diff options
Diffstat (limited to 'user_guide')
| -rw-r--r-- | user_guide/changelog.html | 7 | ||||
| -rw-r--r-- | user_guide/libraries/security.html | 3 |
2 files changed, 10 insertions, 0 deletions
diff --git a/user_guide/changelog.html b/user_guide/changelog.html index d095c2f5f..6a76a4fd0 100644 --- a/user_guide/changelog.html +++ b/user_guide/changelog.html @@ -91,6 +91,7 @@ Change Log <li class="reactor">Added a <a href="libraries/migration.html">Migration Library</a> to assist with applying incremental updates to your database schema.</li> <li class="reactor">Driver children can be located in any package path.</li> <li class="reactor">Added max_filename_increment config setting for Upload library.</li> + <li><samp>CI_Loader::_ci_autoloader()</samp> is now a protected method.</li> </ul> </li> </ul> @@ -125,7 +126,13 @@ Change Log <li>Visual updates to the welcome_message view file and default error templates. Thanks to <a href="https://bitbucket.org/danijelb">danijelb</a> for the pull request.</li> <li class="reactor">Added <samp>insert_batch()</samp> function to the PostgreSQL database driver. Thanks to epallerols for the patch.</li> <li class="reactor">Added "application/x-csv" to mimes.php.</li> + <li class="reactor">Added CSRF protection URI whitelisting.</li> <li>Fixed a bug where <a href="libraries/email.html">Email library</a> attachments with a "." in the name would using invalid MIME-types.</li> + <li>Added support for pem,p10,p12,p7a,p7c,p7m,p7r,p7s,crt,crl,der,kdb,rsa,cer,sst,csr Certs to mimes.php.</li> + <li>Added support pgp,gpg to mimes.php.</li> + <li>Added support 3gp, 3g2, mp4, wmv, f4v, vlc Video files to mimes.php.</li> + <li>Added support m4a, aac, m4u, xspf, au, ac3, flac, ogg Audio files to mimes.php.</li> + </ul> </li> <li>Helpers diff --git a/user_guide/libraries/security.html b/user_guide/libraries/security.html index dd62a4386..cbe12d852 100644 --- a/user_guide/libraries/security.html +++ b/user_guide/libraries/security.html @@ -116,6 +116,9 @@ Note: This function should only be used to deal with data upon submission. It's <p>If you use the <a href="../helpers/form_helper.html">form helper</a> the <var>form_open()</var> function will automatically insert a hidden csrf field in your forms.</p> +<p>Select URIs can be whitelisted from csrf protection (for example API endpoints expecting externally POSTed content). You can add these URIs by editing the 'csrf_exclude_uris' config parameter:</p> +<code>$config['csrf_exclude_uris'] = array('api/person/add');</code> + </div> <!-- END CONTENT --> |