AddToAny

Share this

 

Feed items

  • warning: Declaration of views_handler_argument::init(&$view, &$options) should be compatible with views_handler::init(&$view, $options) in /home/clients/ru/domains/development4web.com/html/sites/all/modules/views/handlers/views_handler_argument.inc on line 48.
  • warning: Declaration of views_handler_filter_boolean_operator::value_validate(&$form, &$form_state) should be compatible with views_handler_filter::value_validate($form, &$form_state) in /home/clients/ru/domains/development4web.com/html/sites/all/modules/views/handlers/views_handler_filter_boolean_operator.inc on line 111.
  • warning: Declaration of views_plugin_row_node_view::options_form(&$form, &$form_state) should be compatible with views_plugin_row::options_form($form, &$form_state) in /home/clients/ru/domains/development4web.com/html/sites/all/modules/views/modules/node/views_plugin_row_node_view.inc on line 35.

Two weeks left before SymfonyWorld Online 2021 Winter Edition, book your ticket now!

The SymfonyWorld Online 2021 Winter Edition conference will take place in just
two weeks, on December 9-10, 2021. The event includes 25 talks covering a
wide range of topics related to Symfony and its ecosystem:




CVE-2021-41268: Remember me cookie persistance after password changes

Description

Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password.

Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.

Resolution

Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.




CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request

Description

When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded-* HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks.




CVE-2021-41270: Prevent CSV Injection via formulas

Description

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with = is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in csv_escape_formulas option in CsvEncoder, to prefix all cells starting by =, +, - or @ by a tab \t.




Symfony 6.0.0-RC1 released

Symfony 6.0.0-RC1 has just been released. Here is a list of the most
important changes:




Symfony 5.4.0-RC1 released

Symfony 5.4.0-RC1 has just been released. Here is a list of the most
important changes:




Symfony 5.3.12 released

Symfony 5.3.12 has just been released. Here is a list of the most
important changes:




Symfony 4.4.35 released

Symfony 4.4.35 has just been released. Here is a list of the most
important changes: