Packagist · #3244 most downloaded on Packagist

apereo/phpcas

1.6.21.7M downloads/moapereo/phpCAS ↗New releases in your daily digest, changelog included.

Provides a simple API for authenticating users against a CAS server

Last release 5 months ago
22 Apr 2026
Release timing varies
gaps range from 4 months to 3.2 years
Nearly every release is documented
notes for 12 of 12 stable releases
Nothing withdrawn
no release was ever pulled
12 years old
12 releases · first in 2014

Release timeline

12 releases since 2014

2014201620182020

Releases

1.6.222 Apr 20262 sources agree
Compatibility with PHP 8.4 and 8.5 (Cédric Anne, Pascal Rigaux)
Bug Fixes:

Compatibility with PHP 8.4 and 8.5 (Cédric Anne, Pascal Rigaux)

CAS_PGTStorage_Db: call method with incorrect case: createTableSQL [#432] (Lars Moelleken)

Windows path fixes: ensure that the PGTStorage path has a trailing '/' [#435] (xamount)

Full Changelog: 1.6.1...1.6.2
Open source →
1.6.119 Feb 2023
Only initialize the session-storage array when values are populated (Adam Franco)
Bug Fixes:

Only initialize the session-storage array when values are populated (Adam Franco)

Autoload source/CAS.php file [#422] (Pierrick Charron)
Open source →

1.6.031 Oct 2022Security

New release addressing CVE-2022-39369 ( GHSA-8q72-6qq8-xv64 )

New release addressing CVE-2022-39369 (GHSA-8q72-6qq8-xv64)

Open source →

Additional notes

Bug Fixes:

Introduce required service_name constructor argument to fix service hostname discovery exploitation vulnerability CVE-2022-39369 (Henry Pan)
Set user agent [#421] (Fydon)

Open source →

1.5.03 May 2022

Fix undefined variables [#417] (Dawid Polak)

Bug Fixes:

Fix undefined variables [#417] (Dawid Polak)
Fix client when getting ticket and it's null [#415] (Quentin Belot)
Allow autoloader to detect trait_exists() [#394] (Jean-Luc Herren)
Use curl_setopt_array instead of loop in CurlRequest [#391] (François Freitag)

Improvement:

Disable printf when verbosity flag is not set to true [#396] (Michał Kleszczyński)
Disabling error printing based on verbosity flag [#393] (Michał Kleszczyński)
Drop php5 compatibility [#385] (François Freitag)
Upgrade phpunit [#378] (François Freitag)
Drop support for outdate php versions[#380] (François Freitag)

Open source →

1.4.030 May 2021Deprecated

Fix use of deprecated setDebug() in examples [#360] (Joachim Fritschi)

Bug Fixes:

Remove ineffective test annotations @outputBuffering [#379] (François Freitag)
Fix travis-ci build process and remove PHP5 support [#366] (Joachim Fritschi)
Fix use of deprecated setDebug() in examples [#360] (Joachim Fritschi)
Fix session_set_save_handler error [#365] (Joachim Fritschi)
Fix wrong server_port documentation [#369] (Joachim Fritschi)

Improvement:

support samesite cookies attribute (#370) (Mickael)
Remove PHP5 support [#366] (Joachim Fritschi)

Open source →

1.3.931 Jan 2021

Tag for the 1.3.9 release.

Open source →

Additional notes

Bug Fixes:

Fix regression of #248: Support of longer session tickets (#349) (Alan Nelson)
Fix private call generating php warning and no logout handling (#352) (Julien Gribonvald)

Improvement:

Add support for logging via a PSR-3 logger [#329] (Jon Dufresne)
Improve attribute handling [#317] (Tobias Schiebeck)
Prefer composer autoload over Autoload.php (Jon Dufresne)
Add Galego Language [#356] Sherwin Harris
Add Portuges Language [#358] Sherwin Harris
Accept callback with extended HTTP_ACCESS headers [#342] (Ivaylo Botyov Nikolov)
Refactor session handling [#340] (Henry Pan, Andrew Miller)

Open source →

1.3.625 Oct 2018

Updated versions for the 1.3.6 release.

