v2.12.3

Important

This release contains a security fix and two fixes that change behavior. See UPGRADE.md before upgrading:

• CookieComponent now honors the 'type' setting in $components. Applications that already set it will write cookies with that type, and cookies written before the upgrade can no longer be read.
• cake server now listens on port 8765 by default instead of 80.

Xml::build() SSRF Fix (PR #33)

• Xml: Xml::build() no longer fetches https:// URLs when 'readFile' => false (operator precedence bug that allowed SSRF)

CookieComponent 'type' Setting (PR #34)

• CookieComponent: Honor the 'type' setting (e.g. 'Cookie' => ['type' => 'aes']), which was previously ignored so cookies were always encrypted with the default 'cipher' type
• Behavior change: Applications that already set 'type' in $components now write cookies with that type, so cookies written before the upgrade (with 'cipher') can no longer be read. See UPGRADE.md

CakeTestLoader Modern Layout (PR #35)

• CakeTestLoader: List test cases from tests/TestCase (app and plugins), falling back to Test/Case, so cake test app without a test case and the web test runner no longer show an empty list for the modern layout

Sqlserver Default PDO Flags (PR #36)

• Sqlserver: Fix operator precedence in connect() so PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION is merged into the 'flags' setting

ServerShell Default Port (PR #37)

• ServerShell: Change the default port of cake server from 80 (requires root) to 8765, and show the default host and port in the help

TestShell PHPUnit Version Message (PR #38)

• TestShell: Ask for PHPUnit 9.6 (instead of v3.7) when PHPUnit cannot be loaded

Documentation Fixes (PR #39)

• README.md: Use ^2.12 in the Composer install example, and link to the Piece of Cake 2 book (https://pieceofcake2.github.io/docs/)
• UPGRADE.md: Show the SQL Server schema setting as a string per connection (the driver does not accept an array mapping)