49 KiB
4.8.0 (Unreleased)
Security patches
This release contains security patches. Some of those patches might require some updates to your project.
CVE-2020-25817 XXE Vulnerability in CSSContentParser
A tool intended for dev-only use CSSContentParser parses HTML using a the SimpleXML parser. Older versions of libxml do not have external entity loading disabled by default. This security patches explicitly disables external entity loading. It can be re-enabled if required via configuration
Overview
New features
- Added a
chunkedFetch()method toDataListto avoid loading large result sets in memory all at once.
Support for silverstripe/graphql v4
The silverstripe/graphql module to drive various parts of the CMS UI, as well as building your own GraphQL APIs in Silverstripe projects.
The CMS currently ships with silverstripe/graphql:^3, which is stable but slow for larger schemas.
The module was rewritten from scratch with performance in mind
(see goals and pull request).
The resultingsilverstripe/graphql:^4 release is currently in a alpha stage.
We encourage everyone to get started, read our new GraphQL documentation,
provide feedback and help us stabilise the module.
In order to facilitate the new module release, most GraphQL helper classes to drive the CMS UI
have been marked as deprecated, and moved to GraphQL/_legacy folders within core modules.
The GraphQL schema under admin/graphql has been altered slightly to enable forwards compability,
with lower-camelcase field names, and a different filter argument structure.
In the unlikely case that you are relying on those classes or queries directly,
consider upgrading to silverstripe/graphql:^4.
Your own GraphQL schemas outside of admin/graphql should not be affected by the changes
if you choose to stay on silverstripe/graphql:^3 for the time being.
We are planning to require the use of silverstripe/graphql:^4 in a future CMS 4.x release.
GraphQL 3 code moved to _legacy folder
You will notice that many of the core modules now have a _legacy directory in their root.
This is a temporary fix that we have applied to satisfy the competing interests of semver and
PSR-4 autoloading.
Because the semver contract precludes changing the fully-qualified names of any classes,
we need to keep GraphQL 3 code untouched. But GraphQL 4 code often contains classes of similar
or identical names, e.g. "ReadFilesResolver", or something to that effect. Further, this
backward compatibility creates a common demand for the canonical namespace "GraphQL.", e.g.
SilverStripe\AssetAdmin\GraphQL. It didn't seem appropriate to put old code in the "GraphQL"
space, and new code in a less obvious place, like SilverStripe\AssetAdmin\GraphQL4.
A simple fix would have been to stuff all the GraphQL 3 code into code/GraphQL/_legacy and use classmap to shim the PSR-4 autoloader, but this is no longer supported in Composer 2.0.
Thus, we ended up with the "least bad" solution, which was to create a parallel path resolution
for GraphQL 3 code in the _legacy folder, alongside code/ / src/.
It is likely that in the future, we will mandate the use of GraphQL 4 in Silverstripe CMS, and
remove this shim. We expect this happen within just one minor release, making _legacy/ a very short-lived workaround.
Enhancements
Default time period for log in form "remember me" checkbox reduced from 90 to 30 days
Based on feedback from users, we've reduced the time period of the "remember me" checkbox on the login form from
90 to 30 days. This value is configurable via SilverStripe\Security\RememberLoginHash::token_expiry_days.
Security patches
This release contains security patches. Some of those patches might require some updates to your project.
CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth
The Silverstripe CMS graphql endpoint on /admin/graphql can be accessed via basic authentication and bypass Multi-Factor Authentication (MFA).
The basic-auth authenticator is no longer enabled by default. The regular member authenticator is still enabled and
protects the /admin/graphql endpoint.
If your site does not use MFA, or you understand that it can be bypassed, then the basic authenticator can be reinstalled with the following configuration.
