tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity
21,398 Commits 31 Branches 527 Tags 162 MiB
8b7063a8e2
Commit Graph

1549 Commits

Author SHA1 Message Date
Serge Latyntcev
8b7063a8e2 [CVE-2019-12617] Fix access escalation for CMS users with limited access through permission cache pollution 2019-09-24 16:03:48 +12:00
Serge Latyntcev
eccfa9b10d [CVE-2019-12203] Session fixation in "change password" form 
A potential account hijacking may happen if an attacker has physical access to
victim's computer to perform session fixation. Also possible if the targeted application contains an XSS vulnerability.
Requires the victim to click the password reset link sent to their email.
If all the above happens, attackers may reset the password before the actual user does that.
 2019-09-24 16:03:48 +12:00
Garion Herman
0d27f32cc9 FIX Add 'legal empty attributes' to allow empty alt values on imgs 
In some situations, a caption is used in place of a value in the alt
attribute, and in others an image may be cosmetic and not in need of an
alt attribute value (though the alt attribute must still be rendered in
this case).
 2019-09-24 11:44:12 +12:00
Robbie Averill
3cfc21c405
Merge pull request #9241 from open-sausages/pulls/4.4.3/fix-file-permission 
Fix administrators not being able to see files that are restricted to groups
 2019-09-23 11:13:26 -07:00
bergice
6a1c6ecec6 Fix administrators not being able to see files that are restricted to groups 
Resolves https://github.com/silverstripe/silverstripe-asset-admin/issues/777
 2019-09-23 16:44:28 +12:00
Guy Marriott
7877ffcc85 Merge branch '4.3' into 4.4 2019-09-18 15:52:18 -07:00
Hayden Shaw
daf9d55ecb Allow non summary fields to be used as export fields 
Fixes regression in 3d989a6eae.
 2019-09-19 10:00:54 +12:00
Robbie Averill
592ab6abc1 Merge branch '4.3' into 4.4 2019-09-13 18:11:34 -07:00
Robbie Averill
066ce8e01c Merge branch '4.2' into 4.3 
# Conflicts:
 #	src/View/ThemeResourceLoader.php
 2019-09-13 18:10:37 -07:00
Robbie Averill
cfe86ad5a1
Merge pull request #9153 from creative-commoners/pulls/4.4/stream-ree-tags 
FIX Skip md5-ing the whole contents of a stream for etags
 2019-09-13 17:59:26 -07:00
Maxime Rainville
591b88a9bc BUG Allow infinite loop when calling DataObject::writeComponent() recursively 2019-09-10 14:15:28 +12:00
Robbie Averill
41a766d135
Merge pull request #9085 from kinglozzer/9084-path-join-exception 
Catch Path::join() exceptions in findTemplate() (fixes #9084)
 2019-09-06 12:00:39 -07:00
Maxime Rainville
24015c7767 Merge branch '4.3' into 4.4 2019-09-04 09:42:09 +12:00
Robbie Averill
aec5051a24
Merge pull request #9206 from creative-commoners/pulls/4.3/strip-bom-on-csv-import 
FIX Byte Order Marks (BOM) are now stripped when importing CSV files
 2019-09-03 09:55:38 -07:00
Maxime Rainville
a2a202c016
Merge pull request #9200 from open-sausages/pulls/4.4.3/consistent-actions 
FIX make the grid field actions consistent to what they look like on pages
 2019-09-02 14:07:22 +12:00
bergice
2f8d847a10 FIX make the grid field actions consistent to what they look like on pages 
Resolves https://github.com/silverstripe/silverstripe-admin/issues/904
 2019-09-02 12:22:32 +12:00
Robbie Averill
0b991cc039
Merge pull request #9198 from elabuwa/pulls/4.3/bug-fix-html-entities-breadcrumbs-in-group 
Bug : Add html_entity_decode to group parents
 2019-08-30 09:51:52 +12:00
Dileep Ratnayake
fe4eb5dd2a
Update src/Security/Group.php 
Co-Authored-By: Maxime Rainville <maxime@rainville.me>
 2019-08-29 15:44:41 +12:00
Robbie Averill
77ba8391c4 FIX Byte Order Marks (BOM) are now stripped when importing CSV files 2019-08-29 14:54:57 +12:00
Maxime Rainville
73f43c6f42 BUG Remove placeholder text on new group form 2019-08-28 17:14:19 +12:00
Dileep Ratnayake
9b7075ed5d
Update Group.php 2019-08-27 16:22:00 +12:00
Dileep Ratnayake
a976a1688b
Update Group.php 
move to private method
 2019-08-27 16:21:08 +12:00
Dileep Ratnayake
40e5c4ec59
Update Group.php 
use of convert::raw2xml, rename $grp to $group
 2019-08-27 16:19:40 +12:00
Dileep Ratnayake
4f8240bd48
Update src/Security/Group.php 
Co-Authored-By: Andre Kiste <bergice@users.noreply.github.com>
 2019-08-27 12:19:03 +12:00
Will Rossiter
d2a07b1047
FIX Remove error when exporting a column that is not displayed in a GridField 2019-08-27 11:54:31 +12:00
Dileep Ratnayake
f7a602137a
add html_entity_decode to breadcrumbs 2019-08-27 11:49:17 +12:00
Robbie Averill
bae7e32680 FIX Member::changePassword() no longer applies password validation rules to the hashed value 2019-08-16 09:06:07 +12:00
Robbie Averill
4b44272367 Merge branch '4.3' into 4.4 2019-08-14 09:30:53 +12:00
Robbie Averill
d63e4b520c Merge branch '4.2' into 4.3 2019-08-14 09:30:41 +12:00
Guy Marriott
3d989a6eae
FIX Use content generated by DataColumns component for print and csv export 2019-08-09 15:04:38 +12:00
Robbie Averill
3b96c51688 Merge branch '4.3' into 4.4 2019-08-02 11:24:45 +12:00
Guy Marriott
0abfed3e06
FIX Skip md5-ing the whole contents of a stream for etags 2019-07-30 08:25:03 +12:00
Robbie Averill
5c794dfcdd FIX Prevent setting session value when no session exists yet 2019-07-29 17:16:01 +02:00
UndefinedOffset
40cd66852e BUGFIX: Fixed issue where multiple relationship sort order columns would be lost in favor of only the last relationship column in the sort order 2019-07-26 11:54:10 -03:00
Robbie Averill
40f06fafa9 Merge branch '4.3' into 4.4 2019-07-19 10:45:44 +02:00
Robbie Averill
c7b15eaef5 Merge branch '4.2' into 4.3 2019-07-19 10:45:29 +02:00
Serge Latyntcev
d667d64f13 Merge branch '4.3' into 4.4 2019-07-15 09:18:17 +12:00
Serge Latyntsev
7ef13e7ef6 FIX Confirmation components to respect SS_BASE_URL (#9074) 2019-07-05 16:05:41 +12:00
Sam Minnee
404366909e FIX: Fix MysqlStatement::rewind() 
Its implementation is more naive than Query’s and leads to unnecessary
seek()ing. This causes issues with the previous commit.
 2019-07-03 14:28:31 +12:00
Sam Minnee
96e7914f23 FIX: Fix MySQLQuery::seek() and Query::rewind() to fix repeated iteration 
API: Query::seek() and Query::rewind() no longer return a value.

