Skip to content
/ security-http Public

v7.4.18

Choose a tag to compare

View all tags
@fabpot fabpot released this 30 Aug 21:39
· 239 commits to 8.2 since this release
Immutable release. Only release title and notes can be modified.
v7.4.18
This tag was signed with the committer’s verified signature.
fabpot Fabien Potencier
SSH Key Fingerprint: 2Epes5EqLalzBuDpYoQuproz9c57CsymvlzEGYtOXJw
Verified
Learn about vigilant mode.
ca575e2

Changelog (v7.4.17...v7.4.18)

  • bug #65735 Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
  • bug #65734 Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
  • bug #65677 Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
  • bug #65685 Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
  • bug #65655 Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)

Contributors

Seldaek, nicolas-grekas, and davidszkiba
Assets 3
Loading