## Change LogSecurity
-
silverstripe/framework (4.7.3 -> 4.8.0)
- 2021-02-18 802455137 Validate custom multi-file uploads (Steve Boyd) - See cve-2020-26138
- 2021-02-11 7f97734a2 Prevent loading of xml entities (Steve Boyd) - See cve-2020-25817
-
silverstripe/graphql (3.4.1 -> 3.5.0)
- 2021-02-09 149b4ed Disable basic-auth for graphql requests (Steve Boyd) - See cve-2020-26136
Features and Enhancements
-
silverstripe/installer (4.7.3 -> 4.8.0)
- 2021-04-30 4e1fa26 Add login-forms to changelog template (Steve Boyd)
-
silverstripe/framework (4.7.3 -> 4.8.0)
- 2021-04-15 d9e8dd42c Update keep me signed in tooltip text (Steve Boyd)
- 2021-04-06 1c7fd287a Reduce default token period from 90 to 30 days (Steve Boyd)
- 2021-02-11 095a3b70f Provide helpers for isDev/isTest/isLive in templates (Loz Calver)
- 2020-10-22 eedad00eb Expose TreeDropdownField root node ID in schema (Loz Calver)
-
silverstripe/admin (1.7.3 -> 1.8.0)
-
silverstripe/asset-admin (1.7.1 -> 1.8.0)
-
silverstripe/versioned-admin (1.7.2 -> 1.8.0)
-
silverstripe/cms (4.7.1 -> 4.8.0)
-
silverstripe/versioned (1.7.2 -> 1.8.0)
- 2021-02-26 3995209 Update Versioned Admin menu title to "Archive" (#302) (Chris Penny)
- 2020-12-01 1ac859e Compliance with new SchemaConfig API (#315) (Aaron Carlino)
- 2020-11-19 68cbd4f compatibility with new stateless plugins (Aaron Carlino)
- 2020-11-13 4a42ca7 GraphQL 4 Compatibility (#308) (Aaron Carlino)
-
silverstripe/graphql (3.4.1 -> 3.5.0)
- 2020-11-13 25f654c Field formatting API, forward compatibility (#313) (Aaron Carlino)
-
silverstripe/login-forms (4.3.0 -> 4.4.1)
Bugfixes
-
silverstripe/assets (1.7.0 -> 1.8.0)
- 2021-03-19 6dd8559 Ensure remove folder removes all exepcted files/folders/links (#430) (Adrian Humphreys)
- 2021-03-12 756be6f Remove disabled extensions from allowed_extensions (#439) (Andrew Aitken-Fincham)
- 2021-03-01 4018329 Cast image dimensions from shortcode as int to avoid exception when dimensions are not numeric (#436) (Michael van Schaik)
-
silverstripe/framework (4.7.3 -> 4.8.0)
- 2021-04-20 12a6f7bd0 fix typo in core constants phpdoc block (maks)
- 2021-03-30 66fa597b3 Better handling of remember me token when login across devices is disabled (#9895) (Maxime Rainville)
- 2021-03-03 d2fa64b48 Allow Email to re-render when data changes (#9876) (Nik)
- 2021-02-25 028c4fdaa Tweak shortcode parser so it properly parse empty attributes (Maxime Rainville)
- 2021-02-08 33365b92f Bug Fix - Ensure DataQuery::exists() SQL is both valid MySQL and T-SQL (Joe Harvey)
- 2021-01-21 0dd59a1e7 Reset GridFieldFilterHeader grid state when search is cleared (#9829) (Maxime Rainville)
- 2021-01-07 2f64667bd DBComposite getIndexSpecs method using self API to get the list of db fields (Serge Latyntcev)
- 2020-12-29 3b74c2596 Fix DataQuery::exists() not working correctly (3Dgoo)
- 2020-12-28 157d426d3 URL to Symfony cache adapters (Patrick Nelson)
- 2020-12-22 43777d1df Update .gitattributes and some http:// links (#9805) (William Desportes)
- 2020-12-21 c932d7e7f Fix the phpdoc blocks (William Desportes)
- 2020-12-15 5be045f9a Bug when specifying 0 in ArrayList::offsetSet (Steve Boyd)
