Skip to content

XMF 1.2.33

Latest
Latest

Choose a tag to compare

View all tags
@mambax7 mambax7 released this 14 Oct 05:24
v1.2.33
822fda0

XMF 1.2.33 is a security update for the PHP 7.4 line (XOOPS 2.5.x). It backports the fixes released in XMF 1.3.3 (#197) via #198.

Security

  • ProxyCheck / IPAddress::fromRequest(): the proxy_env header is only used when REMOTE_ADDR is listed in the new $xoopsConfig['proxy_trusted'] (addresses or CIDR ranges, array or comma separated; IPv4-mapped IPv6 peers match IPv4 entries). Entries are read from right to left, skipping trusted proxies, and any entry that is not an IP address stops the search. Sites that set proxy_env must add proxy_trusted; until then the peer address is used.
  • ProxyCheck: RFC 7239 Forwarded values are parsed case-insensitively, with quoted delimiters respected, node ports stripped, and elements with zero or several for parameters rejected.

Bug fixes

  • Database\Tables: CURRENT_TIMESTAMP defaults reported as current_timestamp() or with a precision are no longer quoted and render in the canonical form; the same text in a string column stays a quoted literal. Tables with functional index key parts are refused with an error instead of loading a wrong index definition.
  • Database\Migrate: getCurrentSchema() leaves out missing tables; getCurrentSchema(), saveCurrentSchema(), getSynchronizeDDL() and synchronizeSchema() throw RuntimeException when a table cannot be read.
  • FilterInput::cleanVar() accepts a null type without a PHP 8.1+ deprecation.

Development

  • PHPUnit 9 fixture signatures; roave/security-advisories dropped from require-dev and the low-severity php-jwt 6.x advisory (PKSA-y2cr-5h3j-g3ys, fixed only in php-jwt 7, which needs PHP 8) ignored so the dev install resolves on PHP 7.4.

PHP 7.4 or later.

Assets 2
Loading