|
变化不少,大家看看
Version 2.0.3
Release Date: August 20, 2011
* Security
o An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection.
An incompatibility in PHP versions < 5.2.3 and MySQL < 5.0.7 with mysql_set_charset() creates a situation where using multi-byte character sets on these environments may potentially expose a SQL injection attack vector. Latin-1, UTF-8, and other "low ASCII" character sets are unaffected on all environments.
If you are running or considering running a multi-byte character set for your database connection, please pay close attention to the server environment you are deploying on to ensure you are not vulnerable.
* General Changes
o Fixed a bug where there was a misspelling within a code comment in the index.php file.
o Added Session Class userdata to the output profiler. Additionally, added a show/hide toggle on HTTP Headers, Session Data and Config Variables.
o Removed internal usage of the EXT constant.
o Visual updates to the welcome_message view file and default error templates. Thanks to danijelb for the pull request.
o Added insert_batch() function to the PostgreSQL database driver. Thanks to epallerols for the patch.
o Added "application/x-csv" to mimes.php.
o Fixed a bug where Email library attachments with a "." in the name would using invalid MIME-types.
* Helpers
o Added an optional third parameter to heading() which allows adding html attributes to the rendered heading tag.
* Libraries
o Altered Session to use a longer match against the user_agent string. See upgrade notes if using database sessions.
o Added $this->db->set_dbprefix() to the Database Driver.
o Changed $this->cart->insert() in the Cart Library to return the Row ID if a single item was inserted successfully.
o Added $this->load->get_var() to the Loader library to retrieve global vars set with $this->load->view() and $this->load->vars().
o Changed $this->db->having() to insert quotes using escape() rather than escape_str().
Bug fixes for 2.0.3
* Added ENVIRONMENT to reserved constants. (Reactor #196)
* Changed server check to ensure SCRIPT_NAME is defined. (Reactor #57)
* Removed APPPATH.'third_party' from the packages autoloader to negate needless file stats if no packages exist or if the developer does not load any other packages by default.
* Fixed a bug (Reactor #231) where Sessions Library database table example SQL did not contain an index on last_activity. See Upgrade Notes.
* Fixed a bug (Reactor #229) where the Sessions Library example SQL in the documentation contained incorrect SQL.
* Fixed a bug (Core #340) where when passing in the second parameter to $this->db->select(), column names in subsequent queries would not be properly escaped.
* Fixed issue #199 - Attributes passed as string does not include a space between it and the opening tag.
* Fixed a bug where the method $this->cart->total_items() from Cart Library now returns the sum of the quantity of all items in the cart instead of your total count.
* Fixed a bug where not setting 'null' when adding fields in db_forge for mysql and mysqli drivers would default to NULL instead of NOT NULL as the docs suggest.
* Fixed a bug where using $this->db->select_max(), $this->db->select_min(), etc could throw notices. Thanks to w43l for the patch.
* Replace checks for STDIN with php_sapi_name() == 'cli' which on the whole is more reliable. This should get parameters in crontab working.
|
|