Commit Graph

322 Commits

Author SHA1 Message Date
Daniel Hensby
00544ff100 FIX session_regenerate_id uses config system 2016-01-05 22:31:58 +00:00
Damian Mooyman
7367cf54c4 [ss-2015-020]: Prevent possible Privilege escalation 2015-09-10 13:01:24 +12:00
Damian Mooyman
8d6cd1529f BUG Fix some database errors during dev/build where an auth token exists for the current user
Fixes #3660
2015-03-25 11:34:13 +13:00
Daniel Hensby
d2a3da2203 Making docs gender agnostic 2015-03-07 12:32:04 +00:00
Elvinas L.
32ce85d9f4 FIX. Summary fields can't be translated
fieldLabels() now can find these fields and translate them.
2015-01-15 15:09:32 +02:00
Will Rossiter
220bdf342c Merge pull request #3577 from tractorcow/pulls/3.1/fix-basicauth-resetlogin
BUG Fix BasicAuth not resetting failed login counts on authentication
2015-01-15 11:03:52 +13:00
JorisDebonnet
1cd54e6bdc Update Member.Email from 256 to 254 length
Fixes #3074
2014-11-29 22:30:11 +01:00
Damian Mooyman
9d78eb7fe6 BUG Fix BasicAuth not resetting failed login counts on authentication 2014-10-24 14:19:12 +13:00
Damian Mooyman
53c40a94fa API Enable re-authentication within the CMS if a user session is lost
BUG Resolve issue with error redirection being ignored within CMS
BUG Fix issue with invalid securityID being re-emitted on failure
2014-10-14 15:19:48 +13:00
Will Rossiter
61ec808604 Set $lock_out_after_incorrect_logins out of the box 2014-09-26 10:49:53 +12:00
Loz Calver
d91c7d14b8 FIX: Rewrite Member getCMSFields to ensure updateCMSFields is only run once (fixes #2827)
Fix usage of  inside closure

Can't use self:: in closure either

Basic unit tests to check extensions are applied correctly
2014-02-16 21:21:15 +00:00
Ingo Schommer
bb9f84afd5 Merge pull request #2806 from tractorcow/pulls/bug-member-locale
BUG Default Member.Locale now chooses a better default value when i18n.locale is not a valid translation
2014-02-03 17:03:48 -08:00
Damian Mooyman
293c672fa7 BUG Default Member.Locale now chooses a better default value when i18n.locale is not a valid translation
This will resolve issues in cases where the site locale may be assigned a value that does not have an explicit translation. E.g. if the locale is en_NZ (and it's appropriate for this to be the assigned locale), Afrikaans will no longer be the default selected locale when creating members. Now en_US is chosen as a better fallback default.

This is a minor ease of use fix that means fewer CMS users can be accidentally created in Afrikaans within NZ based sites.

Test cases included.
2014-01-30 15:55:14 +13:00
Gus King
5797efa263 Documented magic properties of DataObject 2014-01-26 00:11:32 -05:00
Will Rossiter
13bd4e96b1 Correct PHPDoc for Member::currentUser. (Fixes #2750) 2014-01-12 16:08:31 +13:00
Ingo Schommer
627e3cdf11 Revert entity name change
Partially reverts b0f38f4990
which broke unit tests relying on the old entity name
in 3.1, where translations and the en.yml master file have been backported to.
2013-12-19 23:13:13 +01:00
Ingo Schommer
15c7252af0 beforeMemberLoggedIn/beforeMemberLoggedOut hooks
Required to save/restore parts of the session information,
which Member nukes indiscriminately on logout.

Specific use case is restoring linkages to temporary databases
on Behat test runs.
2013-12-18 18:26:01 +01:00
andrewvt
953dec8863 Updated group filter
Updated group filter
2013-11-01 07:22:13 -04:00
andrewvt
9a11c643da added removeFromGroupByCode() function to Member.php
I was using the addToGroupByCode() function today and it would have been handy to have a removeFromGroupByCode() so I decided to add one.
2013-10-24 16:57:00 -04:00
Will Rossiter
813d34b15e FIX: Use Injector API for managing Member_Validator instance.
Updates the CMS profile page and SecurityAdmin to give developers a few ways to customise the required fields.