- 2020-12-07 61afab2ed fix indentation (Lukas)
- 2020-08-17 5226d961e Fix unit test (Maxime Rainville)
-
silverstripe/admin (1.7.3 -> 1.8.0)
- 2021-05-11 4793b9f Fix TreeDropDownField no longer displaying dropdown options (#1196) (Andre Kiste)
- 2021-02-25 036bc9e Fix merge conflict from merge-up (Steve Boyd)
- 2021-02-14 9a4bf89 Allow external link anchor fiel to work even if the user provides a hash mark (Maxime Rainville)
- 2021-01-26 095b773 Clean up old life cycle methods and fix serach filter compenent state (Maxime Rainville)
- 2020-12-02 bc9457b Fix inforrect modelConfig (Aaron Carlino)
- 2020-10-22 397fa06 TreeDropdownField wouldn't render children when using TreeBaseID (fixes #954) (Loz Calver)
- 2020-08-28 7594ef2 Do not override grid state with search parameters (Maxime Rainville)
-
silverstripe/asset-admin (1.7.1 -> 1.8.0)
-
silverstripe/campaign-admin (1.7.1 -> 1.8.0)
- 2020-09-16 1a9af45 Display a notification after publishing a campaign (Maxime Rainville)
-
silverstripe/versioned-admin (1.7.2 -> 1.8.0)
-
silverstripe/cms (4.7.1 -> 4.8.0)
- 2021-03-05 db7efad6 undefined variable inChangeSets (Will Rossiter)
-
silverstripe/versioned (1.7.2 -> 1.8.0)
- 2021-02-24 1685b88 Unset subquery sort in unlinkDisownedRelationship to avoid exception on DB Drivers that disallow sub query sort (#325) (Klemen Dolinsek)
- 2021-02-16 36bfe43 GraphQL tests based on latest refactoring (Ingo Schommer)
- 2021-02-16 e33dd28 Apply version filtering on read correctly (Ingo Schommer)
-
silverstripe/login-forms (4.3.0 -> 4.4.1)
API Changes
-
silverstripe/framework (4.7.3 -> 4.8.0)
-
silverstripe/asset-admin (1.7.1 -> 1.8.0)
-
silverstripe/versioned-admin (1.7.2 -> 1.8.0)
- 2021-05-10 6748fc9 Bump requirement no GraphQL 3.5 (Maxime Rainville)
-
silverstripe/graphql (3.4.1 -> 3.5.0)
- 2021-05-10 f8ac3f7 Block older version module from using this minor (#379) (Maxime Rainville)
Dependencies
-
silverstripe/admin (1.7.3 -> 1.8.0)
-
silverstripe/campaign-admin (1.7.1 -> 1.8.0)
-
silverstripe/versioned-admin (1.7.2 -> 1.8.0)
-
silverstripe/cms (4.7.1 -> 4.8.0)
- 2020-12-11 9136c8a5 Bump ini from 1.3.5 to 1.3.7 (dependabot[bot])
-
silverstripe/login-forms (4.3.0 -> 4.4.1)
Documentation
- silverstripe/framework (4.7.3 -> 4.8.0)
- 2021-03-18 9e766dbaa Fix incorrect CSRF graphql documentation (Aaron Carlino)
- 2021-03-10 4ee92da6b Clarify return value for CompositeValidator::getValidatorsByType() (Maxime Rainville)
- 2021-02-24 34bc08051 Add guide on new MySQL collation to Server Reqs (Garion Herman)
- 2021-02-23 07dea64bf Document removal of exclude directive (Aaron Carlino)
- 2021-02-19 5a4641d80 Disable versioning on GraphQL (#9769) (Ingo Schommer)
- 2021-02-16 68eeef60d GraphQL build requirement changes (Ingo Schommer)
- 2021-02-15 8167c6f3e Update references to graphql basic-auth (Steve Boyd)
- 2021-02-15 eca656ffe fix accidentally nested info box (Ed Wilde)
- 2021-02-15 7d67760a6 fix link syntax (Ed Wilde)
- 2021-02-15 8a8f5e6ba fix code block not closed (Ed Wilde)
- 2021-02-14 e60a25cfb fix typo (Ed Wilde)
- 2021-02-14 01eedff4a fix api link syntax and a couple of typos (Ed Wilde)