Open source →

Additional notes

Security Fixes:

Fix XSS in proxy mode [#271] (Joachim Fritschi)

Bug Fixes:

Fix bad condition [#252] (Brice Vercoustre)
Hash ticket strings to generate valid-length session-ids [#224, #244, #248] (Adam Franco)
Fix "phpCAS" class capitalization in code [#273, #277] (phy25)

Improvement:

Remove fallback for __autoload [#247] (marinaglancy)
More robust check for Windows OS in File.php [#275] (xamount)
Fix continue statement within switch/case for php 7.3 compatibility [#278] (stonk7)

Open source →

1.3.510 Apr 2017

Tag for the 1.3.5 release.

Open source →

Additional notes

Security Fixes:

Fix possible authentication bypass in validateCAS20 [#228] (Gregory Boddin)

Bug Fixes:

Fix file permissions (non-executable) [#177] (Remi Collet)
Fixed translations Greek and Japanese #192
Fix errors under phpdbg [#204] (MasonM)
Fix logout replication error [#213] (Gregory Boddin)

Improvement:

Add more debug info to logout code [#95] (Joachim Fritschi)
Allow longer ticket >32 chars for PGTStorage [#130] (Joachim Fritchi)
Improved verification of supplied CA arguments [#172] (Joachim Fritschi)
Change minimum supported php version to 5.4 in documentation (Joachim Fritschi)
Add message to CAS_Authentication_Exception [#197] (Baldinof)
Ingnore composer related files and directories [#201] (greg0ire)
Add setter for cas client [#206] (greg0ire)
Add callback for attribute parsing [#205] (Gregory Boddin)
Added setter for base url [#208] (LeopardDennis)
Fix documentation of code documentation [#216] (erozqba)
Improved https detection by HTTP_X_FORWARDED_Protocol [#220] (Gregory Boddin)
Add language support for simplified chinese [#227] (phy25)

Open source →

1.3.416 Nov 2015

Mark auth call completed for post-auth callback [#131] (Daniel Frett)

Security Fixes:

Bug Fixes:

Mark auth call completed for post-auth callback [#131] (Daniel Frett)
Remove typo CAS_TypeMismatchException [#133] (Gabrijel Gavranović)
Fix SERVER_ADMIN error for alternate Webservers [#103] (Joachim Fritschi)
Fix non-strict string comparision in _isHttps check [#139] (Brandon Peters)
Fix setNoCasServerValidation for cURL 7.10 [#122] (Joachim Fritschi)
Fix renew support [#93] (Joachim Fritschi)
_getClientUrl() fixes with reverse proxies [#154] adongy
Param type doc should be 'string' in CAS::logoutWithRedirectService() [#167] Chris McCafferty
Fix broken class reference [#161] Joachim Fritschi

Improvement:

Add phpCAS::isInitialized() API method [#112] (Adam Franco)
select temporary directory based on env vars [#136) (Geoffroy Desvernay)
Add gitattributes to reduce unnecessary files from composer installs. [#141] (Jon Dufresne)
Allow cas endpoint to be a 'get url' [#146] (flushbi)
Add documentation for phpCAS::$_PHPCAS_CLIENT [#156] (Sylvain)
Improve https check [#139] (Joachim Fritschi)
Add time to trace [#158] (cwsterling)
Add php5.6 tests, move to faster docker env [#169] (Florian Holzhauer)
Introduce a setVerbose() toggle to prevent debug info leaking in production [#152 #147] (Joachim Fritschi)

Open source →

1.3.324 Jul 2014Security

CVE-2014-4172 Urlencode all tickets [#125] (Marvin Addison)

Security Fixes:

CVE-2014-4172 Urlencode all tickets [#125] (Marvin Addison)

Bug Fixes:

Fix CURL compatibility CURL >= 7.28.0 [#66] (adoy)
Commit session before redirect [#79] (kakawait)
Fix warnings for php => 5.5 [87] (fh)
Update wrong wording in examples [#90] (misilot)
Fixed bug in imap.php [#105] (echampet)
Fix missing Server_Admin variable for nginex #121
Fix error in TypeMismatchException #123
Fix bug in https test [#126] (Florent Baldino)

Improvement:

Fix grammar of documentation [#61] (frett)
Improved testability of the phpCAS client [#7] (Adam Franco)
Fixed typo [#70] (fh)
Example for improved cookie hardening [#67] (Joachim Fritschi)
Added support for X-Forwarded-Proto Header [#77] (Paul Donohue)
Added composer support [#73] (dhyde)
Travis for continuous integration [#82] (fh)
Support for X-Forwared-Port [#100] (neopeak)
Support for CAS 3.0 protocol [#116] (fredrik-w)

Open source →