Commit Graph

1019 Commits

Author SHA1 Message Date
Kirk Mayo
632884252b NEW: Updating out of date URLs in the framework source code and docs 2014-02-07 15:10:44 +13:00
Ingo Schommer
bb9f84afd5 Merge pull request #2806 from tractorcow/pulls/bug-member-locale
BUG Default Member.Locale now chooses a better default value when i18n.locale is not a valid translation
2014-02-03 17:03:48 -08:00
Ingo Schommer
0d7e9a9692 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	_config/routes.yml
	docs/en/topics/datamodel.md
	forms/DropdownField.php
2014-02-04 08:19:04 +13:00
Ingo Schommer
124886a7f9 Merge pull request #2799 from yearofthegus/document-magic-members
Documented magic properties of DataObject
2014-01-30 18:26:23 -08:00
Ingo Schommer
ab070944d5 Merge branch 'pulls/apidocs-package-list' of https://github.com/madmatt/silverstripe-framework into madmatt-pulls/apidocs-package-list
Conflicts:
	view/SSTemplateParser.php
	view/SSTemplateParser.php.inc
2014-01-31 15:15:59 +13:00
Damian Mooyman
293c672fa7 BUG Default Member.Locale now chooses a better default value when i18n.locale is not a valid translation
This will resolve issues in cases where the site locale may be assigned a value that does not have an explicit translation. E.g. if the locale is en_NZ (and it's appropriate for this to be the assigned locale), Afrikaans will no longer be the default selected locale when creating members. Now en_US is chosen as a better fallback default.

This is a minor ease of use fix that means fewer CMS users can be accidentally created in Afrikaans within NZ based sites.

Test cases included.
2014-01-30 15:55:14 +13:00
Gus King
5797efa263 Documented magic properties of DataObject 2014-01-26 00:11:32 -05:00
Will Rossiter
13bd4e96b1 Correct PHPDoc for Member::currentUser. (Fixes #2750) 2014-01-12 16:08:31 +13:00
micmania1
229bea399b added logout url to Security and deprecated Security::set_login_url in favour of config 2013-12-20 21:55:54 +00:00
Ingo Schommer
7591e43ab9 Merge remote-tracking branch 'origin/3.1' 2013-12-19 23:33:58 +01:00
Ingo Schommer
627e3cdf11 Revert entity name change
Partially reverts b0f38f4990
which broke unit tests relying on the old entity name
in 3.1, where translations and the en.yml master file have been backported to.
2013-12-19 23:13:13 +01:00
Ingo Schommer
f29d51f433 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	docs/en/reference/dataobject.md
	lang/es.yml
2013-12-19 20:23:09 +01:00
Ingo Schommer
23371b01aa "lost password" translation master (fixes #2725) 2013-12-19 20:00:59 +01:00
Sean Harvey
6fc9db6f0e API DataObject::validate() visibility changed to public (issue #1659)
DataObject::validate() is currently set to protected, but this means
you can't call validate() from outside the context of itself unless
you overload the method to use a public visibility and then call
parent::validate()

As it would turn out, most classes that overload this method already
set the visibility to public, so it would make sense the parent matches
that as well.
2013-12-19 16:36:39 +13:00
Ingo Schommer
15c7252af0 beforeMemberLoggedIn/beforeMemberLoggedOut hooks
Required to save/restore parts of the session information,
which Member nukes indiscriminately on logout.