Although breaking an API inside a patch release may seem odd, this in
fact is correcting a long-standing bug in our implementation of 
Iterator::rewind(), so I think it’s appropriate.

https://github.com/silverstripe/silverstripe-framework/issues/9097
 2019-07-03 09:20:05 +12:00
Robbie Averill
ad050997fd
Merge pull request #9070 from kinglozzer/email-plaintext 
FIX: Email::render() generating object instead of string for plaintext part (fixes #9069)
 2019-07-02 18:47:18 +12:00
Robbie Averill
fd88003646
Merge pull request #9100 from creative-commoners/pulls/4.4/dataobject-scaffolding-freedom 
Allow extensions to modify form scaffolder in DataObject
 2019-07-02 18:46:39 +12:00
Guy Marriott
59ba9a717d
FIX Allow extensions to update form scaffolding on DataObjects 2019-06-28 16:11:16 +12:00
Robbie Averill
c76d3a5db1 FIX Protect against undefined index when using nullifyEmpty option 2019-06-26 09:26:36 +12:00
Loz Calver
b1551a687d Catch Path::join() exceptions in findTemplate() (fixes #9084) 2019-06-21 09:40:18 +01:00
Mario Sommereder
260c89fd54 Fix of delimiter not used bug 
See issue https://github.com/silverstripe/silverstripe-framework/issues/8881
 2019-06-20 11:11:27 +12:00
3Dgoo
7e12bee86a
Requirements_Backend.php API documentation fix 
The API documentation for Requirements_Backend is currently broken:
https://api.silverstripe.org/4/SilverStripe/View/Requirements_Backend.html#method_customScript

This is because there are unescaped start tags in the function documentation. 

This is the same as the recent #9060 PR, but for the Requirements_Backend class this time.

This fix changes the tags to be escaped.
 2019-06-15 10:37:49 +09:30
Loz Calver
8e87264864 FIX: Email::render() generating object instead of string for plaintext part (fixes #9069) 2019-06-14 11:39:47 +01:00
Aaron Carlino
c747b1f8d3 Merge branch '4.3' into 4.4 2019-06-10 17:32:07 +12:00
Aaron Carlino
f766555d61 Merge branch '4.2' into 4.3 2019-06-10 17:27:05 +12:00