CakePHP 2.4.1 released

The CakePHP core team is proud to announce the immediate availability of CakePHP 2.4.1[1]. 2.4.1 is a bugfix release for the 2.4 release branch. A short list of the changes you can expect is:

* Improved API documentation and links to the book from the API.

* Notice errors when loading LC_TIME files should no longer happen.

* TreeBehavior::generateTreeList() now includes the scope defined in the model's actsAs property.

* Support for readline was added to Shell commands. If your environment supports readline, arrow keys will no longer output escape sequences.

* FormHelper::input() will now use attributes defined in the label key.

* Inflection support was improved.

* Performance of CakeTime::timeAgoInWords() was improved.

* Method signatures of Behavior callbacks was corrected. If you are using PHP5.4 you may have to update the method signatures of your behaviors to resolve any E_STRICT errors.

* CROSS JOINs work correctly now.

* SqlServer::value() now correctly handles NULL values.

* Cache::clearGroup()  with FileEngine and no prefix behaves as expected now.

* CakeEmail now quotes email aliases that contain non-alphanumeric characters, that have not already been encoded.

* Phone number validation was simplified to fix valid area codes being detected as invalid.

### Security disclosure

In 2.3.8 a security issue in AssetDispatcher was fixed. In the spirit of being open and transparent a more detailed description of the issue is being provided. By carefully crafting a URL the AssetDispatcher would allow arbitrary file access. A successful attack required at least one theme or plugin to be in use. An example url would look like:

    http://example.com/DebugKit/%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd

AssetDispatcher incorrectly checked for directory traversal before decoding the URL. We'd like to thank Takeshi Terada of Mitsui Bussan Secure Directions, Inc for notifying us of the issue.

As always, a big thank you to everyone involved in both contributions through commits, tickets, documentation edits, and those whom have otherwise contributed to the framework. Without you there would be no CakePHP. Download a packaged release [2].

### Links

* [1] http://cakephp.org/changelogs/2.4.1

* [2] http://github.com/cakephp/cakephp/releases/2.4.1

--
Like Us on FaceBook https://www.facebook.com/CakePHP
Find us on Twitter http://twitter.com/CakePHP
 
---
You received this message because you are subscribed to the Google Groups "CakePHP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cake-php+unsubscribe@googlegroups.com.
To post to this group, send email to cake-php@googlegroups.com.
Visit this group at http://groups.google.com/group/cake-php.
For more options, visit https://groups.google.com/groups/opt_out.