yiisoft/yii

https://www.yiiframework.com/news/775/yii-1-1-32-is-released

• Enh #4587: Add socket connection support to CRedisCache (mateusmetzker)
• Bug #4578: PHP 8.4 compatibility: Fix deprecation in session_set_save_handler() (efhsg)
• Bug #4573: PHP 8 compatibility: Fix deprecation warning in CArrayDataProvider (efhsg)
• Bug #4591: Fix deprecation in CCaptchaAction for PHP 8.1+ (rob006)

https://www.yiiframework.com/news/710/yii-1-1-31-is-released

• Bug #4579: Fix Czech translation for "not equal to" validation message in CCompareValidator (karelvasicek)
• Bug #4570: Fix regression in jquery-bbq introduced in Yii 1.1.30 (kevin-foster-uk)
• Bug #4584: Fix a hungarian translation (albertborsos)
• Bug: CVE-2025-32027. Prevent XSS in scenarios where fallback error renderer is used (samdark, marcovtwout)

https://www.yiiframework.com/news/669/yii-1-1-30-is-released

• Bug #4547: PHP 8 compatibility: Fix deprecation in CCaptcha when using Imagick extension (apphp)
• Bug #4541: PHP 8 compatibility: Fix deprecation in MarkdownParser (mdeweerd)
• Bug #4544: PHP 8 compatibility: Fix deprecation in CLocale (apphp)
• Bug #4566: PHP 8 compatibility: Fix passing null to string parameter parameter (apphp)
• Bug #4563: CVE-2021-20086. Prevent prototype pollution in jquert-bbq (kevin-foster-uk)
• Enh #4552: Added support for PHP 8.3 (sandippingle, ThePepster, marcovtwout)
• Enh #4559: Added support for Redis ACL authentication with username for Redis 6+ (arfeen)
• Enh #4568: Add missing hungarian translations (albertborsos)

https://www.yiiframework.com/news/587/yii-1-1-29-is-released

• Bug #4516: PHP 8 compatibility: Allow union types and intersection types in action declarations (wtommyw)
• Bug #4523: Fixed translated in Greek class messages in framework requirements view, which they should not be translated (lourdas)
• Bug #4534: PHP 8.2 compatibility: Fix deprecated dynamic properties in gii/components/Pear/Text/Diff (mdeweerd, marcovtwout)
• Bug: CVE-2023-47130. Prevent RCE when deserializing untrusted user input (ma4ter222, marcovtwout)
• Enh #4529: Exceptions thrown while loading fixture file rows now contain more details (eduardor2k)
• Enh #4533: Various refactorings applied based on PHAN checks (marcovtwout)

https://www.yiiframework.com/news/549/yii-1-1-28-is-released-and-security-support-extended

• Bug #4484: Set Last-Modified after sending cache control headers (jannis701, wtommyw)
• Bug #4491: Fixed limit and Offset not working correctly with MSSQL version 11 (2012) and newer (shnoulle, wtommyw)
• Bug #4497: PHP 8.1 compatibility: Fix unserialize null in CRedisCache (kenguest, wtommyw)
• Bug #4499: PHP 8.1 compatibility: Fix deprecation warning in COciSchema (marcovtwout)
• Bug #4500: PHP 8.1 compatibility: Fix deprecation warnings in CMysql classes (csears123)
• Bug #4507: PHP 8.1 compatibility: Fix deprecation warning in CWebUser (marcovtwout, wtommyw)
• Enh #4490: Added support for PostgreSQL 15 (sternix, marcovtwout)
• Enh #4503: Update tests and code for PHP 8.1 compatibility, stop suppressing deprecation warnings in tests (wtommyw)
• Enh #4505: Added support for PHP 8.2 (wtommyw)

https://www.yiiframework.com/news/510/yii-1-1-27-is-released

• Bug: PHP 8.1 compatibility: Fix CFileCache call of file_get_contents (Bregi)
• Bug: CVE-2022-41922. Prevent RCE when deserializing untrusted user input (fi3wey, marcovtwout)