- 2021-02-14 3a214a2ed fix broken heading (Ed Wilde)
- 2021-02-12 da56fa785 fix invalid syntax on link (Ed Wilde)
- 2021-02-10 cf50aa71b fix missing closing backtick for code display, add required alt attribute (Ed Wilde)
- 2021-02-10 c3499d20e add a callout to the deprecation notice (Ed Wilde)
- 2021-02-10 95a142a9d complete first sentence describing middleware (Ed Wilde)
- 2021-02-04 1be5f471d Resolver signature and context provider examples (Ingo Schommer)
- 2021-02-01 ac90ec7d4 remove the version number from docs urls (Ed Wilde)
- 2021-01-31 296e41768 fix the 'Server Requirements' url (Ed Wilde)
- 2021-01-30 062656d92 Add "Defining the ModelAdmin models" section (Maxime Rainville)
- 2021-01-27 24ca17053 Docs for GraphQL 4 changes (Aaron Carlino)
- 2021-01-26 fd99d50b3 Maintainer Guidelines updates (Serge Latyntcev)
- 2021-01-19 caa224e37 Remove BuildState documentation (Aaron Carlino)
- 2021-01-14 c82f5eeb7 Add Maintainer Guidelines to the Contributing section (Serge Latyntcev)
- 2021-01-13 d308bb022 GraphQL blacklisted fields (#9768) (Ingo Schommer)
- 2021-01-12 99b15ce6d New "Triage" role for Silverstripe Core (Ingo Schommer)
- 2021-01-12 676353011 Clarified Core vs. Supported Modules (Ingo Schommer)
- 2020-12-22 869aaa79a Fix
FlysystemAssetStorereference (#9807) (Martin D) - 2020-12-08 835284fdf GraphQL filter plugin (Ingo Schommer)
- 2020-12-01 fe972d62d Document new schema config, change to resolver discovery pattern (#9781) (Aaron Carlino)
- 2020-11-25 40d19d04e Filesystem capacity issue potential on caches (Ingo Schommer)
- 2020-11-19 154fb7046 replace broken Director link to Routing (Christopher Darling)
- 2020-11-19 e69cfd152 Document new stateless plugins (Aaron Carlino)
- 2020-11-16 bdb2deb3f Update HistoryViewerField to require javascript more consistently (#9773) (Scott Hutchinson)
- 2020-11-15 b6e4747b7 Add blurb about _legacy to changelog (Aaron Carlino)
- 2020-11-15 f673996aa Fix classname reference in SearchContext docs (#9771) (wernerkrauss)
- 2020-11-11 e02540c76 GraphQL v4 changelog note (#9762) (Ingo Schommer)
- 2020-11-03 bf6a52b9c Add some extra details to the changelog about toast notification and DataObject hydration (#9754) (Maxime Rainville)
- 2020-10-15 fee31c2c6 Recommend moving .protected out of webroot (Ingo Schommer)
Other changes
-
silverstripe/installer (4.7.3 -> 4.8.0)
- 2021-01-21 da876a8 Update build status badge (Steve Boyd)
-
silverstripe/recipe-cms (4.7.3 -> 4.8.0)
-
silverstripe/recipe-core (4.7.3 -> 4.8.0)
-
silverstripe/assets (1.7.0 -> 1.8.0)
-
silverstripe/framework (4.7.3 -> 4.8.0)
- 2021-05-16 dde1e7a5c Update translations (Steve Boyd)
- 2021-04-13 6fc25e4e9 RFC Add chunk method to DataList to iterate over large dataset (#8940) (Maxime Rainville)
- 2021-04-13 e2777ded8 • Add missing string (André Kiste)
- 2021-04-13 31c5ab206 [BUGFIX] Prevent call getHeader() on null HTTPRequest object (Kunal Hari)
- 2021-04-11 bbcc187c0 Update conflicting translations. (André Kiste)
- 2021-04-08 8692aabe9 Use new designs (André Kiste)
- 2021-04-05 b75860b19 PATCH: fix param in docblock ... add \ to FormField::__construct (Nicolaas)