Specific use case is restoring linkages to temporary databases
on Behat test runs.
2013-12-18 18:26:01 +01:00
madmatt
bebe0f6e37 Updating @package and @subpackage doc tags 2013-11-29 17:49:30 +13:00
Andrew Short
bedf292612 Merge branch '3.1'
Conflicts:
	docs/en/reference/execution-pipeline.md
	lang/nl.yml
2013-11-11 18:18:25 +11:00
Sean Harvey
70c23f37de Merge pull request #2608 from andrewvt/3.1
added removeFromGroupByCode() function to Member.php
2013-11-03 12:27:10 -08:00
andrewvt
953dec8863 Updated group filter
Updated group filter
2013-11-01 07:22:13 -04:00
Sean Harvey
42fa4d6005 Merge pull request #2574 from dhensby/patch-1
Allowing chaining on `PasswordValidator`
2013-10-31 15:54:18 -07:00
Devlin
6c6ab7b0ce Bad redirect in ChangePasswordForm->doChangePassword() 2013-10-30 09:57:28 +01:00
andrewvt
9a11c643da added removeFromGroupByCode() function to Member.php
I was using the addToGroupByCode() function today and it would have been handy to have a removeFromGroupByCode() so I decided to add one.
2013-10-24 16:57:00 -04:00
Mateusz Uzdowski
1a39f61598 BUG Fix the password reset message to be shown consistently.
If we detect any of the password reset GET params, it's safe to assume
that someone intended a password reset, regardless of other conditions.
2013-10-25 09:29:21 +13:00
Ingo Schommer
b56ca812dc Merge remote-tracking branch 'origin/3.1'
Conflicts:
	tests/security/MemberTest.php
2013-10-23 14:53:29 +02:00
Ingo Schommer
d7e10e620a Merge pull request #2537 from wilr/membervalidator
FIX: Use Injector API for managing Member_Validator instance.
2013-10-23 03:01:15 -07:00
Ingo Schommer
1895f289cc Merge pull request #2560 from TomSpeak/patch-2
NEW Hook for `Member::registerFailedLogin`
2013-10-22 11:57:21 +02:00
Daniel Hensby
974d575826 Allowing chaining on PasswordValidator
Allowing chaining on `PasswordValidator`.

Also using injector pattern for `ValidationResult` instanciation
2013-10-21 20:01:30 +01:00
Ingo Schommer
25b6175e67 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	.travis.yml
	forms/FormField.php
2013-10-20 13:52:56 +02:00
Thomas Speak
d22ca62c6f BUG FailedLoginCount reset
If you fail your maximum login attempts and are locked out, further failed login attempts add to your already existing FailedLoginCount as it is only reset if you log in successfully. This means that if you're locked out, then try again, one failure will automatically lock you out again, regardless of what you set your max limit to.

Example:

lock_out_after_incorrect_logins: 3
FailedLoginCount: 0

The user fails three login attempts.

lock_out_after_incorrect_logins: 3
FailedLoginCount: 3

The user is now locked out.

Lockout time passes.

The user fails their 4th login.

lock_out_after_incorrect_logins: 3
FailedLoginCount: 4

This will continue to happen until the user successfully logs in, without giving them the pre-defined amount of login attempts again due to this condition being met after every incorrect login:
```php
if($this->FailedLoginCount >= self::config()->lock_out_after_incorrect_logins) {
```

FailedLoginTestCount Test Added
2013-10-18 13:48:11 +01:00
Thomas Speak
e8287cd2f5 NEW Hook for Member::registerFailedLogin
Adding a hook for registerFailedLogin so that it is possible to add some custom logic when a user fails to login

Also rearranged the write as this function could hit the DB up to 3 times. Now it will me 0 or 1 times.
2013-10-18 10:17:28 +01:00
Will Rossiter
813d34b15e FIX: Use Injector API for managing Member_Validator instance.
Updates the CMS profile page and SecurityAdmin to give developers a few ways to customise the required fields.

Added extension hook updateValidator for getValidator for things like modules to inject required fields to go along with Injector for replacing the entire class for project specific use.
2013-10-16 11:29:43 +13:00
Devlin
5ea314d012 FIX PasswordValidator->characterStrength() Documentation 2013-10-15 12:44:50 +02:00
Will Rossiter
b0f38f4990 Change default message to be credential agnostic. 2013-10-11 11:22:15 +13:00
Ingo Schommer
b367dd6237 API Removed Member.LastVisited and Member.NumVisits 2013-10-10 12:35:07 +02:00
Ingo Schommer
8727d1b1eb Merge remote-tracking branch 'origin/3.1' 2013-10-10 12:11:50 +02:00
Ingo Schommer
cd225f0fa4 No HTML entities in "Groups" ListboxField (fixes #2513) 2013-10-10 12:08:16 +02:00
Ingo Schommer
60fc7e5346 Merge remote-tracking branch 'origin/3.1' 2013-10-06 19:07:39 +02:00
Damian Mooyman
5bbea12b45 BUG Issue with login form failing to login in certain situations. Fixes issue #2424 2013-10-03 17:12:30 +13:00
Ingo Schommer
c7f656cd00 API Removed "PastMember" cookie and template getter
The functionality is easy to replicate in custom controllers,
and is too rarely used to be placed in core.

