silverstripe-framework/docs/en/changelogs/3.0.4.md

3.0.4

Overview

• Changed dev/tests/setdb and dev/tests/startsession from session to cookie storage.
• Require ADMIN permissions for ?showtemplate=1

Details

Require ADMIN permissions for ?showtemplate=1

Avoids information leakage of compiled template data, which might expose some of the internal template logic.

Upgrading

• If you are using dev/tests/setdb and dev/tests/startsession, you'll need to configure a secure token in order to encrypt the cookie value: Simply run sake dev/generatesecuretoken and add the resulting code to your mysite/_config.php. Note that this functionality now requires the PHP mcrypt extension.