|
|
发表于 2011-11-17 20:33:55
|
显示全部楼层
Release Date: August 20, 2011
Security
An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection.
An incompatibility in PHP versions < 5.2.3 and MySQL < 5.0.7 with mysql_set_charset() creates a situation where using multi-byte character sets on these environments may potentially expose a SQL injection attack vector. Latin-1, UTF-8, and other "low ASCII" character sets are unaffected on all environments.
If you are running or considering running a multi-byte character set for your database connection, please pay close attention to the server environment you are deploying on to ensure you are not vulnerable.
General Changes
Fixed a bug where there was a misspelling within a code comment in the index.php file.
Added Session Class userdata to the output profiler. Additionally, added a show/hide toggle on HTTP Headers, Session Data and Config Variables.
Removed internal usage of the EXT constant.
Visual updates to the welcome_message view file and default error templates. Thanks to danijelb for the pull request.
Added insert_batch() function to the PostgreSQL database driver. Thanks to epallerols for the patch.
Added "application/x-csv" to mimes.php.
Fixed a bug where Email library attachments with a "." in the name would using invalid MIME-types.
Helpers
Added an optional third parameter to heading() which allows adding html attributes to the rendered heading tag.
Libraries
Altered Session to use a longer match against the user_agent string. See upgrade notes if using database sessions.
Added $this->db->set_dbprefix() to the Database Driver.
Changed $this->cart->insert() in the Cart Library to return the Row ID if a single item was inserted successfully.
Added $this->load->get_var() to the Loader library to retrieve global vars set with $this->load->view() and $this->load->vars().
Changed $this->db->having() to insert quotes using escape() rather than escape_str().
Bug fixes for 2.0.3
Added ENVIRONMENT to reserved constants. (Reactor #196)
Changed server check to ensure SCRIPT_NAME is defined. (Reactor #57)
Removed APPPATH.'third_party' from the packages autoloader to negate needless file stats if no packages exist or if the developer does not load any other packages by default.
Fixed a bug (Reactor #231) where Sessions Library database table example SQL did not contain an index on last_activity. See Upgrade Notes.
Fixed a bug (Reactor #229) where the Sessions Library example SQL in the documentation contained incorrect SQL.
Fixed a bug (Core #340) where when passing in the second parameter to $this->db->select(), column names in subsequent queries would not be properly escaped.
Fixed issue #199 - Attributes passed as string does not include a space between it and the opening tag.
Fixed a bug where the method $this->cart->total_items() from Cart Library now returns the sum of the quantity of all items in the cart instead of your total count.
Fixed a bug where not setting 'null' when adding fields in db_forge for mysql and mysqli drivers would default to NULL instead of NOT NULL as the docs suggest.
Fixed a bug where using $this->db->select_max(), $this->db->select_min(), etc could throw notices. Thanks to w43l for the patch.
Replace checks for STDIN with php_sapi_name() == 'cli' which on the whole is more reliable. This should get parameters in crontab working. |
|
IP卡
狗仔卡
尝尝仙
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