[3.0] Misc fixes - #9302

Open

Sesquipedalian wants to merge 20 commits into

SimpleMachines:release-3.0from

Sesquipedalian:3.0/upgrader_login

Commits on Aug 30, 2026

Uses hash_equals() in SMF\Maintenance\Maintenance::login* methods
Sesquipedalian
committed
4baa3a7
Logs correct info about who ran the upgrader
Sesquipedalian
committed
812d127
Moves validatePasswordFlood() from SMF\Actions\Login2 to SMF\Security
Sesquipedalian
committed
6ca8fff
Implements SMF\Security::checkPassword()
Sesquipedalian
committed
f511254
Correctly handles creating login tokens in upgrader
Sesquipedalian
committed
03c7ecc
Removes Maintenance::$context in favour of plain old Utils::$context
Sesquipedalian
committed
9527be3
Uses correct key in DropTimeOffset migration
Sesquipedalian
committed
c3092f7
Gives CacheApi::$enable a default of 0
Sesquipedalian
committed
54e1752
Adds #[\SensitiveParameter] attribute to password processing methods
Sesquipedalian
committed
bf17f45
Adds $update param to Security::checkPassword()
Sesquipedalian
committed
3798b93
Prevents timing attacks against Security::checkPasswordFallbacks()
Sesquipedalian
committed
b44c6ea
Ensures $offset is a string in DropTimeOffset::execute()
Sesquipedalian
committed
e55ef6a
Avoids permission errors when karma data was retained during upgrade
Sesquipedalian
committed
9d6fda6
Improves backward compatibility support for permissions
Sesquipedalian
committed
fb114a6
Adds additional guards against errors about unknown permissions
Sesquipedalian
committed
a6afde7
Ensures guest profile has been loaded in User::initializeGuest()
Sesquipedalian
committed
5a40467
Improves migration step for updating the attachment directory settings
Sesquipedalian
committed
14cd18e
Runs AttachmentDirectory before LegacyAttachments during upgrade
Sesquipedalian
committed
91a3f63
Modernizes and tides code in LegacyAttachments migration step
Sesquipedalian
committed
cc04a3f
Handles attachmentUploadDir more robustly in RemoveTempAttachments task
Sesquipedalian
committed
c385188

Navigation Menu

Uh oh!

[3.0] Misc fixes - #9302

[3.0] Misc fixes#9302
Sesquipedalian wants to merge 20 commits into
SimpleMachines:release-3.0from
Sesquipedalian:3.0/upgrader_login

Commits on Aug 30, 2026

Uses hash_equals() in SMF\Maintenance\Maintenance::login* methods

Logs correct info about who ran the upgrader

Moves validatePasswordFlood() from SMF\Actions\Login2 to SMF\Security

Implements SMF\Security::checkPassword()

Correctly handles creating login tokens in upgrader

Removes Maintenance::$context in favour of plain old Utils::$context

Uses correct key in DropTimeOffset migration

Gives CacheApi::$enable a default of 0

Adds #[\SensitiveParameter] attribute to password processing methods

Adds $update param to Security::checkPassword()

Prevents timing attacks against Security::checkPasswordFallbacks()

Ensures $offset is a string in DropTimeOffset::execute()

Avoids permission errors when karma data was retained during upgrade

Improves backward compatibility support for permissions

Adds additional guards against errors about unknown permissions

Ensures guest profile has been loaded in User::initializeGuest()

Improves migration step for updating the attachment directory settings

Runs AttachmentDirectory before LegacyAttachments during upgrade

Modernizes and tides code in LegacyAttachments migration step

Handles attachmentUploadDir more robustly in RemoveTempAttachments task