==================== 1.0.4 ==================== ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Base Distribution ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [BUGFIX] Fixes wrong URL to tutorials page in Readme.txt ----------------------------------------------------------------------------------------- * Fixes: `#33031 `_ * Commit: `0c887eb `_ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ TYPO3.Flow ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [SECURITY] Protect arguments of form __referrer with HMAC ----------------------------------------------------------------------------------------- The request arguments of the referring request are a serialized string written to one of the hidden fields in a Fluid form. This string has to be protected by a HMAC to protect FLOW3 from possible unserialize attacks. Note: For now there is no object known within the FLOW3 Distribution, that could be used for an unserialize exploit! This change also backports some convenience hmac methods to the hash service from the current master, to have the bugfix in sync. * Security-Bulletin: `FLOW3-SA-2012-001 `_ * Fixes: `#35300 `_ * Commit: `cd39af5 `_ [BUGFIX] typo in return statement for getAccessDecisionVoters() ----------------------------------------------------------------------------------------- Fix return value to array. Fix type hinting for var $securityContext and $authenticationManager * Fixes: `#34620 `_ * Commit: `7e055f0 `_ [BUGFIX] ResourceStreamWrapper returns wrong value for fseek ----------------------------------------------------------------------------------------- Calling fseek will always return the wrong value, as fseek return 0 on success otherwise -1. The stream_wrapper expects a boolean value. So 0 will be evaluated to false and -1 will be evaluated to true * Fixes: `#34608 `_ * Commit: `461bb05 `_ [BUGFIX] Wrong variable name inside rename function ----------------------------------------------------------------------------------------- Use the proper variable name to create the stream wrapper. * Fixes: `#34547 `_ * Commit: `93c28d81 `_ [BUGFIX] Fixes duplicate error id in StringValidator ----------------------------------------------------------------------------------------- StringValidator uses the error id 1238108068, but that is used in StringLengthValidator. This change makes the former use 1238108070 instead. * Fixes: `#33973 `_ * Commit: `e1f1478 `_ [BUGFIX] isAuthenticated should work in authentication request ----------------------------------------------------------------------------------------- AuthenticationManager::isAuthenticated now checks for resumable and new sessions before returning FALSE, so it works also in the request that triggers the authentication. * Fixes: `#33311 `_ * Commit: `27f00f6 `_ [BUGFIX] Now filters correctly for '__destruct' in pointcut filter ----------------------------------------------------------------------------------------- The filter for proxyable methods in SessionObjectMethodsPointcutFilter skips the method '__desctruct' instead of '__destruct' * Fixes: `#34293 `_ * Commit: `55150fe `_ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ TYPO3.Fluid ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [SECURITY] Protect arguments of form __referrer with HMAC ----------------------------------------------------------------------------------------- The request arguments of the referring request are a serialized string written to one of the hidden fields in a Fluid form. This string has to be protected by a HMAC to protect FLOW3 from possible unserialize attacks. Note: For now there is no object known within the FLOW3 Distribution, that could be used for an unserialize exploit! * Security-Bulletin: `FLOW3-SA-2012-001 `_ * Related: `#35300 `_ * Commit: `7bc4e35 `_