Commit Graph

13970 Commits

Author SHA1 Message Date
Damian Mooyman
7367cf54c4 [ss-2015-020]: Prevent possible Privilege escalation 2015-09-10 13:01:24 +12:00
Damian Mooyman
45b22c788e BUG Fix missing framework/admin/tests 2015-09-10 11:06:15 +12:00
Ingo Schommer
4c73721bab Merge pull request #1 from silverstripe-security/fixes/ss-2015-016
[ss-2015-016]: Fix XSS in install.php
2015-09-09 09:48:56 +12:00
Christopher Pitt
751d77386c Merge pull request #2 from silverstripe-security/fixes/ss-2015-015
[ss-2015-015]: Fix insecure returnURL in DatabaseAdmin
2015-09-08 10:53:59 +12:00
Damian Mooyman
d8fd64c3e2 [ss-2015-016]: Fix XSS in install.php 2015-09-08 10:08:28 +12:00
Damian Mooyman
7192932022 [ss-2015-015]: Fix insecure returnURL in DatabaseAdmin 2015-09-08 09:48:09 +12:00
Damian Mooyman
92f9af1984 Update translations 2015-09-02 11:15:53 +12:00
Damian Mooyman
ed401176f9 Added 3.1.14-rc1 changelog 2015-09-02 11:04:21 +12:00
Damian Mooyman
b390f463ea Merge pull request #4566 from chillu/pulls/pragma-docs
Clarify use of HTTP Pragma response header
2015-09-02 09:27:41 +12:00
Will Morgan
17e97babf1 Merge pull request #4549 from kinglozzer/pulls/recursion-arraylist-sort
FIX: Recursion errors when sorting objects with circular dependencies (fixes #4464)
2015-09-01 16:42:17 +01:00
Loz Calver
0943b3b1a0 FIX: Recursion errors when sorting objects with circular dependencies (fixes #4464) 2015-09-01 09:37:06 +01:00
Ingo Schommer
dc650e3cf1 Clarify use of HTTP Pragma response header
The HTTP Pragma header is obsolete for HTTP 1.1,
and technically only defined for a HTTP request (not response).
Refer to https://www.mnot.net/cache_docs/#PRAGMA
,http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.32.
It is superseded by the "Cache-Control" directive.

See HTTP 1.1 spec at https://tools.ietf.org/html/rfc7234#section-5.4:
'Because the meaning of "Pragma: no-cache" in responses is
not specified, it does not provide a reliable replacement for
"Cache-Control: no-cache" in them.'

Sending a "Pragma: nocache" response header is a prudent
backwards compatibility measure for HTTP 1.0 clients.
The intended behaviour is for the majority clients as well as any
intermediary proxies to ignore this header.

Sending an empty Pragma is a known hack
for preventing PHP from adding "Pragma: nocache" to responses
with started sessions (see http://php.net/session_cache_limiter),
since PHP does not allow unsetting existing header() calls.
2015-09-01 11:45:30 +12:00
Ingo Schommer
bba1be3cd0 Merge pull request #4558 from sminnee/simplify-build-matrix-31
MINOR: Simplify build matrix for 3.x builds.
2015-08-31 10:18:00 +12:00
Daniel Hensby
ea757e72a6 Merge pull request #4560 from willmorgan/bugfixes/localstorage-win81-ie11
Fix localStorage for Windows 8.1 IE11 desktop mode
2015-08-29 21:15:19 +01:00
James Bolitho
0cb98bcce2 Fix localStorage for Windows 8.1 IE11 desktop mode
In IE11 windows 8 call to window.localStorage was throwing out an access denied error.  Using try and catch manages the issue and allows the script to execute in IE 11 in desktop mode.

I think it is a problem with IE11 rather than the way Silverstripe is implementing the preview via an iframe from what I have been reading. http://blogs.msdn.com/b/ieinternals/archive/2009/09/16/bugs-in-ie8-support-for-html5-postmessage-sessionstorage-and-localstorage.aspx.  It seems that the way IE11 deals with localStorage is broken in certain cases but I am not 100% certain of the cause yet as I have not been able to find a definitive answer.  I only noticed it was a problem when a new client said they couldn't view the admin screen properly in IE11.  I took a look in IE11 and I was experiencing the same problem which makes the admin interface layout screw up and the preview doesn't work due the error mentioned in the first post.

Instead of the original code I submitted I have amended it and added an additional function to test more robustly to see if localStorage is available and can be accessed properly.  It is a copy of the code on a blog post Mathias Bynens has written about detecting if localStorage is available and can be used: https://mathiasbynens.be/notes/localstorage-pattern

I have added a console.warn as you suggested if localStorage is not available so that at least you get a warning if localStorage tests fail.