This also removes the `Member::is_repeat_member()` getter
and the `PastMember`/`IsRepeatMember` template globals.

See https://groups.google.com/forum/#!topic/silverstripe-dev/b8K3wU64TXg
2013-09-27 20:06:25 +02:00
Ingo Schommer
455e550d9a Merge remote-tracking branch 'origin/3.1'
Conflicts:
	docs/en/topics/testing/create-silverstripe-test.md
	forms/Form.php
	i18n/i18n.php
	model/Image.php
2013-09-27 19:22:14 +02:00
Ingo Schommer
0ea7042443 $privileged_permissions visibility (fixes #2464) 2013-09-27 18:56:38 +02:00
Ingo Schommer
03d1d58148 Merge remote-tracking branch 'origin/3.0' into 3.1
Conflicts:
	admin/code/SecurityAdmin.php
	css/AssetUploadField.css
	docs/en/topics/configuration.md
	security/PermissionRole.php
2013-09-12 17:33:36 +02:00
Ingo Schommer
c2b312d76f Merge remote-tracking branch 'origin/3.1.0' into 3.1 2013-09-12 17:24:42 +02:00
Ingo Schommer
f803704d91 FIX Disallow permissions assign for APPLY_ROLES (SS-2013-005)
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:43 +02:00
Ingo Schommer
05757efceb FIX Privilege escalation through APPLY_ROLES assignment (SS-2013-005)
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:43 +02:00
Ingo Schommer
720c149aee FIX Privilege escalation through Group hierarchy setting (SS-2013-003)
See http://www.silverstripe.org/ss-2013-003-privilege-escalation-through-group-hierarchy-setting/
2013-09-12 15:42:42 +02:00
Ingo Schommer
091c096dbf FIX Disallow permissions assign for APPLY_ROLES (SS-2013-005)
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:36 +02:00
Ingo Schommer
cfa88adf4b FIX Privilege escalation through APPLY_ROLES assignment (SS-2013-005)
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
2013-09-12 15:42:36 +02:00
Ingo Schommer
68ca47b0dd FIX Privilege escalation through Group hierarchy setting (SS-2013-003)
See http://www.silverstripe.org/ss-2013-003-privilege-escalation-through-group-hierarchy-setting/
2013-09-12 15:42:35 +02:00
Sean Harvey
e43ca931d6 Merge pull request #2343 from chillu/pulls/security-404
Returning 404 on /Security, instead of Controller.ss template
2013-09-05 18:56:23 -07:00
Ingo Schommer
1c31c098ee FIX Correct Zend_Locale fallbacks in i18n/DateField/DateTimeField
Due to the recent change of translations to transifex, some
locales changed their names, which prompted a fix to
i18n::get_available_translations() (see 00ffe7294).
This caused a regression where short locales are determined
from the YAML file names (e.g. "en"), but weren't matched up
with fully qualified locales from get_available_translations() (e.g. "en_US").
Since this list is used in the admin/myprofile dropdown for the Member.Locale value,
it didn't match up with any entries and defaulted to the first one ("Africaans").

Note that the behaviour of admin/myprofile is still a bit weird:
It defaults the locale on new members to the one set for the current administrator.
So if a site defaults to en_US in _config.php, but the admin happens to view
his backend in de_DE, all members he creates default to de_DE as well.