Added extension hook updateValidator for getValidator for things like modules to inject required fields to go along with Injector for replacing the entire class for project specific use.
2013-10-16 11:29:43 +13:00
Will Rossiter
b0f38f4990 Change default message to be credential agnostic. 2013-10-11 11:22:15 +13:00
Ingo Schommer
cd225f0fa4 No HTML entities in "Groups" ListboxField (fixes #2513) 2013-10-10 12:08:16 +02:00
Ingo Schommer
1c31c098ee FIX Correct Zend_Locale fallbacks in i18n/DateField/DateTimeField
Due to the recent change of translations to transifex, some
locales changed their names, which prompted a fix to
i18n::get_available_translations() (see 00ffe7294).
This caused a regression where short locales are determined
from the YAML file names (e.g. "en"), but weren't matched up
with fully qualified locales from get_available_translations() (e.g. "en_US").
Since this list is used in the admin/myprofile dropdown for the Member.Locale value,
it didn't match up with any entries and defaulted to the first one ("Africaans").

Note that the behaviour of admin/myprofile is still a bit weird:
It defaults the locale on new members to the one set for the current administrator.
So if a site defaults to en_US in _config.php, but the admin happens to view
his backend in de_DE, all members he creates default to de_DE as well.

Thanks to @tractorcow for contributing and peer reviewing!
2013-08-30 10:18:00 +02:00
Mateusz Uzdowski
d4a6f7304e BUG First error should take precedence here. No further checks needed. 2013-07-19 08:54:52 +12:00
Ingo Schommer
b58e2dbe3a Member.lock_out_delay_mins configurable, password security docs 2013-07-11 09:47:28 +02:00
Will Morgan
1c0ae76f8e Adding passwordless message instead of throwing an exception 2013-06-07 16:52:44 +02:00
Mateusz Uzdowski
2f7fd967b2 BUG Clean up the logOut and session destructon routines. 2013-05-23 13:27:41 +12:00
Ingo Schommer
ee784c3663 Fix priority of Member->getHtmlEditorConfigForCMS() (silverstripe/silverstripe-cms#728) 2013-05-22 21:31:42 +02:00
Sean Harvey
abad856534 Use create() to instantiate Member_GroupSet on Member::Groups()
Keeps it consistent with how HasManyList and ManyManyList are
instantiated in DataObject.
2013-05-22 13:56:36 +12:00
Ingo Schommer
3334eafcb1 API Marked statics private, use Config API instead (#8317)
See "Static configuration properties are now immutable, you must use Config API." in the 3.1 change log for details.
2013-03-24 17:20:53 +01:00
Ingo Schommer
4cd6d00159 Fixed forceExpiry() usage 2013-03-19 10:49:52 +01:00
Ingo Schommer
b416e50bff Fixed deprecations 2013-03-19 10:38:14 +01:00
Ingo Schommer
bea1b9002d Merge remote-tracking branch 'origin/3.0' into 3.1
Conflicts:
	control/HTTP.php
2013-02-26 13:28:35 +01:00
Ingo Schommer
92458d9f43 Fixed line lengths 2013-02-18 14:41:49 +01:00
Ingo Schommer
634c91c6ff Merge remote-tracking branch 'origin/3.0' into 3.1
Conflicts:
	email/Mailer.php
2013-01-30 12:46:24 +01:00
Simon Welsh
c9f728fefb FIX Only check the remember token if a user exists 2013-01-30 09:17:47 +13:00
jean
c048a019f6 BUGFIX Avoid infinite redirection when logging out and when showing a custom login page after displaying the draft version of a page. 2013-01-29 19:24:37 +01:00
Ingo Schommer
22eeaa4ac1 BUG Members should not be allowed to delete themselves (fixes #8121) 2012-12-16 23:53:45 +01:00
Hamish Friedlander
27113f82c3 API Make DataList and ArrayList immutable
In 3.0 there was some confusion about whether DataLists and ArrayLists
were mutable or not. If DataLists were immutable, they'd return the result, and your code
would look like

