Account Options

  1. Sign in
The old Google Groups will be going away soon, but your browser is incompatible with the new version.
Google Groups Home
« Groups Home
CakePHP
Home
+ new post
About this group
Join this group
Security Release - CakePHP 2.1.5 & 2.2.1
Options
There are currently too many topics in this group that display first. To make this topic appear first, remove this option from another topic.
There was an error processing your request. Please try again.
flag
   3 messages - Collapse all  -  Translate all to Translated (View all originals)
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
mark_story  
View profile  
 More options Jul 14 2012, 5:37 pm
From: mark_story <mark.st...@gmail.com>
Date: Sat, 14 Jul 2012 14:37:33 -0700 (PDT)
Local: Sat, Jul 14 2012 5:37 pm
Subject: Security Release - CakePHP 2.1.5 & 2.2.1
Print | Individual message | Show original | Report this message | Find messages by this author

CakePHP 2.1.5 and 2.2.1 have just been released. If you are using CakePHP's
`Xml` class, you should upgrade as soon as possible.

The security issue was recently reported by Paweł Wyleciał. When accepting
user provided XML it is possible to read arbitrary files using external
entities.  This is particularily dangerous for applications accepting XML
data as part of a webservice.  A possible exploit example would be:

   curl -X POST -H 'Content-Type: application/xml' http://locahost/posts -d
'<!DOCTYPE cakephp [
   <!ENTITY payload SYSTEM "file:///etc/passwd" >]>
   <Post>
   <body>&payload;</body>
   </Post>]'

Once the XML has been processed `$this->request->data['Post']['body']` will
contain the contents of `/etc/passwd`. This issue was
[fixed](http://github.com/cakephp/cakephp/commit/6c905411bac66caad5e220a70e3d...)
and packaged releases for 2.1 and 2.2 have been created.  This issue does
not affect the 1.3 or 1.2 release series.  If you are unable to upgrade,
you should apply the
[patch](http://github.com/cakephp/cakephp/commit/6c905411bac66caad5e220a70e3d...)
as soon as possible.

### Other fixes in 2.2.1

In addition to the security fix 2.2.1 contains fixes for the following
issues:

* Fixed missing urlencode on nested named parameters.
* Fixed ANSI codes being output on windows terminals.
* Fixed HtmlHelper::image() including the base directory twice when the
fullBase option is used.
* Console logging now respects the quiet flag for shells.
* TranslateBehavior now saves records with only some translated fields
correctly.
* afterValidate() was made available on behaviors. This was an omission in
2.2.0.

View the complete changelog for 2.2.1 and 2.1.5. Download a packaged
release.

CakeFest 2012 is around the corner and we already expect awesome talks and
workshops during the best PHP conference out there. If you haven't booked
[your tickets](http://cakefest.org/ticket-info) yet, it's about time you do.

As always, thanks to the friendly CakePHP community for the patches,
documentation changes and new tickets. Without you there would be no
CakePHP!

**Links**

[1] http://cakephp.org/changelogs/2.2.1
[2] http://cakephp.org/changelogs/2.1.5
[3] http://github.com/cakephp/cakephp/tags
[4] http://cakefest.org


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Albert 'Tigr'  
View profile  
 More options Jul 15 2012, 2:09 am
From: Albert 'Tigr' <alb...@tigr.net>
Date: Sat, 14 Jul 2012 23:09:25 -0700 (PDT)
Local: Sun, Jul 15 2012 2:09 am
Subject: Re: Security Release - CakePHP 2.1.5 & 2.2.1
Print | Individual message | Show original | Report this message | Find messages by this author

Thank you. Could you update the links on the website? They all point to
2.2.0.


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
mark_story  
View profile  
 More options Jul 15 2012, 8:46 am
From: mark_story <mark.st...@gmail.com>
Date: Sun, 15 Jul 2012 05:46:36 -0700 (PDT)
Local: Sun, Jul 15 2012 8:46 am
Subject: Re: Security Release - CakePHP 2.1.5 & 2.2.1
Print | Individual message | Show original | Report this message | Find messages by this author

Its done now, sorry about that :)

-Mark


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
End of messages
« Back to Discussions « Newer topic     Older topic »

Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
©2013 Google