UnsavedRelationList to be returned by DirectMembers() which in turn causes alterDataQuery() to fall over when called on an UnsavedRelationList. This just adds a simple check to prevent it.
2013-05-23 17:31:19 +02:00
Sean Harvey
ac2216dabc
Merge pull request #1969 from robert-h-curry/patch-1
...
Only show direct members of a group in the members field
2013-05-22 20:28:17 -07:00
Mateusz Uzdowski
2f7fd967b2
BUG Clean up the logOut and session destructon routines.
2013-05-23 13:27:41 +12:00
Ingo Schommer
ee784c3663
Fix priority of Member->getHtmlEditorConfigForCMS() ( silverstripe/silverstripe-cms#728 )
2013-05-22 21:31:42 +02:00
Robert Curry
aeb5a2e42a
Only show direct members of a group in the members field
...
The call to Members() includes members of child groups, which was causing any members added through the grid field to be added to the child groups as well.
2013-05-22 18:48:36 +12:00
Sean Harvey
abad856534
Use create() to instantiate Member_GroupSet on Member::Groups()
...
Keeps it consistent with how HasManyList and ManyManyList are
instantiated in DataObject.
2013-05-22 13:56:36 +12:00
Sean Harvey
15f7c884f8
Merge pull request #1756 from halkyon/permission_denied_hook
...
BUG Security::permissionFailure() fixing permissionDenied hook inconsistency
2013-05-13 02:15:58 -07:00
Ingo Schommer
3e88c98ca5
API Restrict MemberLoginForm to POST requests for increased security
...
CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.
2013-05-08 10:25:28 +02:00
Josua2012
59be4a3be0
Allow custom ChangePasswordForm form
...
With this modification we can use Object::useCustomClass() to create a
custom ChangePasswordForm form:
Object::useCustomClass('ChangePasswordForm',
'CustomChangePasswordForm');
2013-05-08 09:39:39 +02:00
Will Morgan
8f6451612b
Use correct config variable name in encrypt_password
...
Use correct config variable name in encrypt_password
Fixes https://github.com/silverstripe/sapphire/issues/1709
2013-04-28 09:58:42 +12:00
Marvin Dickhaus
ea558828c9
Group description in CMSFields
2013-04-14 22:11:19 +02:00