https://www.yiiframework.com/news/495/yii-1-1-26-is-released

• Bug #4453: Alpine Linux compatibility: Avoid using GLOB_BRACE in CFileHelper::removeDirectory (ivany4)
• Enh #4386: Added support for PHP 8.1 (marcovtwout, JonathanArgentao, ivany4, csears123)
• Enh #4386: Updated HTMLPurifier to version 4.15.0 for PHP 8.1 support (https://github.com/ezyang/htmlpurifier/blob/v4.15.0/NEWS) (marcovtwout)
• Enh #4392: Added support for SSL to CRedisCache (andres101)

https://www.yiiframework.com/news/419/yii-1-1-25-is-released

• Bug #4226: Fix for Gii diff displaying "reset() expects parameter 1 to be array, integer given" (LeoZandvliet, marcovtwout)
• Bug #4369: PHP 8.0 compatibility: Fix warning "Only the first byte will be assigned to the string offset" when generating code with Gii (marcovtwout)
• Bug #4374: Fix for createUpdateCommand which did not accept just a table name when using MSSQL (c-schmitz)
• Bug #4380: Prevent fatal errors while validating CSRF token of malformed requests (rob006)
• Bug #4382: PHP 8.0 compatibility: Fix CFileLogRoute throwing TypeError when logfile cannot be opened (marcovtwout)

https://www.yiiframework.com/news/369/yii-1-1-24-is-released-and-security-support-extended

• Bug #4339: "There is no active transaction" when transaction is autocommitted (twisted1919)
• Bug #4343: Fix "driver does not support quoting" when using the driver pdo_odbc (xpohoc69)
• Bug #4355: Fix errorhandler missing backtrace entries (georaldc, marcovtwout)
• Enh #4349: Added CHtml option to omit type attribute from <script> tag (mohamedmalki, marcovtwout)
• Enh #4351: Added CHtml option to omit CDATA wrapper from <script> and <style> contents (marcovtwout)
• Enh #4354: Allow to set log file permissions for CFileLogRoute (jdayamx)
• Chg #4344: Upgraded jQuery to 1.12.4 (marcovtwout)
• Chg #4344: Upgraded jQuery UI to 1.12.1 (marcovtwout)

https://www.yiiframework.com/news/318/yii-1-1-23-is-released

• Bug #4291: The scheme (protocol) is deleted when validateIDN is enabled after validation (Argevollen)
• Bug #4306: Add PHP 8 support (samdark)
• Bug #4310: Items on memcache won't expire due to memcache difference in internal clock (nikolasr200)
• Bug #4325: Add support for unicode strings beyond the BMP (like emojies) in CJavaScript::encode() (marcovtwout)
• Bug: Fix CFileHelper::findFiles() to use correct directory separator under Windows (samdark)
• Enh #4305: PHP 7.3 compatibility: Support giving cookies a SameSite=None attribute value (tomfotherby)
• Enh #4308: PHP 7.3 compatibility: Add samesite as a session cookie option (tomfotherby)
• Enh #4314: Exceptions thrown while loading fixtures now contain details about the error location (BBoom)
• Enh #4314: Missing fixture files now throw exceptions (BBoom)
• Enh #4315: Added change triggers to clickable checkbox rows in grid views, allowing other script to react to the changed checkbox states (BBoom)
• Enh #4317: Added special option 'encode' to $htmlOptions argument in CHtml::errorSummary and CHtml::error (shidenko97)
• Enh #4323: Add PostgreSQL 12 support (bio, d4rkstar, marcovtwout)
• Chg #4293: Updated HTMLPurifier to version 4.13.0 (https://github.com/ezyang/htmlpurifier/blob/v4.13.0/NEWS) (marcovtwout)

• Bug #4256: PHP 7 compatibility: PHP4 style constructor in Pear/Text/Diff3.php (kenguest)
• Bug #4256: PHP 7 compatibility: Fixed deprecated usage of create_function() in markdown.php (samdark)
• Bug #4261: PHP 7.2 compatibility: INTL_IDNA_VARIANT_2003 has been depreacated (machour)
• Bug #4261: Updated HTMLPurifier to version 4.10.0 (https://github.com/ezyang/htmlpurifier/blob/v4.10.0/NEWS) (machour)
• Bug #4279: PHP 7.4 compatibility: Drop use of accessing string offsets using curly braces (kenguest)
• Enh #4273: PHP 7.3 compatibility: Add "sameSite" support for cookies (thekonz)

