Skip to content

Release v1.31.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 12:37
· 5 commits to main since this release
v1.31.1
41860b8

v1.31.1

Changelog

Security: password_reset.token_field / token_expires_field must be property names (they are used in DQL). See UPGRADING.

Security

  • password_reset.token_field / token_expires_field must be property names. token_field is concatenated into
    the DQL that looks up a reset token (PasswordResetTokenManager::findUserByStoredToken()). The values come from
    application config (trusted), but nothing checked them: a value with spaces or operators changed the query. Both
    options now only accept property names or embeddable paths (resetToken, security.resetToken); anything else is
    a configuration error.

What's Changed

  • fix(security): reset token fields must be property names by @HecFranco in #19

Full Changelog: v1.31.0...v1.31.1

Contributors

HecFranco
Assets 2
Loading