summaryrefslogtreecommitdiffstats
path: root/user_guide_src/source/changelog.rst
diff options
context:
space:
mode:
Diffstat (limited to 'user_guide_src/source/changelog.rst')
-rw-r--r--user_guide_src/source/changelog.rst106
1 files changed, 73 insertions, 33 deletions
diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst
index bcee73a92..0f89077b1 100644
--- a/user_guide_src/source/changelog.rst
+++ b/user_guide_src/source/changelog.rst
@@ -9,16 +9,11 @@ Release Date: Not Released
- License
- - CodeIgniter has been relicensed with the Open Software License (3.0), eliminating its old proprietary licensing.
-
- - All system files are licensed with OSL 3.0.
- - Config, error, and sample files shipped in the application folder are
- licensed with the Academic Free License (3.0) to allow you to retain
- all licensing authority over your own application code.
+ - CodeIgniter has been relicensed with the `MIT License <http://opensource.org/licenses/MIT>`_, eliminating its old proprietary licensing.
- General Changes
- - PHP 5.1.6 is no longer supported. CodeIgniter now requires PHP 5.2.4.
+ - PHP 5.1.6 is no longer supported. CodeIgniter now requires PHP 5.2.4 and recommends PHP 5.4+ or newer to be used.
- Changed filenaming convention (class file names now must be Ucfirst and everything else in lowercase).
- Changed the default database driver to 'mysqli' (the old 'mysql' driver is DEPRECATED).
- ``$_SERVER['CI_ENV']`` can now be set to control the ``ENVIRONMENT`` constant.
@@ -47,9 +42,9 @@ Release Date: Not Released
Only entries in ``$autoload['libraries']`` are auto-loaded now.
- Removed previously deprecated EXT constant.
- Updated all classes to be written in PHP 5 style, with visibility declarations and no ``var`` usage for properties.
- - Moved error templates to *application/views/errors/*.
+ - Added an Exception handler.
+ - Moved error templates to *application/views/errors/* and made the path configurable via ``$config['error_views_path']``.
- Added support non-HTML error templates for CLI applications.
- - Made error templates path configurable using ``$config['error_views_path']``.
- Moved the Log class to *application/core/*
- Global config files are loaded first, then environment ones. Environment config keys overwrite base ones, allowing to only set the keys we want changed per environment.
- Changed detection of ``$view_folder`` so that if it's not found in the current path, it will now also be searched for under the application folder.
@@ -62,6 +57,8 @@ Release Date: Not Released
- Added support for changing the file extension of log files using ``$config['log_file_extension']``.
- Added support for turning newline standardization on/off via ``$config['standardize_newlines']`` and set it to FALSE by default.
- Added configuration setting ``$config['composer_autoload']`` to enable loading of a `Composer <https://getcomposer.org/>`_ auto-loader.
+ - Removed the automatic conversion of 'programmatic characters' to HTML entities from the :doc:`URI Library <libraries/uri>`.
+ - Changed log messages that say a class or file was loaded to "info" level instead of "debug", so that they don't pollute log files when ``$config['log_threshold']`` is set to 2 (debug).
- Helpers
@@ -107,7 +104,7 @@ Release Date: Not Released
- :doc:`Form Helper <helpers/form_helper>` changes include:
- :func:`form_dropdown()` will now also take an array for unity with other form helpers.
- - :func:`form_prep()`'s second argument now only accepts a boolean value, which determines whether the value is escaped for a <textarea> or a regular <input> element.
+ - :func:`form_prep()` is now DEPRECATED and only acts as an alias for :doc:`common function <general/common_functions>` :func:`html_escape()`.
- :doc:`Security Helper <helpers/security_helper>` changes include:
@@ -116,6 +113,7 @@ Release Date: Not Released
- :doc:`Smiley Helper <helpers/smiley_helper>` changes include:
+ - Deprecated the whole helper as too specific for CodeIgniter.
- Removed previously deprecated function ``js_insert_smiley()``.