Thanks to @tractorcow for contributing and peer reviewing!
2013-08-30 10:18:00 +02:00
Ingo Schommer
20b49e215c Merge pull request #2136 from nedmas/fix-remove-export-button-padding
FIX: GridField button styling
2013-08-30 00:24:21 -07:00
Ingo Schommer
a4c6ae3e90 Merge remote-tracking branch 'origin/3.1' 2013-08-22 13:56:33 +02:00
Simon Welsh
151baeede1 Correct line length and indentation 2013-08-21 18:54:05 +12:00
Ingo Schommer
18ae4c5db6 Returning 404 on /Security, instead of Controller.ss template
We shouldn't expose unsolicited content on public URLs,
mainly because it impacts SEO.
2013-08-20 21:12:55 +02:00
Mateusz Uzdowski
085d2e62cb BUG MemberLoginForm fields should be tagged as required. 2013-08-12 09:32:03 +12:00
Ingo Schommer
2a35f2f928 Merge remote-tracking branch 'origin/3.1' 2013-08-07 17:34:11 +02:00
Julian Seidenberg
17e0432252 BUG adding a more descriptive message when the CMS session times out. It used to say "Forbidden", now it says "Not logged in". 2013-08-06 17:27:37 +12:00
Hamish Friedlander
0a79ac3592 Merge branch 'origin/3.1'
Conflicts:
	templates/forms/CheckboxSetField.ss
	templates/forms/FormField_holder.ss
	templates/forms/OptionsetField.ss
2013-07-19 16:25:38 +12:00
Mateusz Uzdowski
d4a6f7304e BUG First error should take precedence here. No further checks needed. 2013-07-19 08:54:52 +12:00
Ingo Schommer
d4a1e6d294 BUG Prevent clickjacking in CMS and Security controllers (fixes #2215) 2013-07-14 22:44:09 +02:00
Ingo Schommer
b58e2dbe3a Member.lock_out_delay_mins configurable, password security docs 2013-07-11 09:47:28 +02:00
Simon Welsh
fbce9fd7cd Merge branch '3.1'
Conflicts:
	.travis.yml
	docs/en/misc/contributing/code.md
	javascript/HtmlEditorField.js
2013-07-05 10:22:58 +12:00
Simon Welsh
1d5ac5876b Only redirect on logout if we're not already redirecting 2013-06-27 09:49:10 +12:00
Tom Densham
3596892001 FIX: GridField button styling
Remove all top/bottom margins from buttons and apply to GridFieldButtonRow component. Ensure that all buttons are added to a suitable GridFieldButtonRow in ModelAdmin, SecurityAdmin and Group.
2013-06-21 14:22:00 +01:00
Ingo Schommer
94b4237372 Merge remote-tracking branch 'origin/3.1' 2013-06-19 11:17:33 +02:00
Will Morgan
db3eed1f9a Using Injector pattern for ValidationResult in Member 2013-06-18 15:49:58 +01:00
Stig Lindqvist
2eafd63297 Merge pull request #2077 from halkyon/changepassword_validation_redirection_issue
BUG If BackURL set, validation errors send the user to wrong place.
2013-06-07 22:44:13 -07:00
Sean Harvey
83bff54ec2 BUG If BackURL set, validation errors send the user to wrong place.
If there's validation errors in the ChangePasswordForm, the user
is taken to the BackURL because redirectBack() will go there if
it's set.

