4.4.5

Security patches

This release contains security patches

CVE-2019-19325 (CVSS 7.5)

Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input. There is no known attack vector for extracting user-session information or credentials automatically, it required a user to fall for the phishing attempt. XSS can also be used to modify the presentation of content in malicious ways.

The vulnerability is known to apply in at least the following cases:

The login form provided by Silverstripe. When the login form is used with Multi Factor Authentication (MFA), the attack complexity for phishing increases, and is mitigated by using security keys such as Yubikey as an unphishable token. Forms which are configured to populate field values based on request parameters. This usually happens via setting the $value on a FormField instance during construction of the form, or by loading request data via Form->loadDataFrom($myRequest->getVars()). Forms which have form validation applied through RequiredFields, and opt-out of using CSRF tokens via disableSecurityToken(). In this case, the vulnerability is more impactful if the form is also configured to accept GET submissions, rather than the default of POST submissions. The vulnerability has not identified on forms created through the silverstripe/userforms module.

Change Log

Security

2020-02-03 ad1b00e XSS through non-scalar FormField attributes - See CVE-2019-19325
2020-02-13 d515e5e XSS through non-scalar FormField attributes - See CVE-2019-19325

Bugfixes

2020-01-07 089053b Make discard confirmations show up when navigating away from editing files (bergice)
2019-12-16 8edf14d VersionedFilesMigrator auto-generated .htaccess directives (Serge Latyntcev)
2019-12-15 fbc37fb Default WasDraft to true when migrating versioned DataObject (#240) (Maxime Rainville)
2019-12-09 be5234d Reference the correct filters for endswith and startswith (Maxime Rainville)
2019-11-27 f85209e fix Injector class alias is now quoted to prevent symfony/yaml 4.0 deprecation warnings (wernerkrauss)
2019-11-26 04c377f Fix phpcs install, phpunit name (Serge Latyntcev)
2019-11-24 f78b7a5 Update build script to copy images to dist folder (Maxime Rainville)
2019-11-22 af55826 Fix missing dist images (Damian Mooyman)
2019-11-20 453945da1 Session::restart() didn't correctly restart session (fixes #9259) (Loz Calver)
2019-11-15 64654ec Retrieve file by filename (Maxime Rainville)
2019-11-14 4372544 Fix linting issue in VersionedFilesMigrationTask and VersionedFilesMigrator (Maxime Rainville)
2019-11-12 9648801 Gracefully handle lack of actions in HistoryViewer (Serge Latyntcev)
2019-11-07 3a00ecc Lowercase PHPUnit in composer.json to allow packagist to resolve 1.2.x-dev (Maxime Rainville)
2019-11-04 d32b280 Resolve issue where dev/build does not refresh static content (Damian Mooyman)
2019-10-29 e76601e5c FormAction title property cannot be set if useButtonTag is false (Damian Mooyman)
2019-10-28 f03b3a0 fixed creating multiple duplicate data objects (#961) (Guy Marriott)
2019-10-23 15b21fc Remove deprecated uppercase characters from composer.json (#982) (Garion Herman)
2019-10-09 eb369ed Gracefully handle lack of versions in HistoryViewer (Serge Latyntcev)
2019-10-08 3a3705d archive relationships, not related objects (Dylan Wagstaff)
2019-10-03 f1594fd99 Ensure that canCreate() context matches that respected by GridFieldAddNewButton (Damian Mooyman)
2019-10-03 b3ccd48 Remove buggy code from LeftAndMain Breadcrumb (Maxime Rainville)
2019-10-02 7db524bd9 DebugViewFrendlyErrorFormatter handle of admin_email (Serge Latyntcev)
2019-09-30 be44178 fixed creating multiple duplicate data object by locking out save button on submit (Makreig)
2019-09-29 2799265 Honour AssetAdminFile insert dimensions when inserting a new image (#1015) (Maxime Rainville)
2019-09-29 f475826 Fix inlinting issue (Maxime Rainville)
2019-09-29 30d816e Flush cache before every test in Sha1FileHashingServiceTest (Maxime Rainville)
2019-09-26 959da81 Store the timestamp in the cache (Maxime Rainville)
2019-09-25 255bf2f JSTree error if callback isn't passed (fixes #958) (Loz Calver)
2019-09-24 fb36e03 Search for both Save and Apply change when running behat tests (Maxime Rainville)
2019-09-23 aa7c05742 Don't force-add view button to readonly GridField (fixes #… (#9254) (Guy Marriott)
2019-09-23 190b2f284 run member CMS validator when editing via groups (fixes #9… (#9255) (Guy Marriott)
2019-09-23 efdb9cc71 run member CMS validator when editing via groups (fixes #9184) (Loz Calver)
2019-09-23 d85ff3bc4 Don't force-add view button to readonly GridField (fixes #9249) (Loz Calver)
2019-09-23 f177606 Update Apache .htaccess for new access directives (Dylan Wagstaff)
2019-08-16 9d44a3b Optimise AssetAdminFile::nestedFolderIDs (Guy Marriott)

9.1 KiB Raw Blame History