• Bug #4220: Fixed PHP 7.2 incompatibility caused by the use of create_function in CHttpRequest and CProfileLogRoute (martinpetrasch, freezy-sk)
• Bug #4227: Fixed PHPUnit 6 compatibility (gianniszach)
• Bug #4229: Remove deprecation errors from framework/web/js/source/jquery.yiiactiveform.js when using jQuery 3.1.1 (kenguest)
• Bug #4234: CVE-2018-14773. Drop support for HTTP_X_REWRITE_URL (kenguest)
• Bug #4238: Fixed intolerance to nulls in CJavaScript::quote() (stevoh6, ddziaduch)
• Chg #4236: Freeze session before changing ini settings to be compatible with PHP 7.2 (vxk7m)

• Bug #4162: Adjusted Zend Escaper to be compatible with PHP <5.3 and fixed usage of non-existing Exceptions (cebe)
• Bug #4167: Fixed PHP 7.2 incompatibility of "count()" in CActiveFinder and CController::renderDynamic() (softark, ThePepster)
• Bug #4168: Fixed CDbHttpSession PHP 7.1 compatibility (csears123)
• Bug #4179: Fixed MariaDB 10.2 current_timestamp() (yaBliznyk)
• Bug #4182: CSecurityManager requires mcrypt extension to work, and for PHP 7.2 we need to install it from pecl (sergey-dryabzhinsky)
• Bug #4191: Fixed "Headers already sent." error in CHttpSession (daniel1302)
• Bug #4191: Fixed "CHtml::value() behaves differently for objects" for PHP 7.2 (daniel1302)
• Bug #4197: Fixed PHP 7.2 assert with string argument is deprecated warning using Gii (ThePepster)
• Bug #4198: Fixed PHP 7.2 SQLSRV lastInsertId (agusdrs)
• Bug #4203: Fixed CHttpCacheFilter::sendCacheControlHeader PHP 7.2 compatibility (b1rdex)
• Enh #4191: Added option for filter classes loaded by YiiBase autoloader (daniel1302)
• Chg #4160: Updated HTMLPurifier to version 4.9.3 (takobell)

• Bug #4155: Ignore PHP 7.1 warnings about deprecated mcrypt (samdark)
• Bug #4156: Timeout in checkMxPorts of mail validator is now configurable (kenguest, samdark)
• Enh: Fixed PHPUnit 6 compatibility (samdark)
• Enh: Reworked model error escaping to escape on output rather than in validators directly (Zaffy, samdark)

• Bug #4004: Better fix for PostgreSQL Session storage (GuillaumeSmaha)
• Bug #4015: Fixed bug with missing "disabled" attribute in internally rendered hidden fields (rob006)
• Bug #4020: Fixed PHP 7 related bug in CCacheHttpSession when destroying not cached sessions (dirx)
• Bug #4034: Fixed CHttpSession::getIsStarted() PHP 7 compatibility (tomotomo)
• Bug #4043: Fixed CJavaScript::quote() to properly escape Unicode characters (samdark)
• Bug #4061: Fixed "Fatal Error: Nesting level too deep - recursive dependency" error in CArrayDataProvider (kf99916, andrewnester)
• Bug #4064: Fixed CHtml::beginForm which produced wrong HTML when using an anchor in the action URL of a GET form (Mytskine)
• Bug #4069: Fixed error with eCRedisCache::executeCommand() when the previous connection timeout exception was catched (taobig)
• Bug #4104: Fixed PHP 7 compatibiltiy in Text_Highlighter (samdark)
• Bug #4111: Fixed PHP 7.1 incompatibility with CFileCache when $embedExpiry=false (cebe)
• Bug #4130: Fixed PHP 7 added an interception of the ParseError exception for the eval() usage (devcommiter)
• Bug #4133: Fixed PHP 7 usage of the func_get_args() functions in YiiBase.php (devcommiter)
• Enh #2819: backported masking of CSRF tokens from Yii 2.0 (samdark)
• Enh #4049: Added '//' as a proper beginning of absolute URL in createAbsoluteUrl() method (ksowa)
• Enh #4075: Added CClientScript::hasPackage() (samdark)
• Chg #4033: Updated Pear/Text used by Gii so it's PHP 7 compatible (samdark)
• Chg #4103: Updated HTMLPurifier to version 4.9.2 (samdark)
• Chg: Updated Text_Highlighter to version 0.7.3 (samdark)
• Chg: Fixed PHP 7.1 incompatibility in Text_Highlighter (cebe)

