Skip to content

v2.12.5

Choose a tag to compare

View all tags
@ttsuru ttsuru released this 15 Oct 02:11
· 549 commits to 2.x since this release
v2.12.5
This tag was signed with the committer’s verified signature.
ttsuru TSURU
GPG key ID: F6AADC7CF63D8DC0
Verified
Learn about vigilant mode.
11135b1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Important

This release fixes three security vulnerabilities. Upgrade as soon as possible. See UPGRADE.md:

Invalid ORDER BY directions now trigger an E_USER_DEPRECATED error; the generated SQL is unchanged.

Security Fixes

  • SmtpTransport / MailTransport: Strip CR and LF from email header names and values (folded header lines are kept), so header values built from user input can no longer inject headers or start the body (GHSA-4f9q-3c4x-52cv, the CakePHP 2 equivalent of CVE-2026-77634)
  • View: View, layout and element file names containing .. must resolve inside the view paths; files outside them are treated as missing (GHSA-w2mh-x92p-5p95, the CakePHP 2 equivalent of CVE-2026-48820)
  • AuthComponent: redirectUrl() collapses protocol-relative URLs (//host, /\host, \\host) stored in Auth.redirect to a local path, so a crafted request URL can no longer redirect to another site after login (GHSA-x4p9-p4cx-gxwx)

Deprecation: invalid ORDER BY directions (PR #54)

  • DboSource::order(): The sort direction is now checked. Valid directions are ASC or DESC, optionally followed by NULLS FIRST / NULLS LAST, matched case-insensitively and with any surrounding whitespace ('asc', ' Desc ', 'desc nulls last'). This applies to array values (['Post.title' => 'desc']), the $direction argument and a direction written after the field in a string key ('Post.title DESC')
  • Any other direction (for example "='test' DESC", 'ASC; ...', 'DESC LIMIT 1', 'NULLS FIRST', or a non-string value) triggers an E_USER_DEPRECATED error. The generated SQL is exactly the same as before; invalid directions will throw an InvalidArgumentException in a future version (see UPGRADE.md)
  • Field / expression handling is unchanged, and DboSource::expression() objects are used verbatim without the check
Assets 2
Loading