Zend Framework 2 changelog

Another framework comprised of individual components (ZF2).

All Versions

51

Latest Version

Avg Release Cycle

83 days

Latest Release

2851 days ago

Changelog History

Page 3

v2.3.4 Changes
January 14, 2015
⚡️ SECURITY UPDATES
- ZF2015-01: Session validators were not run if set before session start. Essentially, the validators were writing to the $_SESSION superglobal before session start, which meant the data was overwritten once the session began. This meant on subsequent calls, the validators had no data to compare against, making the sessions automatically valid. We have provided patches to ensure that validators are run only after the session has begun, which will ensure they validate sessions correctly going forward. If you use Zend\Session validators, we recommend upgrading immediately.
v2.3.3 Changes
September 17, 2014
- 6576: Custom barcode adapter wasn't being set in options
- 6664: Use is_file to check for an uploaded file
⚡️ SECURITY UPDATES
- ZF2014-05: Due to an issue that existed in PHP's LDAP extension, it is possible to perform an unauthenticated simple bind against a LDAP server by using a null byte for the password, regardless of whether or not the user normally requires a password. We have provided a patch in order to protect users of unpatched PHP versions (PHP 5.5 <= 5.5.11, PHP 5.4 <= 5.4.27, all versions of PHP 5.3 and below). If you use Zend\Ldap and are on an affected version of PHP, we recommend upgrading immediately.
- ZF2014-06: A potential SQL injection vector existed when using a SQL Server adapter to manually quote values due to the fact that it was not escaping null bytes. Code was added to ensure null bytes are escaped, and thus mitigate the SQLi vector. We do not recommend manually quoting values, but if you do, and use the SQL Server adapter without PDO, we recommend upgrading immediately.
v2.3.2 Changes
August 11, 2014
v2.3.1 Changes
April 15, 2014
⚡️ SECURITY UPDATES
- ZF2014-03: Potential XSS vector in multiple view helpers due to inappropriate HTML attribute escaping. Many view helpers were using the escapeHtml() view helper in order to escape HTML attributes. This release patches them to use the escapeHtmlAttr() view helper in these situations. If you use form or navigation view helpers, or "HTML element" view helpers (such as gravatar(), htmlFlash(), htmlPage(), or htmlQuicktime()), we recommend upgrading immediately.
v2.3.0 Changes
March 12, 2014
v2.2.10 Changes
February 18, 2015
⚡️ SECURITY UPDATES
- ZF2015-02: Zend\Db\Adapter\Platform\Postgresql was incorrectly using \\ to escape double quotes in identifiers and values, which could lead to SQL injection vectors. We have provided patches that use proper escaping. If you use Postgresql with Zend Framework 2, we recommend upgrading immediately.
v2.2.9 Changes
January 14, 2015
⚡️ SECURITY UPDATES
- ZF2015-01: Session validators were not run if set before session start. Essentially, the validators were writing to the $_SESSION superglobal before session start, which meant the data was overwritten once the session began. This meant on subsequent calls, the validators had no data to compare against, making the sessions automatically valid. We have provided patches to ensure that validators are run only after the session has begun, which will ensure they validate sessions correctly going forward. If you use Zend\Session validators, we recommend upgrading immediately.
v2.2.8 Changes
September 17, 2014
⚡️ SECURITY UPDATES
- ZF2014-05: Due to an issue that existed in PHP's LDAP extension, it is possible to perform an unauthenticated simple bind against a LDAP server by using a null byte for the password, regardless of whether or not the user normally requires a password. We have provided a patch in order to protect users of unpatched PHP versions (PHP 5.5 <= 5.5.11, PHP 5.4 <= 5.4.27, all versions of PHP 5.3 and below). If you use Zend\Ldap and are on an affected version of PHP, we recommend upgrading immediately.
- ZF2014-06: A potential SQL injection vector existed when using a SQL Server adapter to manually quote values due to the fact that it was not escaping null bytes. Code was added to ensure null bytes are escaped, and thus mitigate the SQLi vector. We do not recommend manually quoting values, but if you do, and use the SQL Server adapter without PDO, we recommend upgrading immediately.
v2.2.7 Changes
April 15, 2014
⚡️ SECURITY UPDATES
- ZF2014-03: Potential XSS vector in multiple view helpers due to inappropriate HTML attribute escaping. Many view helpers were using the escapeHtml() view helper in order to escape HTML attributes. This release patches them to use the escapeHtmlAttr() view helper in these situations. If you use form or navigation view helpers, or "HTML element" view helpers (such as gravatar(), htmlFlash(), htmlPage(), or htmlQuicktime()), we recommend upgrading immediately.
v2.2.6 Changes
March 06, 2014
⚡️ SECURITY UPDATES
- ZF2014-01: Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse. A new component, ZendXml, was introduced to mitigate XML eXternal Entity and XML Entity Expansion vectors that are present in older versions of libxml2 and/or PHP. Zend\Json\Json::fromXml() and Zend\XmlRpc's Response and Fault classes were potentially vulnerable to these attacks. If you use either of these components, we recommend upgrading immediately.

Awesome PHP is part of the LibHunt network. Terms. Privacy Policy.