• Bug #1191: Fixed undefined index in CListIterator when data removed in parent CList (steven-hadfield)
• Bug #2881: CGridView was blocking refresh on filter field change event after previous filtering using ENTER key (sivir)
• Bug #2921: Fixed CStatePersister read/write concurrency issue causing state data corruption (matteosistisette, samdark)
• Bug #2993: Fixed MySQL datetime fields can have default CURRENT_TIMESTAMP (tomvdp)
• Bug #3144: Fixed regression introduced in 1.1.16, whitespace before and after attributes in validation rules where not ignored (cebe)
• Bug #3458: Fixed CGridView with enableHistory breaks queries containing '&' characters (nkovacs)
• Bug #3476: Database sessions with Postgres did not work properly (c-schmitz)
• Bug #3497: CErrorHandler messages for HTTP response codes were not matching RFCs (TeMPOraL)
• Bug #3637: Fixed not quoting primary key in count statements (applee)
• Bug #3696: Fixed broken case insensitiveness for Active Record count expressions introduced with fixed #268 (xt99)
• Bug #3700: Undefined variable $acceptedLanguage in CHttpRequest::getPreferredLanguage() (cebe, ddebin)
• Bug #3704: Fixed CSecurityManager to work properly is case cryptAlgorithm specified as array (samdark)
• Bug #3715: CSecurityManager::legacyDecrypt in version 1.1.16 was not compatible with 1.1.15 method (DanaLuther)
• Bug #3724: Fixed namespace prefix in WSDL generator for arrayType. (ametad)
• Bug #3757: Fixed regression in 1.1.16 CPgsqlSchema::dropIndex() (samdark)
• Bug #3764: Fixed regression in 1.1.16, CEmailValidator::validateValue() should not allow empty values to pass (cebe)
• Bug #3833: Fixed CHttpRequest::sendFile() range support in case mbstring.internal_encoding=UTF-8 (MonkeyMaster)
• Bug #3869: jQuery Yii GridView now doesn't fail when refreshing grid via POST request (a-t)
• Bug #3879: Numeric labels in CBreadCrumbs reindex after using array_merge (AloneCoder)
• Bug #3890: Ensured forward compatibility of CWebService::getMethodName() (samdark)
• Bug #3947: Fix error with array_diff when one of CDbCriteria->select contains "false" (askobara, cebe)
• Bug #3974: Fixed warning when request parameter contains array (cmazx)
• Bug #3976: Fixed MSSQL command builderto comply with the DELETE command syntax (odalecne)
• Bug #3980: Fixed CRedisCache error when using mbstring.func_overload and UTF-8 as mbstring.internal_encoding (Lexx918)
• Enh #2399: It is now possible to use table names containing spaces by introducing alias (devivan)
• Enh #3457: CHttpRequest can now detect content type and decode JSON in REST method bodies. (Sibilino)
• Enh #3686: Wrapper div of hidden fields in CForm now have style display:none instead of visibility:hidden to not affect the layout (cebe, alaabadran)
• Enh #3738: It is now possible to override the value of 'required' html option in CHtml::activeLabelEx() (matteosistisette)
• Enh #3812: Added 'validateValue' method to 'CBooleanValidator' class (UA2004)
• Enh #3827: Added the $options parameter to be used in stream_socket_client in CRedisCache.
• Enh #3872: Added database-based StatePersister implementation (AloneCoder)
• Enh #3948: Enhanced CHttpRequest path info extraction for compatibility with PHP 7 (dmitrivereshchagin)
• Enh #3949: Added $overwriteAll argument to CConsoleCommand::copyFiles() which can be set to true in noninteractive commands (dmitrivereshchagin)
• Enh #3995: CAuthManager is now able to silence errors when using PHP 7 (samdark)
• Enh #3998: Improved PHP 7 compatibility for CTimestampBehavior and CChoiceFormat, and for Travis CI (softark)
• Enh: CApcCache is now able to handle PHP 7 APCu (samdark)
• Chg #3776: Autoloader now doesn't error in case of non-existing namespaced classes so other autoloaders have chance to handle these (alexandernst)