- Changed application and environment config files to be loaded in a cascade-like manner.
- The smileys array is now cached and loaded only once.
@@ -138,6 +136,8 @@ Release Date: Not Released
- Added *colors* configuration to allow customization for the *background*, *border*, *text* and *grid* colors.
- Added *filename* to the returned array elements.
- Updated to use `imagepng()` in case that `imagejpeg()` isn't available.
+ - Added **font_size** option to allow customization of font size.
+ - Added **img_id** option to set id attribute of captcha image.
- :doc:`Text Helper <helpers/text_helper>` changes include:
@@ -173,6 +173,7 @@ Release Date: Not Released
- Added Interbase/Firebird database support via the *ibase* driver.
- Added ODBC support for ``create_database()``, ``drop_database()`` and ``drop_table()`` in :doc:`Database Forge <database/forge>`.
- Added **save_queries** configuration setting to *application/config/database.php* (defaults to ``TRUE``).
+ - Added support to binding arrays as ``IN()`` sets in ``query()``.
- :doc:`Query Builder <database/query_builder>` changes include:
@@ -187,7 +188,8 @@ Release Date: Not Released
- Changed ``limit()`` to ignore NULL values instead of always casting to integer.
- Changed ``offset()`` to ignore empty values instead of always casting to integer.
- Methods ``insert_batch()`` and ``update_batch()`` now return an integer representing the number of rows affected by them.
- - Methods ``where()``, ``or_where()``, ``having()`` and ``or_having()`` now convert the operators *<>* and *!=* into *IS NOT NULL* when the supplied for comparison value is equal to *NULL*.
+ - Methods ``where()``, ``or_where()``, ``having()`` and ``or_having()`` now convert trailing ``=`` and ``<>``, ``!=`` SQL operators to ``IS NULL`` and ``IS NOT NULL`` respectively when the supplied comparison value is ``NULL``.
+ - Added method chaining support to ``reset_query()``, ``start_cache()``, ``stop_cache()`` and ``flush_cache()``.
- :doc:`Database Results <database/results>` changes include:
@@ -197,9 +199,10 @@ Release Date: Not Released
- Improved support for the MySQLi driver, including:
- - OOP style of the PHP extension is now used, instead of the procedural aliases.
+ - OOP style usage of the PHP extension is now used, instead of the procedural aliases.
- Server version checking is now done via ``mysqli::$server_info`` instead of running an SQL query.
- Added persistent connections support for PHP >= 5.3.
+ - Added support for configuring socket pipe connections.
- Added support for ``backup()`` in :doc:`Database Utilities <database/utilities>`.
- Changed methods ``trans_begin()``, ``trans_commit()`` and ``trans_rollback()`` to use the PHP API instead of sending queries.
@@ -258,6 +261,7 @@ Release Date: Not Released
- Added support for passing a custom database object to the loader.
- Added support for passing custom table attributes (such as ``ENGINE`` for MySQL) to ``create_table()``.
- Added support for usage of the *FIRST* clause in ``add_column()`` for MySQL and CUBRID.
+ - Added partial support for field comments (MySQL, PostgreSQL, Oracle).
- Deprecated ``add_column()``'s third method. *AFTER* clause should now be added to the field definition array instead.
- Overall improved support for all of the drivers.
@@ -280,19 +284,19 @@ Release Date: Not Released
- :doc:`Session Library <libraries/sessions>` changes include:
- - Library changed to :doc:`Driver <general/drivers>` with classic 'cookie' driver as the default.
- - Added a 'native' PHP Session driver to work with ``$_SESSION``.
- - Added a new **tempdata** feature that allows setting userdata items with expiration time (``tempdata()``, ``set_tempdata()``, ``unset_tempdata()``).
- - Added default ``$config['sess_driver']`` and ``$config['sess_valid_drivers']`` items to *application/config.php* file.
- - Changed 'cookie' driver to respect php.ini's *session.gc_probability* and *session.gc_divisor* settings.
