apereo/phpcas

Bug Fixes:

• Compatibility with PHP 8.4 and 8.5 (Cédric Anne, Pascal Rigaux)
• CAS_PGTStorage_Db: call method with incorrect case: createTableSQL [#432] (Lars Moelleken)
• Windows path fixes: ensure that the PGTStorage path has a trailing '/' [#435] (xamount)

Full Changelog: 1.6.1...1.6.2

Bug Fixes:

• Compatibility with PHP 8.4 and 8.5 (Cédric Anne, Pascal Rigaux)
• CAS_PGTStorage_Db: call method with incorrect case: createTableSQL [#432] (Lars Moelleken)
• Windows path fixes: ensure that the PGTStorage path has a trailing '/' [#435] (xamount)

Bug Fixes:

• Only initialize the session-storage array when values are populated (Adam Franco)
• Autoload source/CAS.php file [#422] (Pierrick Charron)

New release addressing CVE-2022-39369 (GHSA-8q72-6qq8-xv64)

Bug Fixes:

• Introduce required service_name constructor argument to fix service hostname discovery exploitation vulnerability CVE-2022-39369 (Henry Pan)
• Set user agent [#421] (Fydon)

Bug Fixes:

• Fix undefined variables [#417] (Dawid Polak)
• Fix client when getting ticket and it's null [#415] (Quentin Belot)
• Allow autoloader to detect trait_exists() [#394] (Jean-Luc Herren)
• Use curl_setopt_array instead of loop in CurlRequest [#391] (François Freitag)

Improvement:

• Disable printf when verbosity flag is not set to true [#396] (Michał Kleszczyński)
• Disabling error printing based on verbosity flag [#393] (Michał Kleszczyński)
• Drop php5 compatibility [#385] (François Freitag)
• Upgrade phpunit [#378] (François Freitag)
• Drop support for outdate php versions[#380] (François Freitag)

Bug Fixes:

• Remove ineffective test annotations @outputBuffering [#379] (François Freitag)
• Fix travis-ci build process and remove PHP5 support [#366] (Joachim Fritschi)
• Fix use of deprecated setDebug() in examples [#360] (Joachim Fritschi)
• Fix session_set_save_handler error [#365] (Joachim Fritschi)
• Fix wrong server_port documentation [#369] (Joachim Fritschi)

Improvement:

• support samesite cookies attribute (#370) (Mickael)
• Remove PHP5 support [#366] (Joachim Fritschi)

Tag for the 1.3.9 release.

Bug Fixes:

• Fix regression of #248: Support of longer session tickets (#349) (Alan Nelson)
• Fix private call generating php warning and no logout handling (#352) (Julien Gribonvald)

Improvement:

• Add support for logging via a PSR-3 logger [#329] (Jon Dufresne)
• Improve attribute handling [#317] (Tobias Schiebeck)
• Prefer composer autoload over Autoload.php (Jon Dufresne)
• Add Galego Language [#356] Sherwin Harris
• Add Portuges Language [#358] Sherwin Harris
• Accept callback with extended HTTP_ACCESS headers [#342] (Ivaylo Botyov Nikolov)
• Refactor session handling [#340] (Henry Pan, Andrew Miller)

Bug Fixes:

• Fix pear package [#297] (Phil Fenstermacher)

Improvement:

• Adding support for PROXY CALLBACK using POST parameters instead of GET [#312]

Bug Fixes:

• Fix pear package [#297] (Phil Fenstermacher)

Improvement:

• add method to get list of supported protocols (#293) Julien Boulen

Updated versions for the 1.3.6 release.

Security Fixes:

• Fix XSS in proxy mode [#271] (Joachim Fritschi)

Bug Fixes:

• Fix bad condition [#252] (Brice Vercoustre)
• Hash ticket strings to generate valid-length session-ids [#224, #244, #248] (Adam Franco)
• Fix "phpCAS" class capitalization in code [#273, #277] (phy25)

Improvement:

• Remove fallback for __autoload [#247] (marinaglancy)
• More robust check for Windows OS in File.php [#275] (xamount)
• Fix continue statement within switch/case for php 7.3 compatibility [#278] (stonk7)

Tag for the 1.3.5 release.