• Bug #264: Fixed wrong timestamp precision value in postgres schema (nineinchnick)
• Bug #268: Fixed Active Record count error when some field name starting from 'count' (nineinchnick)
• Bug #788: createIndex is not using the recommended way to create unique indexes on Postgres (nineinchnick)
• Bug #1257: CFileValidator is no longer unsafe by default to prevent setting arbitrary values. Instead, when no file is uploaded attribute is set to null (marcovtwout)
• Bug #1635: CDateFormatter::format() with 'ZZZZZ' pattern used to return timezone in RFC 822 format, now returns in ISO 8601 format as it stated in CLDR (resurtm)
• Bug #2235: CPgsqlColumnSchema can't parse default value for numeric field (cebe, pavimus)
• Bug #2376: CHttpSession::regenerateID() now checks if session is started before regenerating session ID (samdark)
• Bug #2378: CActiveRecord::tableName() in namespaced model returned fully qualified class name (velosipedist, cebe)
• Bug #2519: CGridView and CListView fixed to be able handling special characters if history is enabled (klimov-paul)
• Bug #2594: CLogRouter::processLogs() now ensures to clear the Logger messages so nothing is logged twice when method is called multiple times (cebe)
• Bug #2654: Allow CDbCommand to compose queries without 'from' clause (klimov-paul)
• Bug #2658: CBaseListView, CGridView, CListView: added note about $itemsCssClass and $pagerCssClass properties, they must not contain empty string, null or false values (resurtm)
• Bug #2969: CPgsqlSchema::addColumn() converts column type twice (cebe, klimov-paul)
• Bug #2741: Updated CHtml to add maxlength support to all HTML5 fields (ggirtsou)
• Bug #2753: Fixed CErrorHandler::errorAction ignored if error occurs while AJAX request (klimov-paul)
• Bug #2756: Fixed applying condition twice during Active Record relation lazy loading (klimov-paul)
• Bug #2770: Fixed CClientScript renders scripts with different HTML options inside same tag (klimov-paul)
• Bug #2778: Fixed throwing unnecessary exception in CFileValidator when validating MIME types for a file upload that failed (Rupert-RR)
• Bug #2785: Use table name with schema in composeMultipleInsertCommand (nineinchnick)
• Bug #2836: Fixed rendering when try-catching widget Exception while 'captureOutput' is set to true (darkheir)
• Bug #2845: Fixed 1.1.14 regression affecting non-strict comparison in CRangeValidator validator (samdark)
• Bug #2855: Fixed issue with Component::__call() and normal properties holding a Closure (cebe)
• Bug #2862: Fixed array_merge caused renumbering of $data indexes in CHtml::radioButtonList() (ligser)
• Bug #2864: Fixed CGridView ajax calls failing CSRF validation when ajaxType is set to POST (nineinchnick)
• Bug #2874: Fixed duplicate columns selection for HAS_MANY relation with composite primary key (borro)
• Bug #2876: Fixed single quotes in comments column causes syntax error in model code generated by Gii(klimov-paul)
• Bug #2884: Fixed problem with table alias in CActiveRecord that has been introduced in 1.1.14 (cebe)
• Bug #2887: Fixed CFormElement is missing __isset() (bijibox)
• Bug #2912: Add options parameter to CListView beforeAjaxUpdate (spikyjt)
• Bug #2917: Restored ability to overwrite module alias via application config which was broken in 1.1.14 (klimov-paul)
• Bug #2944: Fixed CDbCriteria fails to merge limit when it is 0 (softark)
• Bug #2945: Fixed CUrlRule escapes dot (.) symbol on parsing (qiangxue)
• Bug #2959: Fixed CFileValidator to encode file name, while composing error messages (klimov-paul)
• Bug #2963: CAssetManager::generatePath no longer uses basename for hasing (eirikhm)
• Bug #2970: Fixed Active Record may join same relation twice on eager loading. (klimov-paul)
• Bug #3010: Problem with callables given as values to CDetailView. CDetailView now only allows annonymous functions to be called, all other values will be taken as value (cebe)
• Bug #3064: Fixed problem with array to string converion in CDbMigration methods that accept array parameters (cebe)
• Bug #3055: CAction::runWithParams() now returns consistent result even if called without parameters (cebe)
• Bug #3087: Fixed crash on cookie validation when switching between enabling and disabling validation (cebe)
• Bug #3113: Fixed problems with realpath(false) which can occur in combination with Yii::getPathOfAlias() when alias does not exist (cebe)
