symphonycms

Symphony 2.7.10 is a LTS release with hot fixes for 2.7.9.

Associated bundle

git: 2.7.10-bundle
zip: symphony-2-2.7.10.zip

Bug Fixes

• f1b4b5e0a4 Disable auto-loader when checking for class exist
• 06ee00e712 Revert to old style arrays

Symphony 2.7.9 is a LTS release with a single hot fix for 2.7.8.

Associated bundle

git: 2.7.9-bundle
zip: symphony-2-2.7.9.zip

Bug Fixes

• 1bf7f0df09 Fix missing 2.7.8 edit in the installer

Symphony 2.7.8 is a LTS release with bugfixes for PHP7 and security.

Associated bundle

git: 2.7.7-bundle
zip: symphony-2-2.7.8.zip

Bug Fixes

• b7996563bd Remove unset $id (introduced by copy/paste) #2839
• 67ad067ce0 Fix broken sessions with PHP 7.0.* #2840
• 1ace6b3186 Fix possible self-XSS in the pages content page
• b390ade210 Make sure array_map does not create warnings
• f04054aea0 Fix possible self-XSS in the events/DS pages

Symphony 2.7.8 is a LTS release with bugfixes for PHP7.3 and security.

Associated bundle

git: 2.7.8-bundle
zip: symphony-2-2.7.8.zip

Bug Fixes

• 936c8d1b98 Fix PHP5.3: Make sure session_status exists
• 514f2569fd Do not add the empty item if value is required
• cc375c5554 Fix crash when creating a data source with a dash
• 1148c441cc Don't encode email headers if in ASCII range 0-127
• 5ed669f25a Remove X-Mailer email header
• fabc3b21af Fix missing calendar suggestion with field errors
• 991a78753a Update last_seen default value properly #2863
• ad43faf7c9 idn_to_utf8: Remove warning if PHP's error reporting is E_ALL #2868
• 183e8a3408 Make sorting entries deterministic #2872
• 93149b69cb Set a default log filter value when updating #2867
• f29382d4e2 Remove forward slashes (/) and unicode escapes in env json #2866
• 69ddd48269 Validate section id upon entry edit #2875
• 5e66eaa403 Force sorting on a date columns we select #2879
• 4a53ee7c2e Suppress opcache warnings when opcache_invalidate does not work #2876
• 2bedc142d0 Fix PHP 7 warnings #2871
• 2ec6ffb005 Make $provides property protected #2874
• 64eb43fb76 Revert to isset
• bbff66cc63 Fix the missing sort parameter for nav DS
• 179a2b4abd Fix broken indentation in generated data sources
• 6c7aaacc21 Force event name to start with a letter
• 2449fe9523 Apply Lang::createHandle to params' field handle #2894
• 1b3b173d1b Fix transliterations for parentheses #2891
• 053cdac537 Remove null bytes from XML to prevent DOM errors #2893
• 2eee808da3 Fixes for PHP 7.3 #2887
• 63ea09bb9c Force entry IDs to be integers in SQL query

Minor Updates

• 987e0ca0ae Add hash (#), curly ({}), star (*) to transliteration #2888

Symphony 2.7.6 is a LTS release with a single regression fix.

Associated bundle

git: 2.7.6-bundle
zip: symphony-2-2.7.6.zip

Bug Fixes

• 8d218d7f0a Rename the undefined var #2823

Symphony 2.7.5 is a LTS release with bug fixes. It also fixes a privilege escalation.

Associated bundle

git: 2.7.5-bundle
zip: symphony-2-2.7.5.zip

Bug Fixes

• 52a3ab8141 Add non-breaking hyphen to transliterations #2818
• fd8c0bf9df Make limitWords work with word boundaries #2816
• 285f9fc23f Fix the privilege escalation bug #2815
• 6040574e25 Prevent empty session creation #2821
• b7e0b7415f Double encode value in displayPublishPanel() #2822

Symphony 2.7.4 is a LTS release with simple bug fixes.

Associated bundle

git: 2.7.4-bundle
zip: symphony-2-2.7.4.zip

Bug Fixes

• 0f4eb72a63 Properly set and pass the new author's id #2802
• e17e7a44e7 Silence errors generated by unlink for delete methods #2810
• 829b329a00 Replace is_int with General::intval() #2811

Symphony 2.7.3 is a LTS release with simple bug fixes.

