tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity
14,007 Commits 31 Branches 527 Tags 162 MiB
615b2d5563
Commit Graph

971 Commits

Author SHA1 Message Date
Damian Mooyman
7367cf54c4 [ss-2015-020]: Prevent possible Privilege escalation 2015-09-10 13:01:24 +12:00
Daniel Hensby
2d4b743090 FIX Members can access their own profiles in CMS 2015-08-26 15:47:51 +01:00
Daniel Hensby
ab0572e7cc DOCS Permission comments made a bit clearer 2015-08-21 09:16:46 +01:00
Daniel Hensby
6eede57ff2 Fix issue where Access All CMS Sections doesnt work 2015-08-20 22:30:43 +01:00
Damian Mooyman
6fabd0122b BUG Fix potential XSS injection 2015-07-01 17:41:32 +12:00
Sean Harvey
fd755a7ff9 BUG ChangePasswordForm validation message should render HTML correctly. 
HTML shows up in the form message escaped, but it shouldn't be.
 2015-07-01 17:41:32 +12:00
Damian Mooyman
22a35e48a9 BUG Fix malformed urls redirecting to external sites 2015-05-28 10:12:18 +12:00
Daniel Hensby
c2fd18e829 FIX use config for Security::$login_url 2015-04-23 17:20:07 +01:00
Damian Mooyman
8d6cd1529f BUG Fix some database errors during dev/build where an auth token exists for the current user 
Fixes #3660
 2015-03-25 11:34:13 +13:00
Damian Mooyman
a775a44387 Merge pull request #4016 from guru-digital/REDIRECT_fix 
HTTP basic auth fix
 2015-03-19 14:55:20 +13:00
Daniel Hensby
de2aa47250 Merge pull request #4006 from kinglozzer/patch-1 
FIX: Security::$default_message_set Config value unusable
 2015-03-17 17:05:01 +00:00
Loz Calver
a61c08d031 FIX: Security::$default_message_set Config value unusable 2015-03-17 15:51:31 +00:00
Corey Sewell
46e61b3448 Check both $_SERVER['HTTP_AUTHORIZATION'] and $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] for HTTP Basic authentication headers 2015-03-17 14:15:54 +13:00
Daniel Hensby
d2a3da2203 Making docs gender agnostic 2015-03-07 12:32:04 +00:00
Damian Mooyman
49c462710d Merge pull request #3795 from uniun/patch-2 
FIX. Summary fields can't be translated
 2015-02-16 15:55:29 +13:00
Daniel Hensby
89c14d079d Making TreeMultiSelectField consistent with parent class 
NEW TreeDropdownField sanatiser helper added
Use config for default_cast of objects
FIX Determine if Diffed value should be escaped
Forcing casting for core DB fields
Fixing permissions labels
 2015-02-13 11:12:30 +13:00
Elvinas L.
32ce85d9f4 FIX. Summary fields can't be translated 
fieldLabels() now can find these fields and translate them.
 2015-01-15 15:09:32 +02:00
Will Rossiter
220bdf342c Merge pull request #3577 from tractorcow/pulls/3.1/fix-basicauth-resetlogin 
BUG Fix BasicAuth not resetting failed login counts on authentication
 2015-01-15 11:03:52 +13:00
Daniel Hensby
b2ace2b76c Merge pull request #3689 from guru-digital/patch-2 
Add ability to use Basic Auth when running PHP in CGI mode in Apache
 2014-12-08 18:39:42 +00:00
Corey Sewell
fbebf96d66 Add detection for PHP running in CGI mode and add HTTP_AUTHORIZATION rewrite rule 
Detect and parse HTTP_AUTHORIZATION for basic authentication running PHP in CGI mode
Add comments about using CGI mode with Apache and Basic Auth in /docs/en/topics/environment-management.md
Added notes  to docs/en/changelogs/3.1.9.md
 2014-12-05 11:35:52 +13:00
JorisDebonnet
1cd54e6bdc Update Member.Email from 256 to 254 length 
Fixes #3074
 2014-11-29 22:30:11 +01:00
Damian Mooyman
31b5a9dc86 API Allow CMS re-authentication to be completely disabled if necessary 2014-11-21 17:43:53 +13:00
Damian Mooyman
2bdfd65e9b BUG Security::findAnAdministrator doesn't always find an admin 2014-11-18 15:36:34 +13:00
Damian Mooyman
9d78eb7fe6 BUG Fix BasicAuth not resetting failed login counts on authentication 2014-10-24 14:19:12 +13:00
Damian Mooyman
53c40a94fa API Enable re-authentication within the CMS if a user session is lost 
BUG Resolve issue with error redirection being ignored within CMS
BUG Fix issue with invalid securityID being re-emitted on failure
 2014-10-14 15:19:48 +13:00
Will Rossiter
61ec808604 Set $lock_out_after_incorrect_logins out of the box 2014-09-26 10:49:53 +12:00
Sean Harvey
0e07f1a7f5 Merge remote-tracking branch 'origin/3.0' into 3.1 2014-08-22 17:50:36 +12:00
Ingo Schommer
1661213e5b FIX Opt-out pf form message escaping (fixes #2796) 
This fixes a limitation introduced through http://www.silverstripe.org/ss-2013-008-xss-in-numericfield-validation/.
Form messages used to accept HTML, now they’re escaped by default, effectively removing the ability
to pass in HTML and take care of escaping manually.