• Bug #3134: Fixed the issue that query cache returns the same data for the same SQL but different query methods (qiangxue)
• Bug #3144: It wasn't possible to use attributes with spaces in validation rules (samdark)
• Bug #3179: Fixed a bug with CBreadcrumbs widget and homelink that did not use activeLinkTemplate property (mbdwey, cebe)
• Bug #3206: Quote table names in CDbMessageSource::loadMessagesFromDb (nkovacs)
• Bug #3233: Gii now allows base classes with absolute namespace as well, not only relative ones (etienneq)
• Bug #3242: Removed display:none on form hidden fields (mahadazad)
• Bug #3283: Fixed CEmailValidator to validate empty value (nukkumatti)
• Bug #3288: Check if PHPUnit_Runner_Version exists before requiring (hjellek)
• Bug #3302: CActiveForm::error() fixed to respect 'hideErrorMessage' option on regular render (klimov-paul)
• Bug #3305: COciSchema column comment reading from another schema (gureedo)
• Bug #3321: Clear stat cache after rotating log files so later file size check is not cached (cebe, jjdunn)
• Bug #3327: Gii did not generate empty directories properly (gureedo)
• Bug #3406: Fixed Object of class Imagick could not be converted to string (eXprojects)
• Bug #3410: Fixed wrong translation parameter name in CPhpAuthManager::addItemChild() (klimov-paul)
• Bug #3569: CConsoleCommand::copyFiles() did not replace DIRECTORY_SEPARATOR correctly (jmxhit)
• Bug #3582: make sure build autoload produces the same output on both Windows and Unix platforms (GerHobbelt)
• Bug: Fixed the bug that backslashes are not escaped by CDbCommandBuilder::buildSearchCondition() (qiangxue)
• Bug: Fixed URL parsing so it's now properly giving 404 for URLs like "http://example.com//////site/about/////" (samdark)
• Bug: Fixed an issue with CFilehelper and not accessable directories which resulted in endless loop (cebe)
• Bug: CSecurityManager encryption and string comparison were enhanced (sarciszewski, Jan Ewald, tom--, ircmaxell, qiangxue, samdark)
• Enh: Public method CFileHelper::createDirectory() has been added (klimov-paul)
• Enh: Added proper handling and support of the symlinked directories in CFileHelper::removeDirectory(), added $options parameter in CFileHelper::removeDirectory() (resurtm)
• Enh #89: Support for SOAP headers in WSDL generator (nineinchnick)
• Enh #94: Web services: Implement document/literal encoding for WDSL (nineinchnick)
• Enh #106: Added getters to CGridColumn to allow getting cell contents for extended use cases of CGridView (cebe)
• Enh #132: Added ODBC support in CDbConnection (nineinchnick, resurtm)
• Enh #182: CSort: allow arrays in asc/desc keys of virtual attributes (nineinchnick)
• Enh #640: Introduce bigpk and bigint column types in each class extending CDbSchema (nineinchnick)
• Enh #873: CStatRelation (CActiveRecord::STAT) now supports scopes (resurtm, klimov-paul)
• Enh #1372: CDbCommandBuilder::createMultipleInsertCommand() now throws exception if data array is empty (cebe)
• Enh #1515: Post-JOIN operations (use|force|ignore index()) support in relational queries (KonovalovMaxim, resurtm)
• Enh #1593: Allow access to exception currently processed by CErrorHandler (klimov-paul)
• Enh #1893: Added Schema and native connection support for the CUBRID DBMS (https://www.cubrid.org/) (kadishmal)
• Enh #2119: add y pattern to CDateTimeParser (mrpelle)
• Enh #2540: Enable CJSON to use JsonSerializable interface when serializing objects (sammousa)
• Enh #2630: CLinkPager $nextPageLabel, $prevPageLabel, $firstPageLabel and $lastPageLabel can now be false to disable the buttons (index0h)
• Enh #2640: Enable diff on gii generated SQL files (1allen)
• Enh #2664: Added support for HTTP PATCH requests to CHttpRequest (cebe)
• Enh #2683: Application views generated by webapp command are now using HTML5 by default (cebe)
• Enh #2688: CHtml::beginForm() now supports additional HTTP methods, via a hidden _method field. (phpnode)
• Enh #2722: CFileHelper::findFiles() accepts absolutePaths in $options and returns absolute paths if true or relative ones otherwise (defaults to true) (pavel-voronin)
• Enh #2734: Request::getPreferredLanguage() is now able to select a best matching between supported and requested languages (zvirusz)
• Enh #2737: CFileCache: added cachePathMode and cacheFileMode options to set modes used by chmod() for cache directory and files (ujovlado)