- - Changed 'cookie' driver to use HMAC authentication instead of a simple md5 checksum.
- - Changed 'cookie' driver to select only one row when using database sessions.
- - Changed 'cookie' driver to write to only write to the database at end of page execution.
+ - Completely re-written the library to use self-contained drivers via ``$config['sess_driver']``.
+ - Added 'files', 'database', 'redis' and 'memcached' drivers (using 'files' by default).
+ - Added ``$config['sess_save_path']`` setting to specify where the session data is stored, depending on the driver.
+ - Dropped support for storing session data in cookies (which renders ``$config['sess_encrypt_cookie']`` useless and is therefore also removed).
+ - Dropped official support for storing session data in databases other than MySQL and PostgreSQL.
+ - Changed table structure for the 'database' driver.
+ - Added a new **tempdata** feature that allows setting userdata items with expiration time (``mark_as_temp()``, ``tempdata()``, ``set_tempdata()``, ``unset_tempdata()``).
- Changed method ``keep_flashdata()`` to also accept an array of keys.
- Changed methods ``userdata()``, ``flashdata()`` to return an array of all userdata/flashdata when no parameter is passed.
- Deprecated method ``all_userdata()`` - it is now just an alias for ``userdata()`` with no parameters.
- Added method ``has_userdata()`` that verifies the existence of a userdata item.
- Added *debug* level log messages for key events in the session validation process.
+ - Dropped support for the *sess_match_useragent* option.
- :doc:`File Uploading Library <libraries/file_uploading>` changes include:
@@ -318,6 +322,7 @@ Release Date: Not Released
- :doc:`Cart Library <libraries/cart>` changes include:
+ - Deprecated the library as too specific for CodeIgniter.
- Added method ``remove()`` to remove a cart item, updating with quantity of 0 seemed like a hack but has remained to retain compatibility.
- Added method ``get_item()`` to enable retrieving data for a single cart item.
- Added unicode support for product names.
@@ -332,7 +337,7 @@ Release Date: Not Released
- Class properties *wm_font_color*, *wm_shadow_color* and *wm_use_drop_shadow* are now protected, to avoid breaking the ``text_watermark()`` method if they are set manually after initialization.
- If property *maintain_ratio* is set to TRUE, ``image_reproportion()`` now doesn't need both width and height to be specified.
- Property *maintain_ratio* is now taken into account when resizing images using ImageMagick library.
- - Added support for maintaining transparency for PNG images in method ``text_watermark()``.
+ - Added support for maintaining transparency for PNG images when watermarking.
- Added a **file_permissions** setting.
- :doc:`Form Validation Library <libraries/form_validation>` changes include:
@@ -345,6 +350,7 @@ Release Date: Not Released
- Removed method ``is_numeric()`` as it exists as a native PHP function and ``_execute()`` will find and use that (the **is_numeric** rule itself is deprecated since 1.6.1).
- Native PHP functions used as rules can now accept an additional parameter, other than the data itself.
- Updated method ``set_rules()`` to accept an array of rules as well as a string.
+ - Added support for ``in`` method that test if a given value is within a given list.
- Fields that have empty rules set no longer run through validation (and therefore are not considered erroneous).
- Added rule **differs** to check if the value of a field differs from the value of another field.
- Added rule **valid_url**.
@@ -391,9 +397,10 @@ Release Date: Not Released
- Added support for the anchor "rel" attribute.
- Added support for setting custom attributes.
- Added support for language translations of the *first_link*, *next_link*, *prev_link* and *last_link* values.
+ - Added support for ``$config['num_links'] = 0`` configuration.
- Added ``$config['reuse_query_string']`` to allow automatic repopulation of query string arguments, combined with normal URI segments.
+ - Added ``$config['use_global_url_suffix']`` to allow overriding the library 'suffix' value with that of the global ``$config['url_suffix']`` setting.