- 2021-04-01 2ecd8b34e adding use SilverStripe\Security\Member; to make sure linting works (Nicolaas)
- 2021-03-30 44fae4497 Better describe the 'keep me signed in' checkbox (André Kiste)
- 2021-03-23 504e20320 Update DBBoolean.php (#9893) (Nicolaas)
- 2021-03-22 daa9060c1 remove unused class import Convert (Christopher Darling)
- 2021-03-22 fc40e0b98 Test that email is trimmed (Thomas Portelange)
- 2021-03-22 22b2d58b5 Update src/Security/Member.php (Thomas Portelange)
- 2021-03-19 0586c55e6 prevent spaces in emails (Thomas Portelange)
- 2021-03-04 9f9ff0151 Update 02_cors.md (Joe Chenevey)
- 2021-02-16 d023f4613 Update upgrading docs to refactoring (Aaron Carlino)
- 2021-02-09 77ecbd854 Updated TreeDropdownField.php documentation (Antony Thorpe)
- 2021-02-03 8c2a9ba07 Document edge case for non-assets install (Aaron Carlino)
- 2021-01-26 452f50700 Update docs/en/05_Contributing/16_Maintainer_Guidelines.md (Serge Latyntsev)
- 2021-01-21 d5eb3216b Update docs/en/05_Contributing/16_Maintainer_Guidelines.md (Ingo Schommer)
- 2021-01-21 7a1a1dc13 Update index.md (Lars Prakken)
- 2021-01-21 a2d7dd081 Update build status badge (Steve Boyd)
- 2021-01-13 fe2027e48 PHPDoc in PEG parser (Ingo Schommer)
- 2020-11-27 e908b68bf Revert "Update 09_Core_committers.md" (Scott Hutchinson)
- 2020-11-26 ddd8e6da3 Revert translation updates (Steve Boyd)
- 2020-11-25 2a99b8295 Fixing links (Patrick Nelson)
- 2020-11-09 1e87528fa Update 14_PHP_Coding_Conventions.md (Andrew Aitken-Fincham)
- 2020-11-09 924d0ccb9 Link to the PHPCS standard used for framework (Andrew Aitken-Fincham)
- 2020-11-06 37a5c9af1 01_Error_Handling: % wrapped in quotes (James Cocker)
- 2020-10-22 bc92b52c1 Remove useless requirement (Christophe Coevoet)
- 2020-08-17 a43414ded Make sure GridState always outputs a JSON Object string (Maxime Rainville)
- 2020-07-08 34f5004b2 Update 04_Rendering_Templates.md (scttw)
-
silverstripe/admin (1.7.3 -> 1.8.0)
- 2021-05-16 bdc8576 Update translations (Steve Boyd)
- 2021-02-22 1f17a3c BUGFIX: remove null request due to urls.reverse() (Aaron Carlino)
- 2021-02-19 7b84013 BUGFIX: Incorrect fragment url (Aaron Carlino)
- 2021-02-17 c4dc092 BUGFIX: Replace GraphQL3 fragment urls, rely on legacy document state (Aaron Carlino)
- 2021-02-16 5490584 Correct GraphQL admin types path (Ingo Schommer)
- 2021-01-27 195b510 Compatibility with GraphQL 4 changes (Aaron Carlino)
- 2021-01-21 a1498ac Update build status badge (Steve Boyd)
- 2020-11-16 13a1232 GraphQL BACKWARD_COMPAT flag fix (#1157) (Ingo Schommer)
- 2020-11-13 9202c18 Move graphql legacy code to _legacy for PSR-4 compat (Aaron Carlino)
-
silverstripe/asset-admin (1.7.1 -> 1.8.0)
- 2021-05-16 d56f0330 Update translations (Steve Boyd)
- 2021-02-17 d303bd90 Linting (Aaron Carlino)
- 2021-02-16 af73cf28 Remove redundant event handler (Aaron Carlino)
- 2021-02-16 1d94a222 Reinstate GraphQL type transcriber config (Ingo Schommer)
- 2021-01-27 c7472e29 Compatibility with GraphQL 4 changes (Aaron Carlino)
- 2021-01-21 d1d76212 Update build status badge (Steve Boyd)
- 2021-01-19 1539dfef Compatibility with new context providers (Aaron Carlino)
