Skip to content

Instantly share code, notes, and snippets.

@brendo
Created October 8, 2011 06:42
Show Gist options
  • Save brendo/1271955 to your computer and use it in GitHub Desktop.
Save brendo/1271955 to your computer and use it in GitHub Desktop.
Symphony 2.2.4 Release Notes

Symphony 2.2.4

This is a recommended update for all users, regardless of PHP environment, which aims to resolve Date related issues that have arise since Symphony 2.2.2. This release rolls back functionality for PHP5.2 users that was introduced in Symphony 2.2.2 that allowed Symphony to better support European date formats. PHP 5.3 is recommended for all European date formats. In addition, this release makes the first time unit tests have been used in a Symphony release, which were used to ensure that the core Date filtering returned the correct results for all supported filters.

Some low risk security vulnerabilities reported by Mavituna Security have also been resolved in this release.

Fixes

  • #838 - Fixed bug when grouping Checkboxes
  • #815 - Prevent possible MySQL error when creating a Page
  • #814 - Pages, Datasources and Events can now be created with numeric handles again, this fixes a regression since Symphony 2.2.2

Symphony 2.2.4 RC1

Fixes

  • #791 - Fixed bug in Upload field when the upload path contained a folder with only two characters.
  • #790 - Regexp for 'documents' now supports .docx
  • #781 - Ampersand in section name doesn't get converted to entity in datasource.
  • #751 - General::realiseDirectory now disables the umask so folders are created with passed permissions. Previously these permissions may have been altered by the umask.
  • #740 - Filtering with earlier than on the Date field fails in some environments. Now passes all 118 tests.
  • #736 - The Content-Length header is no longer set by Symphony. This resolves reported issues of a '5 second' delay before rendering a Frontend page.
@brendo
Copy link
Author

brendo commented Oct 8, 2011

Sure.

@kanduvisla
Copy link

Could you give us more insight on what the security vulnerabilities were, so we can possibly patch older installations where upgrading isn't possible?

@brendo
Copy link
Author

brendo commented Oct 10, 2011

The security vulnerabilities allowed XSS through the ?debug and SQL Injection via the ?prepopulate parameters. This commit contains the fixes. From memory some SQL Injection fixes were included in the SBL 1.20 release as well.

@kanduvisla
Copy link

@brendo: So if I understand correctly, these vulnerabilities could only be exposed if the author was logged in in the CMS?

@brendo
Copy link
Author

brendo commented Oct 10, 2011

Correct, hence low risk :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment