From c4b982ff523b9b51e98bd35a1d1ab02e18f697c7 Mon Sep 17 00:00:00 2001 From: "Beau Beauchamp, WebTigers" Date: Fri, 7 Aug 2026 13:12:29 -0400 Subject: [PATCH] =?UTF-8?q?Release=20v0.51.1-beta=20=E2=80=94=20CSRF=20tok?= =?UTF-8?q?en=20lifetime=20+=20change-password=20validation=20UX?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug-fix release: the single-use CSRF token (#105) and the change-password form's validation surfacing — localized inline field errors, the strength meter on the profile page, a clear 'Passwords do not match', and a client-side match check (#106). Also backfills the 0.51.0-beta CHANGELOG entry that was skipped. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 28 ++++++++++++++++++++++++++++ library/Tiger/Version.php | 2 +- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 077657b..e7d3832 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,34 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows ## [Unreleased] +## [0.51.1-beta] — 2026-08-07 + +### Fixed +- **CSRF token is no longer effectively single-use (#105).** `Zend_Form_Element_Hash` armed the + token with a 1-hop session expiration, so the first submit consumed it — a submit that failed any + *other* field's validation then left the corrected resubmit dead with *"your security token + expired,"* fixable only by a full page refresh (hit on the profile Security / change-password form). + New `Tiger_Form_Element_Hash` arms the token on its timeout only (matching `Tiger_Form`'s documented + "not single-use; validates until it times out"), so a failed-then-corrected resubmit works. +- **Change-password form now surfaces its validation (#106).** Field-level validator messages are + localized — `Tiger_Service_Service::_formErrors` translates each field message the same way + top-level `messages[]` already were, so a validator's semantic key (e.g. `password.too_short`) + renders as a real sentence — and the view shows them inline (`.invalid-feedback`) instead of a bare + red icon. The password **strength meter** now loads on the account-layout profile page (it was + auth-layout-only). The confirm-mismatch message reads **"Passwords do not match."** (was Zend's + default), and new/confirm are matched **client-side** before the round trip. + +## [0.51.0-beta] — 2026-08-06 + +### Added +- **CMS authoring: partial editor, Blocks, and content-region layouts (#103).** A partial is editable + inside its layout's chrome; a **Block** is a detached copy-in fragment (My Blocks palette + Save as + Block). PUMA ships prebuilt content-region layouts (full-width / sidebars) that compose partials + inside `
`, with the shell's injection points abstracted from CMS users. +- **Theme templates as forkable starters + Modules taxonomy.** Theme layouts/partials surface as + forkable templates (server-side DataTable); the Modules screen is a DataTable with a Type column + + taxonomy filter, and an installed module retains the taxonomy it was downloaded under. + ## [0.50.0-beta] — 2026-08-04 ### Changed diff --git a/library/Tiger/Version.php b/library/Tiger/Version.php index 99faf73..f1ed674 100644 --- a/library/Tiger/Version.php +++ b/library/Tiger/Version.php @@ -9,5 +9,5 @@ class Tiger_Version { /** Current Tiger Core version. Keep in lockstep with the git tag cut for a release. */ - const VERSION = '0.51.0-beta'; + const VERSION = '0.51.1-beta'; }