- Removed the default ``&nbsp;`` from a number of the configuration variables.
- - Added support for ``$config['num_links'] = 0`` configuration.
- :doc:`Profiler Library <general/profiling>` changes include:
@@ -422,7 +429,11 @@ Release Date: Not Released
- Added method chaining support.
- Added support for setting table class defaults in a config file.
- - :doc:`Zip Library <libraries/zip>` method ``read_file()`` can now also alter the original file path/name while adding files to an archive.
+ - :doc:`Zip Library <libraries/zip>` changes include:
+
+ - Method ``read_file()`` can now also alter the original file path/name while adding files to an archive.
+ - Added support for changing the compression level.
+
- :doc:`Trackback Library <libraries/trackback>` method ``receive()`` will now utilize ``iconv()`` if it is available but ``mb_convert_encoding()`` is not.
- Core
@@ -441,6 +452,7 @@ Release Date: Not Released
- Added conditional PCRE UTF-8 support to the "invalid URI characters" check and removed the ``preg_quote()`` call from it to allow more flexibility.
- Renamed method ``_filter_uri()`` to ``filter_uri()``.
+ - Changed method ``filter_uri()`` to accept by reference and removed its return value.
- Changed private methods to protected so that MY_URI can override them.
- Renamed internal method ``_parse_cli_args()`` to ``_parse_argv()``.
- Renamed internal method ``_detect_uri()`` to ``_parse_request_uri()``.
@@ -475,6 +487,7 @@ Release Date: Not Released
- Changed default value of the ``$xss_clean`` parameter to NULL for all methods that utilize it, the default value is now determined by the ``$config['global_xss_filtering']`` setting.
- Added method ``post_get()`` and changed ``get_post()`` to search in GET data first. Both methods' names now properly match their GET/POST data search priorities.
- Changed method ``_fetch_from_array()`` to parse array notation in field name.
+ - Changed method ``_fetch_from_array()`` to allow retrieving multiple fields at once.
- Added an option for ``_clean_input_keys()`` to return FALSE instead of terminating the whole script.
- Deprecated the ``is_cli_request()`` method, it is now an alias for the new :func:`is_cli()` common function.
- Added an ``$xss_clean`` parameter to method ``user_agent()`` and removed the ``$user_agent`` property.
@@ -484,7 +497,8 @@ Release Date: Not Released
- Added function :func:`get_mimes()` to return the *application/config/mimes.php* array.
- Added support for HTTP code 303 ("See Other") in :func:`set_status_header()`.
- Removed redundant conditional to determine HTTP server protocol in :func:`set_status_header()`.
- - Changed ``_exception_handler()`` to respect php.ini *display_errors* setting.
+ - Renamed ``_exception_handler()`` to ``_error_handler()`` and replaced it with a real exception handler.
+ - Changed ``_error_handler()`` to respect php.ini *display_errors* setting.
- Added function :func:`is_https()` to check if a secure connection is used.
- Added function :func:`is_cli()` to replace the ``CI_Input::is_cli_request()`` method.
- Added function :func:`function_usable()` to work around a bug in `Suhosin <http://www.hardened-php.net/suhosin/>`.
@@ -492,12 +506,14 @@ Release Date: Not Released
- Changed internal function ``load_class()`` to accept a constructor parameter instead of (previously unused) class name prefix.
- Removed default parameter value of :func:`is_php()`.
- Added a second argument ``$double_encode`` to :func:`html_escape()`.
+ - Changed function ``config_item()`` to return NULL instead of FALSE when no value is found.
- :doc:`Output Library <libraries/output>` changes include:
- Added a second argument to method ``set_content_type()`` that allows setting the document charset as well.
- Added methods ``get_content_type()`` and ``get_header()``.
- Added method ``delete_cache()``.
+ - Added configuration option ``$config['cache_query_string']`` to enable taking the query string into account when caching.
- Changed caching behavior to compress the output before storing it, if ``$config['compress_output']`` is enabled.
