Skip to content

v2.12.11

Choose a tag to compare

View all tags
@ttsuru ttsuru released this 19 Oct 09:41
v2.12.11
da4f36e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Important

This release fixes a security vulnerability. Upgrade as soon as possible. See UPGRADE.md:

  • Form action and redirects to another host via a request URL that starts with // (CakeRequest::here() is protocol-relative) (GHSA-wh43-gc93-wh4c)

HtmlHelper now outputs the script, link and style tags of HTML5; set html5 to false in its settings to keep the former output.

Security Fixes

  • CakeRequest: The request URL loses all its leading slashes and backslashes, not only the first slash, so CakeRequest::$url never starts with / or \ and CakeRequest::$here / here() never start with // or /\. A request to //example.com/posts was routed as /example.com/posts, but here was the protocol-relative URL //example.com/posts: FormHelper::create() without a url printed <form action="//example.com/posts">, so the form was submitted to another host, and $this->redirect($this->request->here(false)) redirected there. With a base path, here(false) of /base//example.com/posts had the same problem. here() also collapses the leading slashes of a $here changed by the application. Routing is unchanged (GHSA-wh43-gc93-wh4c, PR #90)

Enhancements: HTML5 Script, Link and Style Tags (PR #86)

  • HtmlHelper html5 setting: HtmlHelper outputs the tags of HTML5 by default: script(), css() and the <style> of css() with rel import have no type attribute, and scriptBlock() and scriptStart() neither add type="text/javascript" nor wrap the script in CDATA. Set 'html5' => false in the settings of the helper for the former output: public $helpers = ['Html' => ['html5' => false]];. The safe option of scriptBlock(), scriptStart() and the methods of JsHelper still adds the CDATA when it is true; its default follows the setting
  • Test pages: The test runner and the code coverage report of the web test runner use the tags of HTML5

Tests (PR #87)

  • Independent of the skeleton defaults: ApplicationControllerTest::testRedirect() clears Session.cacheLimiter, so the 'nocache' default of pieceofcake2/app v2.5.3 no longer makes it fail

Upgrading

composer update pieceofcake2/cakephp

See UPGRADE.md, Security Fixes and HTML5 Tags.

Full Changelog: v2.12.10...v2.12.11

Assets 2
Loading