We pass through HTML to message in core through the CTF system, so this needs to be fixed.
It’s an alternative fix to https://github.com/silverstripe/silverstripe-framework/pull/2803.
 2014-08-22 16:59:34 +12:00
Tim Snadden
afad65ee71 Fix 'Uncaught ReferenceError: jQuery is not defined' if jQuery is not included in template. 2014-04-30 09:30:22 +12:00
Mateusz U
36d925543b Merge pull request #3020 from tractorcow/pulls/3.1-autocomplete-username 
API Security.remember_username to disable login form autocompletion
 2014-04-11 09:17:27 +12:00
Damian Mooyman
997077ae83 API Security.remember_username to disable login form autocompletion 2014-04-11 09:05:25 +12:00
Ingo Schommer
be12656bd9 Returning response from doChangePassword() 2014-04-10 17:21:56 +12:00
Ingo Schommer
f737922cdf Prevent IE errors on hidden login forms 
In order to focus a field, it needs to be visible,
which can't be guaranteed on a core level by the login form JavaScript.
Optionally check for visibility via jQuery if it exists,
and allow explicit disabling of this behaviour via a unique identifier.
 2014-04-08 11:28:54 +12:00
Damian Mooyman
1cc366fe23 Merge pull request #2850 from kinglozzer/2827-member-extend 
FIX: Rewrite Member getCMSFields to ensure updateCMSFields is only run once (fixes #2827)
 2014-03-04 13:42:17 +13:00
Ingo Schommer
c047a7b990 Reset FailedLoginCount on successful password reset 2014-03-03 17:47:16 +13:00
Ingo Schommer
9afcf8f01a Allow vetoing forgot password requests 2014-02-25 13:05:32 +13:00
Loz Calver
d91c7d14b8 FIX: Rewrite Member getCMSFields to ensure updateCMSFields is only run once (fixes #2827) 
Fix usage of  inside closure

Can't use self:: in closure either

Basic unit tests to check extensions are applied correctly
 2014-02-16 21:21:15 +00:00
Kirk Mayo
632884252b NEW: Updating out of date URLs in the framework source code and docs 2014-02-07 15:10:44 +13:00
Ingo Schommer
bb9f84afd5 Merge pull request #2806 from tractorcow/pulls/bug-member-locale 
BUG Default Member.Locale now chooses a better default value when i18n.locale is not a valid translation
 2014-02-03 17:03:48 -08:00
Ingo Schommer
124886a7f9 Merge pull request #2799 from yearofthegus/document-magic-members 
Documented magic properties of DataObject
 2014-01-30 18:26:23 -08:00
Ingo Schommer
ab070944d5 Merge branch 'pulls/apidocs-package-list' of https://github.com/madmatt/silverstripe-framework into madmatt-pulls/apidocs-package-list 
Conflicts:
	view/SSTemplateParser.php
	view/SSTemplateParser.php.inc
 2014-01-31 15:15:59 +13:00
Damian Mooyman
293c672fa7 BUG Default Member.Locale now chooses a better default value when i18n.locale is not a valid translation 
This will resolve issues in cases where the site locale may be assigned a value that does not have an explicit translation. E.g. if the locale is en_NZ (and it's appropriate for this to be the assigned locale), Afrikaans will no longer be the default selected locale when creating members. Now en_US is chosen as a better fallback default.

This is a minor ease of use fix that means fewer CMS users can be accidentally created in Afrikaans within NZ based sites.

Test cases included.
 2014-01-30 15:55:14 +13:00
Gus King
5797efa263 Documented magic properties of DataObject 2014-01-26 00:11:32 -05:00
Will Rossiter
13bd4e96b1 Correct PHPDoc for Member::currentUser. (Fixes #2750) 2014-01-12 16:08:31 +13:00
Ingo Schommer
627e3cdf11 Revert entity name change 
Partially reverts b0f38f4990
which broke unit tests relying on the old entity name
in 3.1, where translations and the en.yml master file have been backported to.
 2013-12-19 23:13:13 +01:00
Ingo Schommer
23371b01aa "lost password" translation master (fixes #2725) 2013-12-19 20:00:59 +01:00
Ingo Schommer
15c7252af0 beforeMemberLoggedIn/beforeMemberLoggedOut hooks 
Required to save/restore parts of the session information,
which Member nukes indiscriminately on logout.

Specific use case is restoring linkages to temporary databases
on Behat test runs.
 2013-12-18 18:26:01 +01:00
madmatt
bebe0f6e37 Updating @package and @subpackage doc tags 2013-11-29 17:49:30 +13:00
Sean Harvey
70c23f37de Merge pull request #2608 from andrewvt/3.1 
added removeFromGroupByCode() function to Member.php
 2013-11-03 12:27:10 -08:00
andrewvt
953dec8863 Updated group filter 
Updated group filter
 2013-11-01 07:22:13 -04:00