Robbie Averill
3a537bc745
Merge branch 'heads/4.0.4' into 4.0
2018-05-28 17:50:07 +12:00
Robbie Averill
5887201dd5
Merge pull request #64 from silverstripe-security/pulls/4.0/ss-2018-010
...
[SS-2018-010] Fix regression of SS-2017-002
2018-05-14 17:12:45 +12:00
Robbie Averill
beec0c0d47
[SS-2018-010] Fix regression of SS-2017-002
2018-05-14 17:12:07 +12:00
Damian Mooyman
e409d6f673
[ss-2018-001] Restrict non-admins from being assigned to admin groups
2018-05-14 17:10:22 +12:00
Daniel Hensby
d5e2d3fa67
Merge branch '3.6' into 4.0
2018-05-01 21:47:17 +01:00
azt3k
6b39b25e20
Fixes a count() php warning without an api change
...
Warning: count(): Parameter must be an array or an object that implements Countable in /path/to/vendor/silverstripe/framework/src/Security/Member.php on line 1355
2018-04-27 09:31:07 +01:00
Joe Harvey
bf2cee3989
Bugfix - Correct duplicate nesting of 'Content' to be returned to template
...
In scenarios where:
- No member is logged in
- An 'AutoLoginHash' is provided via the 't' (token) query param
- The token isn't valid (determined by Member::validateAutoLoginToken())
The message which is intended to be returned to the end-user via $Content
in the template, is mistakenly double nested in ['Content' => ['Content' => 'Message']]
this leads to "The method forTemplate() doesn't exist on ArrayData" errors.
See - https://github.com/silverstripe/silverstripe-framework/issues/7866
2018-03-07 14:14:05 +00:00
JorisDebonnet
3e0984db49
Delete orphaned Group_Members records after deleting a Member
2018-02-27 19:47:26 +01:00
Damian Mooyman
0e26c06644
BUG Fix behaviour towards versioned but unstagable records
2018-02-20 12:20:18 +13:00
Daniel Hensby
e298fcc345
Merge branch '3.6' into 4.0
2018-02-09 14:32:58 +00:00
Daniel Hensby
660dfd34a8
FIX Issue where default admin has no password encryption
2018-02-06 20:18:32 +00:00
Simon Erkelens
a071672b48
[bugfix] $request == null breaks
...
The $request incoming as null was not properly detected by the if/elseif structure.
2018-02-05 13:02:07 +13:00
Damian Mooyman
60fa7558d3
BUG Fix double casting in login authenticator name
...
Fixes #7769
2018-01-22 14:06:24 +13:00
Daniel Hensby
db610aaf3b
Fixing string concat CS issues
2018-01-16 18:39:30 +00:00
Damian Mooyman
f86b855c90
BUG Prevent basic-auth from disallowing logout
...
Fixes #7555
2018-01-16 15:24:20 +13:00
Daniel Hensby
1c72d6946d
Merge branch '3.6' into 4.0
2017-12-14 21:01:35 +00:00
Damian Mooyman
a2fa9f0943
Merge pull request #7694 from creative-commoners/pulls/4.0/injection-session
...
FIX Use Injector to retrieve the current session
2017-12-12 16:47:36 +13:00
Robbie Averill
eb6c1fc6de
FIX Allow the current controller as well as injectable HTTPRequest objects
2017-12-12 16:35:53 +13:00
Robbie Averill
097d0697c5
FIX Use Injector to retrieve the current session
2017-12-12 16:03:16 +13:00
Damian Mooyman
f1dd3d6f03
[ss-2017-009] Prevent disclosure of sensitive information via LoginAttempt
2017-11-30 17:00:49 +13:00
Loz Calver
c4b366828e
FIX: Restore BackURL preservation on log out ( closes #7636 )
2017-11-27 16:15:28 +00:00
Damian Mooyman
6a73466b41
BUG Fix basicauth
2017-11-03 12:08:38 +13:00
Damian Mooyman
ad36b8f6a9
Use restart instead of destroy
2017-11-03 12:08:38 +13:00
Daniel Hensby
a61ce077c6
FIX Sessions must be destroyed on logout
2017-11-03 12:08:38 +13:00
Robbie Averill
897cba55cb
FIX Move Member log out extension points to non-deprecated methods
2017-11-02 11:39:02 +13:00
Damian Mooyman
3c8848a090
Update code style and fix tests
2017-10-30 17:34:15 +13:00
Christopher Joe
f6b7cf8889
Feature disable current user from removing their admin permission
2017-10-30 12:34:06 +13:00
Oly Su
4d85da179f
291 checks if ->value is iterable
2017-10-27 10:46:20 +13:00
Damian Mooyman
b9cb1e69e6
BUG Replace phpdotenv with thread-safe replacement
2017-10-20 18:43:11 +13:00
Simon Erkelens
6506a5b958
Don't add a . when there's no extension
2017-10-16 11:56:35 +13:00
Damian Mooyman
6a55dcfc16
Fix references to resource paths / urls
2017-10-10 16:51:47 +13:00
Chris Joe
566d7baa48
Merge pull request #7437 from open-sausages/pulls/4.0/stateless-extensions
...
