Damian Mooyman
6b384f4b35
Merge branch '4.0' into 4
2017-12-07 13:52:00 +13:00
Daniel Hensby
eb55c27124
Merge branch '4.0' into 4
2017-12-05 12:14:22 +00:00
Damian Mooyman
f1dd3d6f03
[ss-2017-009] Prevent disclosure of sensitive information via LoginAttempt
2017-11-30 17:00:49 +13:00
Loz Calver
c4b366828e
FIX: Restore BackURL preservation on log out ( closes #7636 )
2017-11-27 16:15:28 +00:00
Simon Erkelens
0987003053
Add the ability to redirect a user to a custom page with custom content after changing their password
2017-11-27 14:18:40 +13:00
Damian Mooyman
6a73466b41
BUG Fix basicauth
2017-11-03 12:08:38 +13:00
Damian Mooyman
ad36b8f6a9
Use restart instead of destroy
2017-11-03 12:08:38 +13:00
Daniel Hensby
a61ce077c6
FIX Sessions must be destroyed on logout
2017-11-03 12:08:38 +13:00
Robbie Averill
897cba55cb
FIX Move Member log out extension points to non-deprecated methods
2017-11-02 11:39:02 +13:00
Damian Mooyman
3c8848a090
Update code style and fix tests
2017-10-30 17:34:15 +13:00
Christopher Joe
f6b7cf8889
Feature disable current user from removing their admin permission
2017-10-30 12:34:06 +13:00
Oly Su
4d85da179f
291 checks if ->value is iterable
2017-10-27 10:46:20 +13:00
Damian Mooyman
b9cb1e69e6
BUG Replace phpdotenv with thread-safe replacement
2017-10-20 18:43:11 +13:00
Simon Erkelens
6506a5b958
Don't add a . when there's no extension
2017-10-16 11:56:35 +13:00
Damian Mooyman
6a55dcfc16
Fix references to resource paths / urls
2017-10-10 16:51:47 +13:00
Chris Joe
566d7baa48
Merge pull request #7437 from open-sausages/pulls/4.0/stateless-extensions
...
API Extensions are now stateless
2017-10-09 11:45:33 +13:00
Ingo Schommer
7406318f03
Merge pull request #7436 from creative-commoners/pulls/4.0/consistent-change-password-api
...
NEW Ensure changePassword is called by onBeforeWrite for a consistent API
2017-10-06 11:26:37 +01:00
Damian Mooyman
b996e2c22c
API Extensions are now stateless
...
ENHANCEMENT Injector now lazy-loads services more intelligently
2017-10-06 14:53:44 +13:00
Daniel Hensby
16cac4e3bd
Merge branch '3' into 4
2017-10-05 16:40:31 +01:00
Robbie Averill
413034f684
Remove psuedo-property SetPassword from Member
2017-10-05 16:55:24 +13:00
Robbie Averill
cdf6ae45a3
NEW Ensure changePassword is called by onBeforeWrite for a consistent API
2017-10-05 16:14:15 +13:00
Robbie Averill
6044579a3f
MINOR Separate some areas of logic in LostPasswordHandler to make them more overridable
2017-10-05 14:17:38 +13:00
Robbie Averill
6b52412693
NEW Make Member::changePassword extensible
2017-10-05 11:18:34 +13:00
Chris Joe
b219e40ff7
Merge pull request #7414 from open-sausages/pulls/4.0/basic-auth-var
...
BUG Restore SS_USE_BASIC_AUTH env var
2017-10-02 15:11:19 +13:00
Damian Mooyman
e2750c03fc
BUG Restore SS_USE_BASIC_AUTH env var
...
Fixes #7268
2017-09-29 16:56:56 +13:00
Damian Mooyman
f4b1417612
ENHANCEMENT Use less expensive i18n defaults in Member::populateDefaults()
...
Fixes #7381
2017-09-29 16:40:17 +13:00
Mike Cochrane
b8e5a2ce32
FIX readonly PermissionCheckboxSetField
...
A readonly PermissionCheckboxSetField (eg in Security when viewing a member without permission to edit it) can result in calling "getRecord()" on null. Add is_object check, consistent with line 98.
2017-09-25 15:25:10 +13:00
Loz Calver
7431122b58
Make auto login token expiry configurable ( closes #7278 )
2017-09-18 14:06:13 +01:00
Damian Mooyman
905c4e04d5
BUG Incorrect path for requirements file
2017-09-12 10:36:48 +01:00
Christopher Joe
25380eb454
Fix permission check for admin role
2017-09-06 10:21:01 +12:00
Sam Minnee
8c15e451c6
FIX: Removed unnecessary database_is_ready call.