- :doc:`Config Library <libraries/config>` changes include:
@@ -506,6 +522,7 @@ Release Date: Not Released
- Removed internal method ``_assign_to_config()`` and moved its implementation to *CodeIgniter.php* instead.
- ``item()`` now returns NULL instead of FALSE when the required config item doesn't exist.
- Added an optional second parameter to both ``base_url()`` and ``site_url()`` that allows enforcing of a protocol different than the one in the *base_url* configuration setting.
+ - Added HTTP "Host" header character validation to prevent cache poisoning attacks when ``base_url`` auto-detection is used.
- :doc:`Security Library <libraries/security>` changes include:
@@ -519,6 +536,7 @@ Release Date: Not Released
- :doc:`Language Library <libraries/language>` changes include:
- Changed method ``load()`` to filter the language name with ``ctype_alpha()``.
+ - Changed method ``load()`` to also accept an array of language files.
- Added an optional second parameter to method ``line()`` to disable error logging for line keys that were not found.
- Language files are now loaded in a cascading style with the one in **system/** always loaded and overriden afterwards, if another one is found.
@@ -538,6 +556,7 @@ Release Date: Not Released
- Added a ``$config['log_file_permissions']`` setting.
- Changed the library constructor to try to create the **log_path** directory if it doesn't exist.
+ - Added support for microseconds ("u" date format character) in ``$config['log_date_format']``.
- Added `compatibility layers <general/compatibility_functions>` for:
@@ -549,7 +568,7 @@ Release Date: Not Released
- Removed ``CI_CORE`` boolean constant from *CodeIgniter.php* (no longer Reactor and Core versions).
- Added support for HTTP-Only cookies with new config option *cookie_httponly* (default FALSE).
- ``$config['time_reference']`` now supports all timezone strings supported by PHP.
- - Fatal PHP errors are now also passed to ``_exception_handler()``, so they can be logged.
+ - Fatal PHP errors are now also passed to ``_error_handler()``, so they can be logged.
Bug fixes for 3.0
@@ -698,7 +717,6 @@ Bug fixes for 3.0
- Fixed a bug (#2061) - :doc:`Routing Class <general/routing>` didn't properly sanitize directory, controller and function triggers with **enable_query_strings** set to TRUE.
- Fixed a bug - SQLSRV didn't support ``escape_like_str()`` or escaping an array of values.
- Fixed a bug - :doc:`Database Results <database/results>` method ``list_fields()`` didn't reset its field pointer for the 'mysql', 'mysqli' and 'mssql' drivers.
-- Fixed a bug (#73) - :doc:`Security Library <libraries/security>` method ``sanitize_filename()`` could be tricked by an XSS attack.
- Fixed a bug (#2211) - :doc:`Migration Library <libraries/migration>` extensions couldn't execute ``CI_Migration::__construct()``.
- Fixed a bug (#2255) - :doc:`Email Library <libraries/email>` didn't apply *smtp_timeout* to socket reads and writes.
- Fixed a bug (#2239) - :doc:`Email Library <libraries/email>` improperly handled the Subject when used with *bcc_batch_mode* resulting in E_WARNING messages and an empty Subject.
@@ -722,14 +740,12 @@ Bug fixes for 3.0
- Fixed a bug (#2609) - :doc:`Common function <general/common_functions>` :func:`get_config()` optional argument was only effective on first function call. Also, it can now add items, in addition to updating existing items.
- Fixed a bug in the 'postgre' :doc:`database <database/index>` driver where the connection ID wasn't passed to ``pg_escape_string()``.
- Fixed a bug (#33) - Script execution was terminated when an invalid cookie key was encountered.
-- Fixed a bug (#2681) - :doc:`Security Library <libraries/security>` method ``entity_decode()`` used the `PREG_REPLACE_EVAL` flag, which is deprecated since PHP 5.5.
- Fixed a bug (#2691) - nested :doc:`database <database/index>` transactions could end in a deadlock when an error is encountered with *db_debug* set to TRUE.