• Enh #2758: Updated phpdoc in blog demo to match current IDE supported syntax (samdark)
• Enh #2777: Allow Yii::import() and Yii::createComponent() to import classes that are loaded by other autoloaders e.g. composer (cebe)
• Enh #2791: requirements/index.php: added CRYPT_BLOWFISH check for CPasswordHelper (tom--)
• Enh #2799: Add HTML5 input support for color, datetime, datetime-local, week and search to CHtml and CActiveForm (phpnode)
• Enh #2817: Allow specifying $colums and $refColumns arguments as array in various CDbSchema methods (mynameiszanders, samdark)
• Enh #2850: Parameter 'id' added for 'ajaxUpdateError' js function at 'CListView' and 'CGridView' (klimov-paul)
• Enh #2851: Improved Mime-Type detection by using the mime.types file from apache http project to dected mime types by file extension (cebe, pavel-voronin, trejder)
• Enh #2852: Refactored ShellCommand to be easier to extend (samdark, mindplay-dk)
• Enh #2908: Add insertMultiple to Migrations (luislobo)
• Enh #3014: Allow changing the database used by ActiveRecord in beforeCount() like it is possible in beforeFind() already (cebe)
• Enh #3023: Added support for formatting DateTime instances to CFormatter (cebe, nitso)
• Enh #3027: Added custom encodeLabel attributes of the CMenu items (hugeval)
• Enh #3048: CApcCache is now compatible with APCu (iobotis, samdark)
• Enh #3049: 'cli' mode detection at CConsoleApplication improved (klimov-paul)
• Enh #3061: 'jquery.yiiGridView' and 'jquery.yiiListView' allows to handle all update options via history state data (klimov-paul)
• Enh #3068: Added CDbCommand::naturalLeftJoin() and CDbCommand::naturalRightJoin() (bunchachis)
• Enh #3115: Updated phpdoc for better code completion in modern IDEs (samdark)
• Enh #3147: Updated Request::getIsSecureConnection() to work with lower and uppercase config values (cebe)
• Enh #3156: It is now possible to override the models PK using primaryKey() method, even if the table defines one (drLev)
• Enh #3182: Added namespace support for controllers in subdirectories (Ekstazi, samdark)
• Enh #3202: Adding support for the X-HTTP-Method-Override header in CHttpRequest (pawzar)
• Enh #3211: Added support for PHPUnit 3.8+ in the bootstrap (JoelMarcey, samdark)
• Enh #3222: 'summaryTagName' and 'emptyCssClass' options added to CBaseListView (klimov-paul)
• Enh #3225: Added CForm::errorSummaryHeader and CForm::errorSummaryFooter, used like in CActiveForm::errorSummary() (rawtaz)
• Enh #3228: Added an ability to migrate to the certain time (gorcer, resurtm)
• Enh #3277: CHtml::checkBoxList and radioButtonList to take into account closeSingleTag for <br> (hwmaier)
• Enh #3307: Adding attribute localeClass to CApplication (pawzar)
• Enh #3314: Removed async from special attribute list enabling async=false for scripts (wilwade)
• Enh #3324: Added syslog log route (miramir, resurtm)
• Enh #3346: Added fileHeader option to MessageCommand (mbdwey)
• Enh #3349: Added errorCallback to CActiveForm::$clientOptions (rusalex)
• Enh #3351: Allow array attribute for CFileValidator even if maxFiles is not > 1 (cebe)
• Enh #3359: Added merge parameter to CModule::setModules (KJLJon)
• Enh #3391: Exception and log for not existed ClientScript package (rusalex)
• Enh #3500: Framework now responds with HTTP protocol version requested (samdark)
• Enh #3513: Added 'getExtensionByMimeType' method to CFileHelper class (UA2004)
• Enh #3533: Added Yii and YiiBase classes to composer autoloader (sammousa)
• Enh #3571: Extracted rendering of data cell in CGridView.renderTableRow() to separate method for extensibility (hijarian)
• Enh #3623: itemscope attribute is now rendered as HTML5 boolean (vercotux)
• Chg #2025: Upgraded jQuery to 1.11.1 (marcovtwout)
• Chg #3042: CPasswordHelper::generateSalt() now returns salt with $2y$ cost (samdark)
• Chg #3137: Upgraded HTMLPurifier to 4.6.0 (samdark)
• Chg #3298: ListView and GridView: Added check for the existence of a href attribute in link pager (dutchakdev)
• Chg #3464: Updated multifile plugin used by CMultiFileUpload to version 1.48 (samdark)
• Chg #3636: Upgraded jQuery UI to 1.11.2 (marcovtwout)
• Chg: Updated the i18n data bundled with the framework to CLDR23.1 https://unicode.org/Public/cldr/23.1/ this adds new locales and has many fixes and additional data for existing ones (cebe, dralshehri)
• New #2955: Added official support for MariaDB (cebe, DaSourcerer)