...
This shaves about 45ms from every request (PHP 7.1 on a 2013 rMBP),
cutting down execution time of a “hello world” controller by about 33%.
database_is_ready is still used in dev/build and ?flush=1 to stop people
from people bypassing security by DOSing the database or otherwise
forcing a DatabaseException
2017-08-25 13:06:12 +12:00
Loz Calver
ecc619248b
Merge pull request #7298 from robbieaverill/pulls/4.0/replace-stat-usage
...
Replace use of Configurable stat() with config()->get(), will be deprecated in future
2017-08-23 10:12:40 +01:00
Damian Mooyman
14761a9246
Remove mcrypt
...
Use session for alternativeDatabaseName instead
Fixes #7280
2017-08-23 12:13:32 +12:00
Robbie Averill
8ebc13ae4e
Replace use of Configurable stat() with config()->get(), will be deprecated in future
2017-08-23 09:42:10 +12:00
Damian Mooyman
9b4d689bb2
Lazy-load custom methods and extensions on CustomMethods and Extensible traits
...
No longer need constructExtensions()
2017-08-22 15:47:24 +12:00
Damian Mooyman
b6a8e45888
BUG Ensure mocked controller has request assigned
...
Fixes #7237
2017-08-03 15:52:31 +12:00
Damian Mooyman
e64acef53a
BUG Fix invalid i18n yaml
2017-08-03 10:13:09 +12:00
Damian Mooyman
8418011456
Fix linting issues
2017-08-02 14:08:59 +12:00
Robbie Averill
e307f067ed
FIX Replace deprecated %s placeholders in translations with named placeholders
...
* Remove the use of sprintf and %s placeholders in the i18n tests
2017-08-02 13:03:55 +12:00
Robbie Averill
a5ca4ecb59
FIX Log in as someone else returns user back to login screen
2017-07-18 17:15:58 +12:00
Simon Erkelens
3e97b99e22
[BUG] Fix issues with multiple authenticators for a single task ( #7149 )
...
Using multiple 2FA authenticators, logging out, resetting password etc. proved to be handled wrong.
Example scenario:
The result is an error, because the `renderWrappedController` was called, despite the responses being a set of either array with Content or Form, or a redirect action.
The default action should be followed and not try to render if there is nothing to render
Because the logout (or changepassword, or resetpassword, etc.) has already been handled, the first response is the default authenticator's response. This _could_ be a form (in case of logout without valid token), a content set (reset password) or a form (change password).
This edge case only happens when there are multiple authenticators supporting the requested method that is _not_ login.
2017-07-14 09:20:58 +12:00
Damian Mooyman
85359ad59e
BUG Ensure that installer can create an initial admin account
...
Fixes #7124
2017-07-06 13:30:04 +12:00
Damian Mooyman
4b23205838
Fix unnamespaced i18n keys
...
Fixes https://github.com/silverstripe/silverstripe-framework/issues/6862
2017-07-04 14:18:47 +12:00
Damian Mooyman
f65e3627dc
BUG Implement or exclude all pending upgrader deltas
2017-07-03 12:21:47 +12:00
Daniel Hensby
c69a565b08
Merge pull request #7046 from andrewandante/FEAT/add_inGroup_to_Group
...
add inGroup(s) methods to Group
2017-06-30 16:38:55 +01:00
Andrew Aitken-Fincham
ab60a167e6
add inGroup(s) methods to Group
2017-06-30 12:47:37 +01:00
Daniel Hensby
30986b4ea3
[SS-2017-002] FIX Lock out users who dont exist in the DB
2017-06-29 13:58:55 +12:00
Damian Mooyman
d20ab50f9d
API Stronger Injector service unregistration
...
BUG Fix up test regressions
FIX director references to request object
API Move all middlewares to common namespace
API Implement RequestHandlerMiddlewareAdapter
ENHANCEMENT Improve IP address parsing
Fix up PHPDoc / psr2 linting
BUG Fix property parsing in TrustedProxyMiddleware
BUG Fix Director::is_https()
2017-06-27 13:32:39 +12:00
Sam Minnee
254204a3a6
NEW: Replace AuthenticationRequestFilter with AuthenticationMiddleware
2017-06-27 13:32:39 +12:00
Ingo Schommer
fa568e333e
Fixed linting errors
2017-06-23 11:19:16 +12:00
