From 481e42660f3c703789b4564402b5c47032c87c99 Mon Sep 17 00:00:00 2001
From: Andrey Andreev <narf@bofh.bg>
Date: Sat, 6 Oct 2012 15:42:56 +0300
Subject: Backport security fixes

---
 user_guide/changelog.html | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'user_guide')

diff --git a/user_guide/changelog.html b/user_guide/changelog.html
index d31839913..1c89f16be 100644
--- a/user_guide/changelog.html
+++ b/user_guide/changelog.html
@@ -68,6 +68,8 @@ Change Log
 	<li>Fixed a bug (#1699) - <a href="libraries/migration.html">Migration Library</a> ignored the <samp>$config['migration_path']</samp> setting.</li>
 	<li>Fixed a bug (#227) - <a href="libraries/input.html">Input Library</a> allowed unconditional spoofing of HTTP clients' IP addresses through the HTTP_CLIENT_IP header.</li>
 	<li>Fixed a bug (#907) - <a href="libraries/input.html">Input Library</a> ignored HTTP_X_CLUSTER_CLIENT_IP and HTTP_X_CLIENT_IP headers when checking for proxies.</li>
+	<li>Fixed a bug (#940) - <samp>csrf_verify()</samp> used to set the CSRF cookie while processing a POST request with no actual POST data, which resulted in validating a request that should be considered invalid.</li>
+	<li>Fixed a bug in the <a href="libraries/security.html">Security Library</a> where a CSRF cookie was created even if <samp>$config['csrf_protection']</samp> is set tot FALSE.</li>
 </ul>
 
 <h2>Version 2.1.2</h2>
-- 
cgit v1.2.3-24-g4f1b