API Extensions are now stateless
2017-10-09 11:45:33 +13:00
Ingo Schommer
7406318f03
Merge pull request #7436 from creative-commoners/pulls/4.0/consistent-change-password-api
...
NEW Ensure changePassword is called by onBeforeWrite for a consistent API
2017-10-06 11:26:37 +01:00
Damian Mooyman
b996e2c22c
API Extensions are now stateless
...
ENHANCEMENT Injector now lazy-loads services more intelligently
2017-10-06 14:53:44 +13:00
Daniel Hensby
16cac4e3bd
Merge branch '3' into 4
2017-10-05 16:40:31 +01:00
Robbie Averill
413034f684
Remove psuedo-property SetPassword from Member
2017-10-05 16:55:24 +13:00
Robbie Averill
cdf6ae45a3
NEW Ensure changePassword is called by onBeforeWrite for a consistent API
2017-10-05 16:14:15 +13:00
Robbie Averill
6044579a3f
MINOR Separate some areas of logic in LostPasswordHandler to make them more overridable
2017-10-05 14:17:38 +13:00
Robbie Averill
6b52412693
NEW Make Member::changePassword extensible
2017-10-05 11:18:34 +13:00
Chris Joe
b219e40ff7
Merge pull request #7414 from open-sausages/pulls/4.0/basic-auth-var
...
BUG Restore SS_USE_BASIC_AUTH env var
2017-10-02 15:11:19 +13:00
Damian Mooyman
e2750c03fc
BUG Restore SS_USE_BASIC_AUTH env var
...
Fixes #7268
2017-09-29 16:56:56 +13:00
Damian Mooyman
f4b1417612
ENHANCEMENT Use less expensive i18n defaults in Member::populateDefaults()
...
Fixes #7381
2017-09-29 16:40:17 +13:00
Mike Cochrane
b8e5a2ce32
FIX readonly PermissionCheckboxSetField
...
A readonly PermissionCheckboxSetField (eg in Security when viewing a member without permission to edit it) can result in calling "getRecord()" on null. Add is_object check, consistent with line 98.
2017-09-25 15:25:10 +13:00
Loz Calver
7431122b58
Make auto login token expiry configurable ( closes #7278 )
2017-09-18 14:06:13 +01:00
Damian Mooyman
905c4e04d5
BUG Incorrect path for requirements file
2017-09-12 10:36:48 +01:00
Christopher Joe
25380eb454
Fix permission check for admin role
2017-09-06 10:21:01 +12:00
Sam Minnee
8c15e451c6
FIX: Removed unnecessary database_is_ready call.
...
This shaves about 45ms from every request (PHP 7.1 on a 2013 rMBP),
cutting down execution time of a “hello world” controller by about 33%.
database_is_ready is still used in dev/build and ?flush=1 to stop people
from people bypassing security by DOSing the database or otherwise
forcing a DatabaseException
2017-08-25 13:06:12 +12:00
Loz Calver
ecc619248b
Merge pull request #7298 from robbieaverill/pulls/4.0/replace-stat-usage
...
Replace use of Configurable stat() with config()->get(), will be deprecated in future
2017-08-23 10:12:40 +01:00
Damian Mooyman
14761a9246
Remove mcrypt
...
Use session for alternativeDatabaseName instead
Fixes #7280
2017-08-23 12:13:32 +12:00
Robbie Averill
8ebc13ae4e
Replace use of Configurable stat() with config()->get(), will be deprecated in future
2017-08-23 09:42:10 +12:00