Security Fixes:

• Fix possible authentication bypass in validateCAS20 [#228] (Gregory Boddin)

Bug Fixes:

• Fix file permissions (non-executable) [#177] (Remi Collet)
• Fixed translations Greek and Japanese #192
• Fix errors under phpdbg [#204] (MasonM)
• Fix logout replication error [#213] (Gregory Boddin)

Improvement:

• Add more debug info to logout code [#95] (Joachim Fritschi)
• Allow longer ticket >32 chars for PGTStorage [#130] (Joachim Fritchi)
• Improved verification of supplied CA arguments [#172] (Joachim Fritschi)
• Change minimum supported php version to 5.4 in documentation (Joachim Fritschi)
• Add message to CAS_Authentication_Exception [#197] (Baldinof)
• Ingnore composer related files and directories [#201] (greg0ire)
• Add setter for cas client [#206] (greg0ire)
• Add callback for attribute parsing [#205] (Gregory Boddin)
• Added setter for base url [#208] (LeopardDennis)
• Fix documentation of code documentation [#216] (erozqba)
• Improved https detection by HTTP_X_FORWARDED_Protocol [#220] (Gregory Boddin)
• Add language support for simplified chinese [#227] (phy25)

Security Fixes:

Bug Fixes:

• Mark auth call completed for post-auth callback [#131] (Daniel Frett)
• Remove typo CAS_TypeMismatchException [#133] (Gabrijel Gavranović)
• Fix SERVER_ADMIN error for alternate Webservers [#103] (Joachim Fritschi)
• Fix non-strict string comparision in _isHttps check [#139] (Brandon Peters)
• Fix setNoCasServerValidation for cURL 7.10 [#122] (Joachim Fritschi)
• Fix renew support [#93] (Joachim Fritschi)
• _getClientUrl() fixes with reverse proxies [#154] adongy
• Param type doc should be 'string' in CAS::logoutWithRedirectService() [#167] Chris McCafferty
• Fix broken class reference [#161] Joachim Fritschi

Improvement:

• Add phpCAS::isInitialized() API method [#112] (Adam Franco)
• select temporary directory based on env vars [#136) (Geoffroy Desvernay)
• Add gitattributes to reduce unnecessary files from composer installs. [#141] (Jon Dufresne)
• Allow cas endpoint to be a 'get url' [#146] (flushbi)
• Add documentation for phpCAS::$_PHPCAS_CLIENT [#156] (Sylvain)
• Improve https check [#139] (Joachim Fritschi)
• Add time to trace [#158] (cwsterling)
• Add php5.6 tests, move to faster docker env [#169] (Florian Holzhauer)
• Introduce a setVerbose() toggle to prevent debug info leaking in production [#152 #147] (Joachim Fritschi)

Security Fixes:

• CVE-2014-4172 Urlencode all tickets [#125] (Marvin Addison)

Bug Fixes:

• Fix CURL compatibility CURL >= 7.28.0 [#66] (adoy)
• Commit session before redirect [#79] (kakawait)
• Fix warnings for php => 5.5 [87] (fh)
• Update wrong wording in examples [#90] (misilot)
• Fixed bug in imap.php [#105] (echampet)
• Fix missing Server_Admin variable for nginex #121
• Fix error in TypeMismatchException #123
• Fix bug in https test [#126] (Florent Baldino)

Improvement:

• Fix grammar of documentation [#61] (frett)
• Improved testability of the phpCAS client [#7] (Adam Franco)
• Fixed typo [#70] (fh)
• Example for improved cookie hardening [#67] (Joachim Fritschi)
• Added support for X-Forwarded-Proto Header [#77] (Paul Donohue)
• Added composer support [#73] (dhyde)
• Travis for continuous integration [#82] (fh)
• Support for X-Forwared-Port [#100] (neopeak)
• Support for CAS 3.0 protocol [#116] (fredrik-w)