If the request manages to have data set outside of post/put we should
still validate the request body. This expands SecurityComponent to cover
PATCH and DELETE methods, as well as request methods that should be
safe, but somehow end up not safe.
Backport the intent of #7845 into 2.x. The implementation differs a bit
from 3.x but paginator helper internals are pretty different in both
branches.
Refs #7092
Fix file:// paths being mishandled on windows.
While I don't think its feasible to fix all the cases reported in #7275
as certain paths have different meaning in windows, we can fix file://
not working.
Refs #7275
Remove the ability to specify completely arbitrary view files. This is
possibly a breaking change. However, I feel the risks out weigh the
benefits in this situation. Now absolute paths must be located *within*
a configured view path.
Adds ssl_ context options to SmtpTransport via CakeSocket. Both
CakeSocket and SmtpTransport can now use all the SSL context options
with the same syntax as HttpSocket.
Having all the options consolidated in one places enables all the SSL
context options to be used in the SmtpTransport instead of just allowing
self_signed as proposed in #7496
Numeric types in postgres are treated like decimals, except they can
have no length, precision or scale components defined.
IE does not accept 1.00000 as a valid step attribute so we'll default to
any when we encounter decimal types with no length.
Refs #7497
When a fieldList is used, and updated is not in the fieldList, the
column should continue to be updated even if the column has a value from
the user. Because the field is not in the fieldList, we must assume that
the intent is for the field to update automatically, as it would have if
the updated column was not present in the save data.
Refs #7076
If a visible input is created *after* a hidden input was created, the
form would always blackhole unless the visible input had the same value
as the hidden input.
Refs #7274
On Windows based systems, both, backward as well as forward
slashes are supported as path separators, thus checking for `DS`
only, would allow to slip in `../` fragments.
refs #5905, cad57dcc28
