Skip to content

Evolution CMS 3.5.8

Latest
Latest

Choose a tag to compare

View all tags
@Seiger Seiger released this 10 Sep 11:58
· 3 commits to 3.5.x since this release
3.5.8
374e110

Evolution CMS 3.5.8

Evolution CMS 3.5.8 is a security, stability, and developer experience release for the 3.5 branch. This version hardens Manager requests, improves package/update workflows, adds stronger mail diagnostics, and expands CI coverage across modern PHP runtimes.

Highlights

  • Added stricter CSRF protection for Manager actions, including legacy mutating GET actions
  • Improved Manager tab restoration after login and CSRF token rotation
  • Hardened security around unserialize usage, PHx, @FILE, stored/reflected XSS vectors, empty hash login, and upgrade transport
  • Added template source support for database/file based template processing
  • Added mail test tools, SMTP certificate verification controls, and better delivery diagnostics
  • Improved package tooling with vendor publish manifest tracking and transitive dependency reporting
  • Added IANA site timezone setting and improved event log timezone/actor display
  • Improved Docker, installer, upgrade smoke tests, and CI coverage for PHP 8.3, 8.4, and 8.5
  • Updated bundled Composer dependencies

Compatibility Note: CSRF Protection

Evolution CMS 3.5.8 tightens CSRF validation in the Manager. Some third-party or legacy packages may fail with a CSRF token mismatch error if they submit Manager forms, links, or AJAX requests without passing the current _token value or X-CSRF-TOKEN header.

The recommended fix is to update the package code to include csrf_field(), csrf_token(), or the X-CSRF-TOKEN header in Manager requests.

If a third-party package blocks access and you need a temporary compatibility workaround, comment line 76 in core/src/Middleware/VerifyCsrfToken.php:

// return $this->reject($request);

This disables the CSRF rejection response, so use it only as a short-term workaround until the affected package is updated.

Assets 2
Loading