v2.10.24.3

This release brings significant security enhancements, improved database compatibility, and comprehensive test coverage improvements for the CakePHP 2.x community fork.

Security Fixes

CVE-2020-15400: CSRF Token Fixation Prevention

• Implemented HMAC-SHA1 signed tokens to prevent token fixation attacks
• Tokens are now cryptographically bound to the application's Security.salt
• Maintains full backward compatibility with existing legacy tokens
• Compatible with CakePHP 3.x/4.x token format

CVE-2015-8379: CSRF Bypass Prevention

• Added comprehensive test coverage for _method parameter handling
• Ensures POST requests cannot bypass CSRF by overriding to GET/HEAD/OPTIONS
• Validates that all unsafe HTTP methods require CSRF tokens
• Tests custom/invalid HTTP methods to prevent bypass attempts

New Features

Enhanced Database Support

• MySQL 8.0 Support: Full compatibility with MySQL 8.0, MariaDB, and Aurora MySQL
• New database driver methods:
  • getVersion(): Returns database version string
  • getServerType(): Identifies MySQL, MariaDB, or Aurora MySQL
  • utf8mb4Supported(): Checks utf8mb4 character set support
  • integerDisplayWidthDeprecated(): Detects MySQL 8.0.17+ deprecations

Breaking Changes

Removed Cache Engines

• Xcache: Removed (incompatible with PHP 7.0+)
• Wincache: Removed (not maintained for PHP 8.x)
• Please migrate to Redis, Memcached, or APCu

Test Suite Improvements

PHPUnit 9.6 Compatibility

• Fixed all deprecation warnings (at(), expectError(), etc.)
• Resolved data provider naming issues
• Fixed risky tests with missing assertions
• Improved test isolation and state management

PHP 8.x Compatibility Fixes

• Fixed null parameter handling across the framework
• Resolved array offset errors
• Fixed deprecation notices for PHP 8.0, 8.1, 8.2, 8.3, 8.4

CI/CD Improvements

• Added MySQL 8.0 to GitHub Actions workflow
• Docker Compose configuration for local testing
• Improved database service configuration

Installation

{
    "require": {
        "friendsofcake2/cakephp": "^2.10"
    }
}

Related Pull Requests

• #2: PHPUnit compatibility and test fixes
• #3: MySQL 8.0 support
• #4: Remove deprecated cache engines
• #5: CVE-2020-15400 fix
• #6: CVE-2015-8379 test coverage

Full Changelog: v2.10.24.2...v2.10.24.3