  $list = $list->filter(....);

If DataLists were mutable, they'd operate on themselves, returning nothing, and your code
would look like

 $list->filter(....);

This makes all DataLists and ArrayList immutable for all _searching_ operations.
Operations on DataList that modify the underlying SQL data store remain mutating.

- These functions no longer mutate the existing object, and if you do not capture the value
returned by them will have no effect:

  ArrayList#reverse
  ArrayList#sort
  ArrayList#filter
  ArrayList#exclude

  DataList#dataQuery (use DataList#alterDataQuery to modify dataQuery in a safe manner)
  DataList#where
  DataList#limit
  DataList#sort
  DataList#addFilter
  DataList#applyFilterContext
  DataList#innerJoin
  DataList#leftJoin
  DataList#find
  DataList#byIDs
  DataList#reverse

- DataList#setDataQueryParam has been added as syntactic sugar around the most common
cause of accessing the dataQuery directly - setting query parameters

- RelationList#setForeignID has been removed. Always use RelationList#forForeignID
when querying, and overload RelationList#foreignIDList when subclassing.

- Relatedly,the protected variable RelationList->foreignID has been removed, as the ID is
now stored on a query parameter. Use RelationList#getForeignID to read it.
2012-12-14 13:30:35 +13:00
Ingo Schommer
644cc79ebb API Removed methods previously deprecated in 3.0 2012-12-14 01:16:47 +01:00
Ingo Schommer
5fed5b91c9 API Moved email bounce handling to new 'emailbouncehandler' module 2012-12-12 23:36:42 +01:00
Simon Welsh
b0121b541c Add codesniffer that ensures indentation is with tabs. 2012-12-12 17:33:31 +13:00
Simon Welsh
fc5dd2994c Add codesniffer that ensures indentation is with tabs. 2012-12-12 00:12:11 +13:00
Ingo Schommer
c55c7c33f8 Merge branch '3.0'
Conflicts:
	admin/code/CMSProfileController.php
	composer.json
	tests/model/DataObjectTest.php
2012-11-22 23:51:28 +01:00
Mateusz Uzdowski
a8b0e44d98 API Hash autologin tokens before storing in the database.
Refactor the code to make it clear the distinction is made between a
plaintext token and a hashed version. Rename fields so it is more
obvious what is being written and what sent out to the user.

This reuses the salt and algorithm from the Member, which are kept
constant throughout the Member lifetime in a normal scenario. If they do
change, users will need to re-request so the hashes can be regenerated.
2012-11-09 11:29:42 +01:00
Will Rossiter
69ea73b4ed Merge pull request #777 from halkyon/field_edit3
Member_ProfileForm respect canEdit() permissions on Member
2012-10-27 20:11:46 -07:00
Ingo Schommer
d1ee7612f5 Merge remote-tracking branch 'origin/3.0' 2012-10-08 16:48:52 +02:00
Saophalkun Ponlu
e3a27ea7da CMS member profile now is no longer in a popup (#7880) 2012-10-08 12:57:55 +02:00
Sean Harvey
0cce58040a BUG Fix deprecated use of dataFieldByName() in Member_Validator 2012-10-08 09:26:28 +13:00
Sam Minnee
1f7fc1f76a FIX Remove instances of lines longer than 120c
The entire framework repo (with the exception of system-generated files) has been amended to respect the 120c line-length limit.  This is in preparation for the enforcement of this rule with PHP_CodeSniffer.
2012-09-30 17:18:13 +13:00