I have tested this on Windows 8.1: Firefox, Chrome & Mac: Firefox, Safari, Chrome and it seems to work as expected.  On IE11 it displays the admin area correctly now but obviously doesn't save the preview settings between page loads if localStorage is not available.
2015-08-29 15:54:14 +01:00
Sam Minnee
ab44f5ef47 MINOR: Simplify build matrix for 3.x builds.
This is a companion to https://github.com/silverstripe/silverstripe-framework/pull/4556
but targeted at the build needs of SilverStripe 3.x. Commit into 3.1 and
then the merge forward into 3.2 and 3.
2015-08-29 15:50:49 +12:00
Daniel Hensby
48d00895ca Merge pull request #4554 from halkyon/flush-docs
DOCS Add warning on flush not being run automatically by unit test commands.
2015-08-28 02:02:31 +01:00
Sean Harvey
03d2fc73c5 Add warning on flush not being run automatically by unit test commands. 2015-08-28 13:00:22 +12:00
Sean Harvey
eca781ed91 Merge pull request #3813 from nfauchelle/patch-1
Flush should be off by default - consistant
2015-08-28 12:49:24 +12:00
Ingo Schommer
28554dbe94 Merge pull request #4504 from dhensby/pulls/fields-fix
When loading data into a form, make sure its using ALL fields
2015-08-28 08:38:49 +12:00
Daniel Hensby
08dd8fda62 Merge pull request #4086 from xini/fix-remote-url-field
fix width of remote url field label to allow right-click-paste
2015-08-27 20:50:35 +01:00
Daniel Hensby
8015919932 Be defensive with token availability 2015-08-27 17:58:43 +01:00
Daniel Hensby
899eb0b235 FIX Use complete fieldlist for extracting data 2015-08-27 17:58:19 +01:00
Daniel Hensby
cffb11e568 TEST Ensure data is loaded into complete FieldList 2015-08-27 17:56:22 +01:00
Ingo Schommer
0c97192558 Merge pull request #4546 from dhensby/pulls/permission-docs
DOCS Adding docs for special Permission cases
2015-08-27 10:39:23 +12:00
Daniel Hensby
209bb94319 DOCS Adding docs for special Permission cases 2015-08-26 23:32:07 +01:00
Damian Mooyman
4fdfe3a0a2 Merge pull request #4543 from dhensby/pulls/members-can-view-themselves
FIX Members can access their own profiles in CMS
2015-08-27 09:43:43 +12:00
Daniel Hensby
2d4b743090 FIX Members can access their own profiles in CMS 2015-08-26 15:47:51 +01:00
Sam Minnée
a40e70f874 Merge pull request #4535 from kinglozzer/travis-notifications
Disable IRC notifications for Travis builds
2015-08-25 18:10:46 +12:00
Loz Calver
99a8a81e9a Fix issues with tests and "subfolder" URLs 2015-08-25 11:49:01 +12:00
Loz Calver
71eb7d3364 Disable IRC notifications for Travis builds 2015-08-24 11:56:04 +01:00
Daniel Hensby
790dff7b81 Merge pull request #4525 from tractorcow/pulls/3.1/teamcity
MINOR Adjustment to teamcity output
2015-08-21 09:18:51 +01:00
Daniel Hensby
ab0572e7cc DOCS Permission comments made a bit clearer 2015-08-21 09:16:46 +01:00
Damian Mooyman
465a3bea64 MINOR Adjustment to teamcity output 2015-08-21 17:30:50 +12:00
Damian Mooyman
d64852b2e8 Merge pull request #4517 from dhensby/pulls/access-all-areas
Fix issue where Access All CMS Sections doesnt work
2015-08-21 11:48:45 +12:00
Daniel Hensby
2cf7446d8e Merge pull request #4519 from tractorcow/pulls/3.1/fix-setup
BUG Fix illegalExtensions breaking tests.
2015-08-21 00:41:38 +01:00
Damian Mooyman
fc212e030c BUG Fix illegalExtensions breaking tests.
Revert #3979
2015-08-21 11:18:58 +12:00
Daniel Hensby
6eede57ff2 Fix issue where Access All CMS Sections doesnt work 2015-08-20 22:30:43 +01:00
Daniel Hensby
a4bd11149f Merge pull request #4508 from kinglozzer/missing-var
FIX: Using undefined var in ModelAdmin
2015-08-18 16:31:32 +01:00
Loz Calver
8b638f56fb FIX: Using undefined var in ModelAdmin 2015-08-18 15:37:15 +01:00
Sam Minnée
9eb2265a21 Merge pull request #4506 from dhensby/pulls/remove-nightly
Remove nightly build as PHP 7 support is explicitly off
2015-08-18 09:09:54 +12:00
Daniel Hensby
a73f9ba8fb Remove nightly build as PHP 7 support is explicitly off 2015-08-17 16:50:05 +01:00
Sam Minnée
5911d50bca Merge pull request #4477 from nickbooties/nickbooties-patch-1
Fixes #4424
2015-08-11 17:34:35 +12:00
Nick
c4c4d79c26 Fix for Issue #4424
Model Admin : 'Show Specification for' toggle link breaks if Title contains spaces.
Uses className for element ID on ImportSpec template.
2015-08-11 14:56:13 +10:00
Sam Minnée
5c3bf3d0a2 Merge pull request #4482 from kinglozzer/classinfo-nonexistant-class
Ensure ClassInfo is backwards compatible with non-existant classes
2015-08-10 15:45:32 +12:00
Will Morgan
a28bf97cf4 Merge pull request #4488 from SpiritLevel/patch-4
Spelling
2015-08-06 16:23:14 +01:00
David Alexander
44680d175c Spelling 2015-08-05 21:34:35 +12:00
Sam Minnée
d419b667ef Merge pull request #4485 from yabbagail/no-php7
Explicitly don't support PHP7
2015-08-05 18:06:52 +12:00
Abagail Yost
30bdcc5dc3 Explicitly don't support PHP7 2015-08-05 15:28:38 +10:00
Will Morgan
ca6a46f88d Merge pull request #4481 from dhensby/pulls/fix-default-perm-failure
Fixing rubbish login message when trying to access the CMS
2015-08-04 16:38:52 +01:00