Associated bundle

git: 2.7.3-bundle
zip: symphony-2-2.7.3.zip

Bug Fixes

• b49cf5391d Make SMTP class reset on unexpected responses #2796
• e80ac53a8c Fix profiler samples #2793
• 6c7ee371bf Add ― to transliterations #2799

Misc

• 755ecc4506 Change to Fixes to make github close the issue

Symphony 2.7.2 is a LTS release with a single bug fix for the missing migration class in 2.7.1

Associated bundle

git: 2.7.2-bundle
zip: symphony-2-2.7.2.zip

Bug Fixes

• 0218e92428 Add missing migration class

Symphony 2.7.1 is a LTS release, with bug fixes, performance and security improvements.

Associated bundle

git: 2.7.1-bundle
zip: symphony-2-2.7.1.zip

Bug Fixes

• 4994503591 Fix broken delete in the section's edit page
• 184dc9798a Fix the suggestion list with no help node
• 1050ac1137 Add missing source delegate parameter
• de98edd74e Prevent blind SQL injection
• 835edae24c Fix css class .empty state clash
• ce211149a9 Fix incorrect comment
• 1e63afbf62 Various fixes for PHP 5.3 and 5.4
• ac89cfe7f4 Add modification_author_id in findDefaultData()
• d2cb806199 Add a css qualifier for blueprints rules
• fef8e7c121 Fix child associations not pre-populated #2740
• 80e00a591f Fix broken pass by ref in SectionPreDelete #2743
• d5123374cb Restore the 2.6.x field behavior for empty arrays #2744
• f93ea3b5d2 Remove empty parent associations #2741
• f2db7d6f63 Fix optional values for upload field #2746
• d37967bdca Fix creating a new entry using prepopulate #2738
• d2c9b62789 Fix escaping of invalid XML #2750
• 54b8622d3d Prepopulate fields that supports it #2751
• 2aba3d5a13 Fix typo #2754
• 2344d00b00 Do not hide exceptions thrown by the database #2756
• f0ac961228 Remove duplicated file_exists checks #2761
• 47d34af8c7 Use the full width when the primary col is empty #2760
• 52c7feca69 Fix Mutex release() not deleting lock file #2766
• c11a1fd209 Remove author name in comment
• f960008305 Prevent robots from indexing login and install #2772
• cf60c4b99d Add configurable log filtering #2762
• 0066fb6d4b Restrict CSS resize to vertical on #2778
• 9030da0878 Add canPrePopulate() to textarea fields #2780
• 271fbe566f Force datasource name to begin with a letter #2774
• 92eb8bc6c8 Fix error if extension not found on boot #2782
• 922abe285b Remove automatic escaping of preferences values #2781
• 3c6fa85282 Docs: Remove wrong @throws directive #2788
• 05b9e83562 Fix some typos #2789
• 22d20e1730 Remove click listener for actions select #2790
• e710b0214b Fix field duplication without field settings #2787

Minor Updates

• 81508c0631 Add id as title attribute
• 58b64c154d Make __reduceType static #2767
• 6af1fda877 Call addslashes on configuration group name #2775
• e0d058c148 Remove session.save_handler from php settings #2784

Associated bundle

git: 2.7.0-bundle
zip: symphony-2-2.7.0.zip

New Features

• 75a5056532 Added a grunt task to run phpcs
• aa22f69283 Added Default Value jQuery plugin
• fd4c0d3d96 Update Session class to PHP 7 specification
• 0ff9ffd55c splitted the DOMAIN constant to create the DIRROOT constant
• d79647d686 added DIRROOT as root-dir parameter
• 0b2fdded4e Add more random sources
• 525d302ec7 Add support for tag negation and filterable ops
• 01bc9dcbd8 Add delegate prior to checking a field's post data #2549
• 506aa7648d Lock/unlock tables when editing entries #2585
• 3e3c2809e0 Provide an extension point to $_SERVER reads
• 419fe79cc3 Tag list field: accept an array of tags #2602
• 0b6d1658a0 Make Configuration::__toString() support nested arrays #2609
• 28a8431c52 Added link to security bug disclosure procedure
• 28393e8803 Add the mb string strpos function call
• 54d6ead613 Enable the email core to ignore attachment errors #2662
• b4cd97ca98 Add sql: null and sql: not null filters #2666
• a6ed8a0e24 Replace url state with canonical url #2665
• 6cb0c94866 Add requiresTable perf optimization #2678
• 27d3351546 Perf: optimise loading of additional language files
• 198390ee46 Perf: further tweaks to language loading, allow for language dialects (eg. pt-br)
• c454a13d2f Add unattended installation process #2654
• 05ac9293db Add General::checkFile*able() API #2683
• 459c9ce8fa Add Custom Author Column delegates
• 31f5eb3694 Add AuthorPreCreate delegate
• c3d6a59b54 Unified the AuthorPreDelete parameters
• 951fb7a42d Add AuthorPostDelete delegate
• 5382e9284f Add NavigationPostBuild delegate
• 4f5543811a Add CanAccessPage delegate
• 6d456f81f3 Add missing 'author' paramter
• 85f30f3e4c Apply 'CanAccessPage' on navigation
• 69bee5fdd6 Add the possibility to run with E_ALL #2687
• 6e68409538 Push deprecated warnings to log #2701
• 00b3f9abc3 Add PreRenderHeaders delegate
• e5ecf3cbd3 Prevents data loss on save #2659