- Fixed a bug (#2515) - ``_exception_handler()`` used to send the 200 "OK" HTTP status code and didn't stop script exection even on fatal errors.
- Fixed a bug - Redis :doc:`Caching <libraries/caching>` driver didn't handle connection failures properly.
- Fixed a bug (#2756) - :doc:`Database Class <database/index>` executed the MySQL-specific `SET SESSION sql_mode` query for all drivers when the 'stricton' option is set.
- Fixed a bug (#2579) - :doc:`Query Builder <database/query_builder>` "no escape" functionality didn't work properly with query cache.
- Fixed a bug (#2237) - :doc:`Parser Library <libraries/parser>` failed if the same tag pair is used more than once within a template.
-- Fixed a bug (#2268) - :doc:`Security Library <libraries/security>` didn't properly match JavaScript events.
- Fixed a bug (#2143) - :doc:`Form Validation Library <libraries/form_validation>` didn't check for rule groups named in a *controller/method* manner when trying to load from a config file.
- Fixed a bug (#2762) - :doc:`Hooks Class <general/hooks>` didn't properly check if the called class/function exists.
- Fixed a bug (#148) - :doc:`Input Library <libraries/input>` internal method ``_clean_input_data()`` assumed that it data is URL-encoded, stripping certain character sequences from it.
@@ -740,7 +756,6 @@ Bug fixes for 3.0
- Fixed a bug where :doc:`User Agent Library <libraries/user_agent>` methods ``accept_charset()`` and ``accept_lang()`` didn't properly parse HTTP headers that contain spaces.
- Fixed a bug where *default_controller* was called instad of triggering a 404 error if the current route is in a controller directory.
- Fixed a bug (#2737) - :doc:`XML-RPC Library <libraries/xmlrpc>` used objects as array keys, which triggered E_NOTICE messages.
-- Fixed a bug (#2729) - :doc:`Security Library <libraries/security>` internal method ``_validate_entities()`` used overly-intrusive ``preg_replace()`` patterns that produced false-positives.
- Fixed a bug (#2771) - :doc:`Security Library <libraries/security>` method ``xss_clean()`` didn't take into account HTML5 entities.
- Fixed a bug (#2856) - ODBC method ``affected_rows()`` passed an incorrect value to ``odbc_num_rows()``.
- Fixed a bug (#43) :doc:`Image Manipulation Library <libraries/image_lib>` method ``text_watermark()`` didn't properly determine watermark placement.
@@ -749,9 +764,34 @@ Bug fixes for 3.0
- Partially fixed a bug (#261) - UTF-8 class method ``clean_string()`` generating log messages and/or not producing the desired result due to an upstream bug in iconv.
- Fixed a bug where ``CI_Xmlrpcs::parseRequest()`` could fail if ``$HTTP_RAW_POST_DATA`` is not populated.
- Fixed a bug in :doc:`Zip Library <libraries/zip>` internal method ``_get_mod_time()`` where it was not parsing result returned by ``filemtime()``.
-- Fixed a bug (#3161) - :doc:`Cache Library <libraries/cache>` methods `increment()`, `decrement()` didn't auto-create non-existent items when using redis and/or file storage.
+- Fixed a bug (#3161) - :doc:`Cache Library <libraries/caching>` methods `increment()`, `decrement()` didn't auto-create non-existent items when using redis and/or file storage.
- Fixed a bug (#3189) - :doc:`Parser Library <libraries/parser>` used double replacement on ``key->value`` pairs, exposing a potential template injection vulnerability.
+Version 2.2.1
+=============
+
+Release Date: January 22, 2015
+
+- General Changes
+
+ - Improved security in ``xss_clean()``.
+ - Updated timezones in :doc:`Date Helper <helpers/date_helper>`.
+
+Bug fixes for 2.2.1
+-------------------
+
+- Fixed a bug (#3094) - Internal method ``CI_Input::_clean_input_data()`` breaks encrypted session cookies.
