Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CC-32129: Updated the security release notes. #2387

Merged
merged 4 commits into from
Jan 23, 2024
Merged

CC-32129: Updated the security release notes. #2387

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
17c4b69
CC-32129: Updated the security-release-notes-202312.0.md with backpor…
abitskil Dec 8, 2023
d321713
CC-32129: Fixed the typo.
abitskil Dec 8, 2023
901b5b5
Merge branch 'master' into bugfix/cc-32129-update-to-security-release
andriitserkovnyi Jan 23, 2024
f3a4566
Update security-release-notes-202312.0.md
andriitserkovnyi Jan 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions ...user/intro-to-spryker/releases/release-notes/security-release-notes-202312.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ If you need any additional support with this content, [contact our support](http
## Insecure password reset workflow

The password reset functionality missed security-related controls that could lead to manipulation by attackers. The security flaws related to fixing this issue included the following:
* Reusable password reset tokens: Upon successful completion of a password reset, the same link containing a token could be reused to reset the password again.<br>
* Reusable password reset tokens: Upon successful completion of a password reset, the same link containing a token could be reused to reset the password again.<br>
Affected applications: BackOffice, Merchant Portal.
* Extended expiration time for password reset tokens: The password reset token expiration time was too long.<br>
Affected applications: Storefront, Back Office, Merchant Portal.
Expand Down Expand Up @@ -216,7 +216,8 @@ If your platform is based on PHP 8.0, you can use version 2.23.1 of the CompanyP
composer require spryker-shop/company-page:"~2.23.1"
composer show spryker-shop/company-page # Verify the version
```
2. In the `CompanyPage/Theme/default/views/role-update/role-update.twig` template, define the data properties::

2. In the `CompanyPage/Theme/default/views/role-update/role-update.twig` template, define the data properties:

```bash
{% raw %}
Expand All @@ -229,7 +230,7 @@ composer show spryker-shop/company-page # Verify the version
{% endraw %}
```

3. Add these properties to the data config of the `permission-table` molecule:
3. Add these properties to the data config of the `permission-table` molecule:

```bash
{% raw %}
Expand Down Expand Up @@ -257,7 +258,7 @@ composer show spryker-shop/company-page # Verify the version
{% endraw %}
```

5. Replace the static links currently used for assigning and unassigning company role permissions with the following Symfony forms:
5. Replace the static links currently used for assigning and unassigning company role permissions with the following Symfony forms:

```bash
{% raw %}
Expand Down Expand Up @@ -298,11 +299,11 @@ composer show spryker-shop/company-page # Verify the version
{% set formAssign = data.companyRolePermissionAssignFormCloner.getForm.createView ?? null %}
{% set formUnassign = data.companyRolePermissionUnassignFormCloner.getForm.createView ?? null %}
{% set actionAssign = path('company/company-role-permission/assign', {
'id-permission': permission.idPermission,
'id-permission': permission.idPermission,
'id-company-role': data.idCompanyRole,
}) %}
{% set actionUnassign = path('company/company-role-permission/unassign', {
'id-permission': permission.idPermission,
'id-permission': permission.idPermission,
'id-company-role': data.idCompanyRole,
}) %}
{% set titleAssign = 'company.account.company_role.permission.assign' | trans %}
Expand Down Expand Up @@ -499,7 +500,7 @@ docker/sdk cli npm install
docker/sdk up --assets
```

or
or

```bash
npm install && npm run yves && npm run zed
Expand Down Expand Up @@ -547,4 +548,4 @@ or
```bash
npm install && npm run yves && npm run zed
npm run mp:build (optional, only for the Marketplace setup)
```
```
Loading