Bug Fixes

• fd4c0d3d96 Update Session class to PHP 7 specification
• b0f9adfc0b Made generateNonce() return value url safe
• 057526a49d Prevent errors if EXTENSIONS is un readable
• 7ea69d0e1a mt_srand function argument must be an integer
• ccbe6936c5 Prevent cookie issues when running behind a proxy #2590
• e7b4b56ad7 Allow install in folders with special chars
• 5f2ecade0e Make sure user can delete the author #2572
• 27ea8968d0 Fix cookie safe url creation
• 09b4c04e8b Remove trailing slash from safe cookie path
• 3d1748d1b5 Fixing potential XSS
• f1d7b05a95 Sanitize error message
• 53f3ebfadd Output password and email even when auth == 0
• 02687ee307 Fix SQL problem with AND (+) operation
• 26067868ea Supress warning when chmod does not work
• ee5a4aef98 Return true in the error handler
• 6809b28cbd Make sure configuration is traversable
• 9bcb03048d Constructor with 1 parameter always = 'No error'
• a7a05368b7 Fix Association Drawer: problem when parent_section_field_id is null #2620
• b8c5014783 Refactor on DataSource::determineFilterType()'s
• e4b8e5aca4 Correct check for undefined variable #2623
• 5bde94fcd6 Fix for MySQL ANSI compliance issue with order by
• 4f8332b9be Fix for MySQL 5.7 Strict mode
• b5ce52e578 Prevent script and link injection on login page
• 2e31e6437c Fix $_fetchSortFieldidocumentation
• f742a3b171 Fix remote code execution by auth'd users
• b3a82da48b Make sure we call stripslashes on read
• 9f26a2e7dc Call stripslashes on index pages as well
• 2b774b4574 Fix unselectable element after a reorder
• 6201a2dd85 Fix broken filter suggestions in DS Editor
• 0a78172b98 Make sure Authors emails are always validated
• 2451c24112 Fix wrong entries-per-page when result is empty
• 0ddd49d402 Prevent XSS with section's name and nav group
• 257aab2deb Prevent acting on non existing tables #2664
• 0d86029304 Remove the attempt at fixing duplication of data
• b43397b41d Better fix for MySQL 5.7 Strict mode
• a5074dc2c5 EntryManager hotfix, field is not an instance of Field, it's an array of field data. RE: #2678
• 86240d361e Refactor General::limitWords so it actually makes sense...
• 31a4bf37c1 Sanitize section's name and nav group
• 5d6cc03ffc Fix not-regexp which leads to wrong results #2695
• dd5ae51b07 Properly sanitize the section`s name
• 64d1dd614d Fix the wrong count of associated entries #2697
• fe762bd15a Make sure we always have a date and time format #2705
• 8bce5797f0 Fix broken AND ( + ) filtering #2694
• 70f2a21988 Fix js error when no visible items exist
• a86bef00c9 Add default values for date columns
• d6c7303af3 Sanitize events and datasources' sources

