Skip to content

0.4.0

Latest

Choose a tag to compare

@thekevinm thekevinm released this 24 Sep 19:43
7476ad4

AMQP service update for DreamFactory 7.7.1: security hardening of the subscription consumer and upgrade to Laravel 13 / PHP 8.3.

Security

  • Scope the AMQP subscribe consumer to the subscriber's role. The subscription callback previously dispatched the triggered service request with permission checks disabled, allowing any user with pub/sub access on a queue to invoke admin-only endpoints; the callback now runs permission-checked under the identity captured at subscribe time (#21)
  • Constrain unserialize() on queue payloads to the Subscribe job class (allowed_classes), with an instanceof guard, blocking PHP gadget-chain attacks via crafted queue payloads (#20)

Maintenance

  • Upgrade to Laravel 13.7 / PHPUnit 11; PHP requirement is now ^8.3. Bumps php-amqplib to ^3.5 and adds explicit laravel/helpers ^1.8 and df-core ~1.0.4 requirements (#19)
  • Add platform overview to README

Full Changelog: 0.3.1...0.4.0