ede381326b
Already applied to root .htaccess, but required for dynamically generated file from installer as well. Also added upgrade instructions.
2.5 KiB
3.0.4
Overview
- Security: Information leakage through web access on YAML configuration files
- Security: Information leakage through web access on composer files
- Security: Require ADMIN permissions for
?showtemplate=1 - Changed
dev/tests/setdbanddev/tests/startsessionfrom session to cookie storage.
Details
Security: Prevent web access to YAML and composer files
Severity: Moderate
Description: YAML files are used to configure the SilverStripe application
since its 3.0 release. These files can contain sensitive values such as database
and API credentials. By default, the installer still stores database credentials
in _config.php files which are safe from web access. So this only concerns
configuration values added in your own project, or a third party module.
Resolution: Update your .htaccess file (for Apache), or your web.config file (for IIS)
with the new files from the project root, and reapply any customizations you've made.
Follow the general upgrade instructions.
The nginx installation instructions
have also been updated to reflect those changes.
Security: Information exposure through web access on composer files
Severity: Low
Description: Composer is a dependency management
tool which can optionally be used to install SilverStripe. The composer.json
and composer.lock files are required for its operation, so they are included
in the standard release since 3.0.2. These files contain information on the installed
versions of core and thirdparty modules, which could be used to target specific
versions of SilverStripe.
Resolution: Update your .htaccess file (for Apache), or your web.config file (for IIS)
with the new files from the project root, and reapply any customizations you've made.
Follow the general upgrade instructions.
The nginx installation instructions
have also been updated to reflect those changes.
Security: Require ADMIN permissions for ?showtemplate=1
Severity: Low
Description: Avoids information leakage of compiled template data, which might expose some of the internal template logic.
Upgrading
- If you are using
dev/tests/setdbanddev/tests/startsession, you'll need to configure a secure token in order to encrypt the cookie value: Simply runsake dev/generatesecuretokenand add the resulting code to yourmysite/_config.php. Note that this functionality now requires the PHPmcryptextension.