SilverStripe 3.1.9
15 January 2015
SilverStripe version 3.1.9 is now available (security release).
Upgrading to SilverStripe 3.1.9
SilverStripe 3.1.9 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply SilverStripe updates as new versions are released, or use Installatron's Clone feature to duplicate an existing SilverStripe install to test the 3.1.9 upgrade prior to applying it live. Get started managing your SilverStripe installations with Installatron
What's New in SilverStripe 3.1.9
This release includes an important security fix.
File permissions
- This release makes an important change to File DataObject permissions in order to close a vulnerability in file modification privileges. By default the minimum necessary permission required by any user to modify files has been changed to CMS_ACCESS_AssetAdmin. If you need unauthenticated users, or users with other rights, to edit certain files, then you will need to customise this. An example use case is when you want to use UploadField on the frontend, where files could be uploaded by non-admin users, and your above logic will need to ensure that those users can edit their own files after they have uploaded it.
Security
- 2015-01-12 c49f164 Fix file and uploadfield permissions SS-2014-018.
Features and Enhancements
- 2014-11-21 31b5a9d Allow CMS re-authentication to be completely disabled if necessary (Damian Mooyman)
- 2014-12-10 fba6880 Additional extension points for Tiny MCE editing, for when images are regenerated and manipulating the HTML prior to a save (Gordon Anderson)
- 2014-11-13 d7eb275 Make the record count in GridFieldFooter optional (Jeremy Shipman)
Bugfixes
- 2015-01-08 a02adf6 Uneccessary class replacement (Michael Strong)
- 2014-12-18 5637431 The method 'name' does not exist on 'Form' (Elvinas L)
- 2014-12-15 6582162 How to folder on forms (Cam Findlay)
- 2014-12-11 b5c361a GD - check file exists before getimagesize (Will Morgan)
- 2014-12-09 6bdd30c Fix gridfield storing duplicate data in session (Damian Mooyman)
- 2014-12-09 3ac705f Feedback to name the fields section to "field types" to make it clearer what the section is about. (Cam Findlay)
- 2014-12-09 e9fd03b use GFMD code blocks to fix code formatting consistency. (Cam Findlay)
- 2014-11-25 01989aa Manifest flushing (Jonathon Menz)
- 2014-11-24 7384d01 DataDifferencer was trying to compare fields, even if the fields didn't exist causing an error. (micmania1)
- 2014-11-18 2bdfd65 Security::findAnAdministrator doesn't always find an admin (Damian Mooyman)
- 2014-11-10 85b4ba1 DataObject::db() doesn't respect overloaded db types (fixes #3620) (Loz Calver)
- 2014-10-03 9d888d5 Fixed SearchForm not calling getTemplate() in forTemplate() (Stephen McMahon)
- 2014-09-02 1f4f5e6 Fix versioned Versioned is not writing Version to _version tables for subclasses of Version dataobjects which have their own DB fields - Fix disjoint of ID / RecordID (which should be the same) - Fix calculation of new record version - Fix use of empty vs !isset to check for existing version (Damian Mooyman)