This document contains information for an outdated version (2.4) and may not be maintained any more.

If some of your projects still use this version, consider upgrading as soon as possible.

2.4.9 (2012-12-04) #

Overview ##

This release provides security fixes to make password hashes more secure, and fixes a regression around duplicated CMS actions.

Upgrading

Impact of the upgrade:

  • Reset password email links generated prior to 2.4.9 will cease to work.
  • Users who use the "remember me" login feature will have to log in again.

API changes related security patch 22095dae:

  • Member::generateAutologinHash is deprecated. You can no longer get the autologin token from AutoLoginHash field in Member. Instead use the return value of the Member::generateAutologinTokenAndStoreHash and do not persist it.
  • Security::getPasswordResetLink now requires Member object as the first parameter. The password reset URL GET parameters have changed from only h (for hash) to m (for member ID) and t (for plaintext token).
  • RandomGenerator::generateHash will be deprecated with 3.1. Rename the function call to RandomGenerator::randomToken.

Security: Hash autologin tokens before storing in the database.

Severity: Moderate

Autologin tokens (remember me and reset password) are stored in the database as a plain text. If attacker obtained the database he would be able to gain access to accounts that have requested a password change, or have "remember me" enabled.

Details

Bugfixes

  • 2012-11-21 6eb597a ed travis.yml paths (Ingo Schommer)
  • 2012-11-21 41aec54 Consistently use FormResponse in CMS JavaScript (fixes #8036) (Ingo Schommer)
  • 2012-11-09 a2501ad ed bootstrap.php path in phpunit.xml.dist (Ingo Schommer)

Other

  • 2012-12-04 2ea9f26 Support for composer-created themes dir structure (Ingo Schommer)
  • 2012-12-04 75e58c9 More graceful handling of missing GET data in ModelAdmin (Ingo Schommer)
  • 2012-12-04 c802659 Relaxed composer version requirements so that stable releases can be created. (Sam Minnee)
  • 2012-11-28 9fa3c52 Exclude vendor/ folder from default phpunit run (Ingo Schommer)
  • 2012-11-09 3f24b0f Added README with build status (Ingo Schommer)
  • 2012-11-09 65793e2 Added travis support (Ingo Schommer)
  • 2012-11-08 f8e860f Removed .mergesources.yml, not used since the dark SVN days (Ingo Schommer)
  • 2012-11-01 157a275 Removed custom repo sources from composer.json (Ingo Schommer)
  • 2012-11-01 7abb6ec Added composer.json (Ingo Schommer)

Comments

Comment policy: Please use comments for tips and corrections about the described functionality.
Comments are moderated, we reserve the right to remove comments that are inappropriate or are no longer relevant. Use the Silverstripe Forum to ask questions.

blog comments powered by Disqus