Minor Updates

• 41018b6769 Set "Sections Index" as default area of default (first) author #2530
• 6f99eb49e6 Better php.ini overrides for insecure setups
• 0f525fe63d Use HTTP_HOST constant instead of reading $_SERVER
• 91e318bd97 Only request the needed schema in table view #2568
• 9ada23cac9 Add data-attributes to publish filtering interface #2577
• ebd698518d Use $_SERVER[] instead of getenv()
• d31ce5ebf7 Split out the http protocol logic into a constant
• 4a2701c4c3 Remove mcrypt as it is not maintained
• f9057b1569 Wrap exceptions xml message in CDATA
• c5c9eb3950 Delete __actionIndex from authors content page
• 64e3774268 Make pickable hidden forms elements readonly
• e2ca2335bc Make email prefs pane inputs readonly by default
• 1b19e689df Change default permission in uploadFile to 0644
• e1f61a3162 PHP 7: Refactor around Exception handlers
• 7084906dbf Remove gray border when row is selected
• 475c198acd Add non breaking space in transliteration.php #2631
• a850313d39 Update pre_populate when updating to 2.7.x
• ff956d71ae Add link to installerpage to delete install folder
• 8b6ca80b02 Add link to delete install folder after update
• d21f3a6da0 Sort settings of associated sections in drawer #2608
• 979a8be3b5 Removed unused code #2613
• 83466e0394 Updated jQuery to 2.2.4
• 59484de609 Use HTML5 lang attribute instead of xml:lang
• e99618b4a8 Refactor edit() and add() to make them identical #2680
• c4d9ba3669 Add X-Content-Type-Options and X-XSS-Protection
• 2b60a28627 Remove unecessary call to clearstatcache() #2684
• 73a579900a Make Email::create() static #2691
• 3c1a65ab76 Eliminate code duplication in random order check #2689
• cb063cf192 Add Referrer-Policy: same-origin for backend pages #2700
• d00a06de27 Remove Access-Control-Allow-Origin header #2706
• 01b5e6114a Group 404 checkboxes and shorten their labels #2702
• c3ad3809e9 Improvements on Associations Drawer
• 5763872ba7 Better wording for the Error Conditions #2723
• a9c3d9b268 Do not show the count if it is zero
• 205a79fdd8 Add composer.lock to the repository
• b5da71861e Add package-lock.json
• a45a9c3ca4 Add the timestamp as the checkbox value
• 798eb8eb43 Replace on with timestamp as the checkbox value

Notes

Closed CVE with this release (or earlier 2.6.x releases):

• CVE-2017-8876
• CVE-2017-7694
• CVE-2017-6067
• CVE-2017-5542
• CVE-2017-5541
• CVE-2016-4309

• Release candidate for 2.7.0
• (MAKE SURE to build the assets before testing!)

• Fix extension requirements check that was not able to accommodate 2 digits patch version number (#2641)

• Fix path traversal and XSS vulnerabilities in the missing_extension exception template #2639

• Added extra validation for sender email address #2636, #2637

• Backports #2627 to 2.6.x, which ensures that the secure flag is correctly set on cookies when running HTTPS

• Fixed Regression:Publish Filtering was broken #2557

The Symphony licence now specifies that the copyrights, starting in 2016, now belongs to the community.

Symphony 2.6.6 is a maintenance release, dedicated to bug fixes and security improvements.

• Properly mark DynamicXMLDatasource as deprecated [#2543]
• Publish Filtering: Prevent duplicate help texts for default comparison mode "is" [#2546]
• Prevent PHP warnings in the error log [#2554]
• Added an upload blacklist: Used in case the user did not specified a validator on the upload field. The blacklist is configurable via a new config value upload_blacklist in the admin section.
• Added more sanitizing of user values

Symphony 2.6.5 is a maintenance release, mostly dedicated to bug fixes and security improvements.

• Fixed installer that was not redirecting to login after is complete with custom admin path
• SMTP HELO Hostname (helo_hostname) setting for SMTP email gateway in order to improve compatibility with modern SMTP servers
• Fix SMTP gateway issues with comma-separated recipients
• Improve read only fields UI (new class field-value-readonly)
• Fixes in the boot sequence
• jQuery plugin symphony.timeago: added a max setting option which disables the plugin on older dates
• Move date conversion to the PHP level (which fixes DST problems)

Symphony 2.6.4 is a maintenance release, mostly dedicated to bug fixes.

• #2489 Fixed issue where dates were not formatted correctly
• #2494 Cleanup session cookies when redirecting
• #2504 More url input sanitizing
• #2514 Consistently use entry status constants
• Enforce PSR-2 code style using PHP CS Fixer
• More url input sanitizing
• Fixed some issue with the package.json file
• Removed dead SYM_DB_INSERT_FAILED const
• Replace create_function with closures
• Remove outdated items from navigation.xml
• Improvements to use strict comparisons
• Sanitize the POST for the system/preferences/
• Updated grunt deps

Thanks again @brendo for your great work leading the Symphony team. I hope to do as good as you!