This document contains information for an outdated version (2.4) and may not be maintained any more. If some of your projects still use this version, consider upgrading as soon as possible.
2.4.9 (2012-12-04) #
This release provides security fixes to make password hashes more secure, and fixes a regression around duplicated CMS actions.
Impact of the upgrade:
- Reset password email links generated prior to 2.4.9 will cease to work.
- Users who use the "remember me" login feature will have to log in again.
API changes related security patch 22095dae:
Member::generateAutologinHashis deprecated. You can no longer get the autologin token from
Member. Instead use the return value of the
Member::generateAutologinTokenAndStoreHashand do not persist it.
Memberobject as the first parameter. The password reset URL GET parameters have changed from only
h(for hash) to
m(for member ID) and
t(for plaintext token).
RandomGenerator::generateHashwill be deprecated with 3.1. Rename the function call to
Security: Hash autologin tokens before storing in the database.
Autologin tokens (remember me and reset password) are stored in the database as a plain text. If attacker obtained the database he would be able to gain access to accounts that have requested a password change, or have "remember me" enabled.
- 2012-11-21 6eb597a ed travis.yml paths (Ingo Schommer)
- 2012-11-09 a2501ad ed bootstrap.php path in phpunit.xml.dist (Ingo Schommer)
- 2012-12-04 2ea9f26 Support for composer-created themes dir structure (Ingo Schommer)
- 2012-12-04 75e58c9 More graceful handling of missing GET data in ModelAdmin (Ingo Schommer)
- 2012-12-04 c802659 Relaxed composer version requirements so that stable releases can be created. (Sam Minnee)
- 2012-11-28 9fa3c52 Exclude vendor/ folder from default phpunit run (Ingo Schommer)
- 2012-11-09 3f24b0f Added README with build status (Ingo Schommer)
- 2012-11-09 65793e2 Added travis support (Ingo Schommer)
- 2012-11-08 f8e860f Removed .mergesources.yml, not used since the dark SVN days (Ingo Schommer)
- 2012-11-01 157a275 Removed custom repo sources from composer.json (Ingo Schommer)
- 2012-11-01 7abb6ec Added composer.json (Ingo Schommer)