Instead of this, just redirect back to the "changepassword" action
on the Security controller.
2013-06-08 11:34:58 +12:00
Sean Harvey
7862ececbd Allow PasswordValidator to be translated 2013-06-08 10:48:27 +12:00
Will Morgan
1c0ae76f8e Adding passwordless message instead of throwing an exception 2013-06-07 16:52:44 +02:00
Ingo Schommer
88536998b9 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	.travis.yml
2013-05-31 18:08:59 +02:00
Sam Minnée
5d76048275 Merge pull request #1780 from hdrlab/patch-4
Disable ID based partial caching for all security actions
2013-05-24 23:53:04 -07:00
Sam Minnée
628391e3f1 Merge pull request #1979 from nedmas/patch-1
BUGFIX: singleton('Group')->Members() fails
2013-05-24 19:45:54 -07:00
Ingo Schommer
016368afdc Merge pull request #1994 from mateusz/logout-cleanup
BUG Clean up the logOut and session destructon routines.
2013-05-24 16:01:42 -07:00
Tom Densham
d36fbfb1b2 BUGFIX: singleton('Group')->Members() fails
Running Members() on a Group that has no Db record causes UnsavedRelationList to be returned by DirectMembers() which in turn causes alterDataQuery() to fall over when called on an UnsavedRelationList. This just adds a simple check to prevent it.
2013-05-23 17:31:19 +02:00
Sam Minnee
d97ca43cd0 Merge branch '3.1'
Conflicts:
	README.md
	dev/install/install.php5
	forms/ConfirmedPasswordField.php
	tests/forms/FormTest.php
2013-05-23 19:01:58 +12:00
Sean Harvey
ac2216dabc Merge pull request #1969 from robert-h-curry/patch-1
Only show direct members of a group in the members field
2013-05-22 20:28:17 -07:00
Mateusz Uzdowski
2f7fd967b2 BUG Clean up the logOut and session destructon routines. 2013-05-23 13:27:41 +12:00
Ingo Schommer
ee784c3663 Fix priority of Member->getHtmlEditorConfigForCMS() (silverstripe/silverstripe-cms#728) 2013-05-22 21:31:42 +02:00
Robert Curry
aeb5a2e42a Only show direct members of a group in the members field
The call to Members() includes members of child groups, which was causing any members added through the grid field to be added to the child groups as well.
2013-05-22 18:48:36 +12:00
Sean Harvey
abad856534 Use create() to instantiate Member_GroupSet on Member::Groups()
Keeps it consistent with how HasManyList and ManyManyList are
instantiated in DataObject.
2013-05-22 13:56:36 +12:00
Sean Harvey
15f7c884f8 Merge pull request #1756 from halkyon/permission_denied_hook
BUG Security::permissionFailure() fixing permissionDenied hook inconsistency
2013-05-13 02:15:58 -07:00
Will Morgan
17e31fc609 Merge pull request #1 from silverstripe/master
Syncing back because I suck at Git
2013-05-08 03:45:51 -07:00
Ingo Schommer
3e88c98ca5 API Restrict MemberLoginForm to POST requests for increased security
CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.
2013-05-08 10:25:28 +02:00
Josua2012
59be4a3be0 Allow custom ChangePasswordForm form
With this modification we can use Object::useCustomClass() to create a
custom ChangePasswordForm form:
Object::useCustomClass('ChangePasswordForm',
'CustomChangePasswordForm');
2013-05-08 09:39:39 +02:00
Ingo Schommer
6c2e791a48 Merge remote-tracking branch 'origin/3.1' 2013-04-29 08:59:06 +02:00
Will Morgan
8f6451612b Use correct config variable name in encrypt_password
Use correct config variable name in encrypt_password
Fixes https://github.com/silverstripe/sapphire/issues/1709
2013-04-28 09:58:42 +12:00
Will Morgan
0de8a8a304 Use correct config variable name in encrypt_password
Use correct config variable name in encrypt_password
Fixes https://github.com/silverstripe/sapphire/issues/1709
2013-04-27 13:29:13 +02:00
Will Morgan
c61f050757 Use correct config variable name in encrypt_password
Use correct config variable name in encrypt_password
Fixes https://github.com/silverstripe/sapphire/issues/1709
2013-04-27 13:22:00 +02:00
Will Morgan
72a7f0e672 AJAX friendly responses for Security class
Final work around issue #1802 - creating templates for complex layout
operations and removing HTML from this controller.
2013-04-26 12:29:35 +01:00
hdrlab
22f5c06fd3 Disable ID based partial caching for all security actions
Disables ID based partial caching for all security actions so that actions such as Security/lostpassword and Security/passwordsent work properly even if partial caching is used.
2013-04-19 16:45:05 +12:00
Marvin Dickhaus
ea558828c9 Group description in CMSFields 2013-04-14 22:11:19 +02:00
Sean Harvey
1eadff5a4f BUG Security::permissionFailure() fixing permissionDenied hook inconsistency
permissionDenied only works if Security::permissionFailure() is called when
there's currently no logged in Member. This fixes it so failed attempts
with logged in Member also includes the permissionDenied hook.

In addition, fix an undefined $member variable
2013-04-12 10:59:00 +12:00
Ingo Schommer
0343a77d30 Merge remote-tracking branch 'origin/3.1' 2013-04-11 11:42:04 +02:00
Ingo Schommer
7d6edccb0a Marked Security.token as private 2013-04-09 01:48:20 +02:00
Ingo Schommer
97819b3f21 Correct encoding in MemberLoginForm->forgotPassword() URLs (fixes #6126) 2013-04-05 11:15:34 +02:00
Ingo Schommer
cfafa19cc3 FIX Disallow group removal when member is edited in groups view
It would invalidate this view. Only allow group editing
for new members added to this group (with a group default),
and for members edited through the "root" view.
2013-04-05 00:51:24 +02:00
Will Rossiter
70144ad549 FIX: Groups should be able to have titles longer than 50 characters (Fixes: open/5611) 2013-03-26 22:05:37 +13:00
Ingo Schommer
3334eafcb1 API Marked statics private, use Config API instead (#8317)
See "Static configuration properties are now immutable, you must use Config API." in the 3.1 change log for details.
2013-03-24 17:20:53 +01:00