tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity
a534b7c784
silverstripe-framework/docs/en/changelogs/3.0.6.md
Ingo Schommer 2e3511bc5f Merge remote-tracking branch 'origin/3.0' into 3.1 
Conflicts:
	docs/en/changelogs/3.0.6.md
	forms/Form.php
	forms/FormField.php
	forms/TreeDropdownField.php
2013-09-27 18:50:47 +02:00

2.5 KiB
Raw Blame History

3.0.6

Overview

  • Security: Require ADMIN for ?flush=1 (stop denial of service attacks) (#1692)

Details

Security: Require ADMIN for ?flush=1 (SS-2013-001)

See announcement

Security: Privilege escalation through Group hierarchy setting (SS-2013-003)

See announcement

Security: Privilege escalation through Group and Member CSV upload (SS-2013-004)

See announcement

Security: Privilege escalation through APPLY_ROLES assignment (SS-2013-005)

See announcement

Security: Information disclosure in Versioned.php (SS-2013-006)

See announcement

Security: Privilege escalation through Group hierarchy setting (SS-2013-003)

See announcement

Security: Privilege escalation through Group and Member CSV upload (SS-2013-004)

See announcement

Security: Privilege escalation through APPLY_ROLES assignment (SS-2013-005)

See announcement

Upgrading

  • If you have created your own composite database fields, then you should amend the setValue() to allow the passing of an object (usually DataObject) as well as an array.
  • If you have provided your own startup scripts (ones that include core/Core.php) that can be accessed via a web request, you should ensure that you limit use of the flush parameter
  • Translation entity namespaces can no longer contain dots, since it conflicts with the YAML format.
  • Translation entities defined in templates now use their fully qualified entity name without dots. Before: BackLink_Button.ss.Back, after BackLink_Button_ss.Back. Please fix any custom language files or uses of those entities in custom code.
  • If using "Māori/Te Reo" (mi_NZ) as your CMS locale, please re-select it in admin/myprofile to ensure correct operation (it has changed its locale identifier)