- 2020-11-16 4d09b012 GraphQL BACKWARD_COMPAT flag fix (#1162) (Ingo Schommer)
- 2020-11-13 3a96166a Move graphql legacy code to _legacy for PSR-4 compat (Aaron Carlino)
-
silverstripe/campaign-admin (1.7.1 -> 1.8.0)
-
silverstripe/versioned-admin (1.7.2 -> 1.8.0)
- 2021-05-16 066d9ac Update translations (Steve Boyd)
- 2021-05-10 84bba8b Update composer.json (Maxime Rainville)
- 2021-01-21 d941d44 Update build status badge (Steve Boyd)
- 2020-11-16 e1ce901 GraphQL BACKWARD_COMPAT flag fix (Ingo Schommer)
- 2020-11-13 cae464f Allow graphql 4 (Aaron Carlino)
- 2020-08-26 9b9e88a MINOR: Add tests for single-stage ArchiveAdmin (Sam Minnee)
-
silverstripe/cms (4.7.1 -> 4.8.0)
- 2021-05-16 8c151627 Update translations (Steve Boyd)
- 2021-05-07 67bfdf0f BUGFIX: Ensure SiteTree is always available in the CMS, along with ancestors (Aaron Carlino)
- 2021-01-21 f9b6d582 Update build status badge (Steve Boyd)
- 2020-12-08 e22fda3f Remove duplicate injector entry (Aaron Carlino)
- 2020-12-07 e415d418 BUGFIX: Restore, refactor getByLink plugin (Aaron Carlino)
- 2020-11-13 ee3e51e5 Move graphql legacy code to _legacy for PSR-4 compat (Aaron Carlino)
-
silverstripe/errorpage (1.7.0 -> 1.8.0)
-
silverstripe/reports (4.7.0 -> 4.8.0)
-
silverstripe/siteconfig (4.7.0 -> 4.8.0)
-
silverstripe/versioned (1.7.2 -> 1.8.0)
- 2021-05-16 afa9e64 Update translations (Steve Boyd)
- 2021-03-15 41ff068 MINOR: fix incorrect variable (Aaron Carlino)
- 2021-03-12 a566639 MINOR: applyToReadingState should not throw. Allow graceful failure to make implementation simpler (resolveVersionedRead) (#329) (Aaron Carlino)
- 2021-03-11 f0701e5 BUGFIX: replace versions pagination, sort to fix versioned-admin (#326) (Aaron Carlino)
- 2021-02-17 9e451a2 BUGFIX: use correct createStorableSchema method (Aaron Carlino)
- 2021-02-15 821494e Apply versioning only to reading state, and not to nested queries anymore (Aaron Carlino)
- 2021-01-27 b6cab40 Compatibility with GraphQL 4 changes (Aaron Carlino)
- 2021-01-21 fbe05df Update README.md (Steve Boyd)
- 2021-01-19 ebb4c8f Compatibility with new context providers (Aaron Carlino)
- 2020-12-02 33a5e56 Get tests passing (Aaron Carlino)
- 2020-12-02 b7aad04 BUGFIX: move modelConfig to correct location (Aaron Carlino)
- 2020-11-16 fbd9637 Fixed implicit GraphQL dependency (#312) (Ingo Schommer)
- 2020-11-16 dd5a031 Check existence of ResolveInfo (Aaron Carlino)
- 2020-11-15 6404194 Remove classmap (Aaron Carlino)
- 2020-11-13 d3b7709 Move graphql legacy code to _legacy for PSR-4 compat (Aaron Carlino)
-
silverstripe/graphql (3.4.1 -> 3.5.0)
-
silverstripe/login-forms (4.3.0 -> 4.4.1)
- 2021-04-13 370c3ca Display tooltip when title is set (André Kiste)
- 2021-04-13 4554bc5 • Move attribute to login-forms (André Kiste)
- 2021-04-12 a73d0e7 Move bootstrap to npm (André Kiste)
- 2021-04-08 51432f9 Use new designs (André Kiste)
- 2021-03-30 effb664 Better describe the 'keep me signed in' option (André Kiste)
- 2021-01-21 f38beb9 Update build status badge (Steve Boyd)
- 2020-11-06 127532c Setting form max width (Michael Nowina-Krowicki)