+- Fixed a bug (#2268) - :doc:`Security Library <libraries/security>` method ``xss_clean()`` didn't properly match JavaScript events.
+- Fixed a bug (#3309) - :doc:`Security Library <libraries/security>` method ``xss_clean()`` used an overly-invasive pattern to strip JS event handlers.
+- Fixed a bug (#2771) - :doc:`Security Library <libraries/security>` method ``xss_clean()`` didn't take into account HTML5 entities.
+- Fixed a bug (#73) - :doc:`Security Library <libraries/security>` method ``sanitize_filename()`` could be tricked by an XSS attack.
+- Fixed a bug (#2681) - :doc:`Security Library <libraries/security>` method ``entity_decode()`` used the ``PREG_REPLACE_EVAL`` flag, which is deprecated since PHP 5.5.
+- Fixed a bug (#3302) - Internal function ``get_config()`` triggered an E_NOTICE message on PHP 5.6.
+- Fixed a bug (#2508) - :doc:`Config Library <libraries/config>` didn't properly detect if the current request is via HTTPS.
+- Fixed a bug (#3314) - SQLSRV :doc:`Database driver <database/index>`'s method ``count_all()`` didn't escape the supplied table name.
+- Fixed a bug (#3404) - MySQLi :doc:`Database driver <database/index>`'s method ``escape_str()`` had a wrong fallback to ``mysql_escape_string()`` when there was no active connection.
+- Fixed a bug in the :doc:`Session Library <libraries/sessions>` where session ID regeneration occurred during AJAX requests.
+
Version 2.2.0
=============
@@ -807,7 +847,7 @@ Bug fixes for 2.1.3
- Fixed a bug (#227) - :doc:`Input Library <libraries/input>` allowed unconditional spoofing of HTTP clients' IP addresses through the *HTTP_CLIENT_IP* header.
- Fixed a bug (#907) - :doc:`Input Library <libraries/input>` ignored *HTTP_X_CLUSTER_CLIENT_IP* and *HTTP_X_CLIENT_IP* headers when checking for proxies.
- Fixed a bug (#940) - ``csrf_verify()`` used to set the CSRF cookie while processing a POST request with no actual POST data, which resulted in validating a request that should be considered invalid.
-- Fixed a bug (#499) - :doc:`Security Library <libraries/security>` where a CSRF cookie was created even if ``$config['csrf_protection']`` is set tot FALSE.
+- Fixed a bug (#499) - :doc:`Security Library <libraries/security>` where a CSRF cookie was created even if ``$config['csrf_protection']`` is set to FALSE.
- Fixed a bug (#1715) - :doc:`Input Library <libraries/input>` triggered ``csrf_verify()`` on CLI requests.
- Fixed a bug (#751) - :doc:`Query Builder <database/query_builder>` didn't properly handle cached field escaping overrides.
- Fixed a bug (#2004) - :doc:`Query Builder <database/query_builder>` didn't properly merge cached calls with non-cache ones.
@@ -2240,7 +2280,7 @@ Release Date: January 30, 2008
- Added an "integer" rule into the Validation library.
- Added valid_base64() to the Validation library.
- Documented clear() in the :doc:`Image
- Processing <../libraries/image_lib>` library.
+ Processing <./libraries/image_lib>` library.
- Changed the behaviour of custom callbacks so that they no longer
trigger the "required" rule.
- Modified Upload class $_FILES error messages to be more precise.
@@ -2594,7 +2634,7 @@ Release Date: October 30, 2006
the Date Helper.
- Added :doc:`$query->free_result() <./database/results>` to database
class.
-- Added :doc:`$query->list_fields() <./database/fields>` function to
+- Added :doc:`$query->list_fields() <./database/metadata>` function to
database class
- Added :doc:`$this->db->platform() <./database/helpers>` function
- Added new :doc:`File Helper <./helpers/file_helper>`: