Removeduse_gzip option onHtmlEditorField which used to compress the rich text editor dependency.No longer required since compression is performed as part of the CMS build automatically.See#832
Starting with this release we do not support PHP 5.6 and 7.0 anymore.As such, 7.1 is the lowest supported version. The prior releases willkeep supporting older PHP versions for their lifetime.
The CMS recipes for new application installations and some of our asset migration scriptsare now generating ".htaccess" using the Apache 2.4 syntax. This does not affect any existing".htaccess" files, but only auto-generated ones.Apache 2.2 has reached its EOL in 2017, so we do not proactively support it anymore.You also may amend any auto-generated ".htaccess" files manually in case you want torun CMS on a different software.
Until now, core releases of Silverstripe CMS would put aninstall.php file in thepublic root that, when accessed with a browser, would offer an installationUI prompting the user for all the necessary configuration of your projectand environment, and validating it before performing the installation.
While this may be an important part of the onboarding experience for newcomersto Silverstripe, it is an unnecessary artefact and potential security riskfor the vast majority of developers who install Silverstripe with composerand their own environment files.
The installer UI will continue to live on under the name "installer-wizard" in aseparate package, whichcan be added incrementally to core recipe installation, usingcomposer require silverstripe/installer-wizard.It is no longer a commercially supported module.
Silverstripe CMS has gradually switched from using file archivesto installation viaComposer.This enabled a much more diverse module ecosystem,with clear dependency management and greater ability tocheck and enforce constraints and semantic versioning.
Starting with this release, we are no longer publishingsilverstripe/installeras a file archive download onsilverstripe.org.If your workflow relied on these downloads, please switch to using Composer.See#9232 for details.
Login forms in Silverstripe CMS are traditionally embedded in your page template.This often requires style adjustments in your website, for example, to cover variationssuch as error messages and validation feedback. It also complicatesmore advanced login flows such as multi-factor authentication.
Starting with this release, you could installsilverstripe/login-formsmodule. It provides generic styles which look great without any adjustments.You can choose to add your own logo or customise the templates.The URLs to login functionality have not changed (e.g.Security/login).
Existing Silverstripe CMS websites upgrading to this release can opt into usinglogin forms via composer:
composer require silverstripe/login-forms
Note that any customisations you might have inPage.ss orLayout/Security.ssno longer apply when this module is installed. If you have customised the login processby adding form fields, or through custom handlers such as SAML or LDAP,you'll need to review those before starting to use the module.
Starting withSilverstripe CMS 4.6 this module will be included in new installations by default.
NewPasswordExpirationMiddleware now proactively invalidates members with expired passwords#
A newPasswordExpirationMiddleware has been implemented.It checks passwords of authenticated users for expiration and either enforce a redirectionto a change password form, or resets the user for a request being processed (sets the current user to null).
This is considered to be a security enhancement, but potentially might interfere with some custom logicaround password expiration, if you have it implemented.
Ideally, you should test your setup when upgrading if you use the password expiration functionality.
If you'd like to deactivate the middleware, you can unregister it in your application config like this:
2019-06-1883661c7 Add deprecation warnings to Versioned::VersionsList() and allVersions() (Robbie Averill)
2019-05-300520d7746 checkHistoricalPasswords(), characterStrength() and minLength() are now correctly deprecated from 4.5.0 onwards (#9008) (Guy Marriott)
2019-05-279bfce8c1a Add extension points to MigrateFileTask (#8994) (Maxime Rainville)
2019-05-24d87377995 checkHistoricalPasswords(), characterStrength() and minLength() are now correctly deprecated from 4.5.0 onwards (Robbie Averill)
2019-05-235184cb9 Bump minimum PHP version to 7.1 (Robbie Averill)
2019-05-23c262dd3 Bump minimum PHP version to 7.1 (Robbie Averill)
2019-05-23002cb6b Bump minimum PHP version to 7.1 (Robbie Averill)
2019-05-23ac3534404 Drop PHP 5.6 and PHP 7.0 support in SS 4.5 (Sam Minnee)