• Bug (CVE-2014-4672): CDetailView may be exploited to allow executing arbitrary PHP script on the server (cebe, qiangxue)

• Added AR post-JOIN operations
• Added ODBC connection related note

• Bug: There was unnecessary echo in CRUD views generated by Gii (samdark)
• Bug: CJavaScript::encode was formatting floats in a wrong way during encoding (samdark)
• Bug: Fixed minLength and maxLength range check in CCaptchaAction::generateVerifyCode so values are now always stay in bounds (samdark)
• Bug #101: CActiveFinder::buildJoinTree() no longer uses 'false' for 'select' value (klimov-paul)
• Bug #135: Fixed wrong CActiveRecord rows count with having (klimov-paul)
• Bug #139: Fixed Active Record lazy load through relation with condition (klimov-paul)
• Bug #150: Fixed CWidget was not switching between view paths when using themes (antoncpu)
• Bug #159: CUploadedFile::getInstancesByName() has been fixed allowing correct fetching files, which name is a part of other file name (klimov-paul)
• Bug #196: CActiveForm: models list whose errors should be displayed in error summary is now customizable when using AJAX validation (resurtm)
• Bug #662: Fixed incorrect Active Record lazy loading of relation through BELONGS_TO relation (klimov-paul)
• Bug #1464: Fixed transparent background for ImageMagick in CCaptchaAction (manuel-84, cebe)
• Bug #1669: CNumberValidator used to add wrong error messages in case non-numeric values being validated (resurtm)
• Bug #1692: CWebUser::renewCookie() and CWebUser::restoreFromCookie() now make use of the identityCookie options (f10i)
• Bug #1693: Fixed log file will rotate twice when high performance (monque)
• Bug #1724: Allow CClientScript registering scripts and script files with the HTML options (klimov-paul)
• Bug #1732: CWebLogRoute and CProfileLogRoute with enabled $showInFireBug: fixed bug related to JS console object in MSIE 8 and 9 (resurtm)
• Bug #1763: CSqlDataProvider was appending another ORDER BY string to an existing ORDER BY statement when using fieldname with dot (szako)
• Bug #1827: Gii wasn't properly handling table name with the schema part for PostgreSQL (resurtm)
• Bug #1895: Fixed erroneous language attributes in french views (located at framework\views\fr) (Ragazzo)
• Bug #1909: CGridView::$filterSelector now prevents default action after event has completed by returning false result in event handler function (matih)
• Bug #1911: MigrateCommand does not rely on cached value about migration table existance anymore as this info could be outdated in testing enviroment (cebe)
• Bug #1915: CDataProviderIterator: fixed init in case of disabled pagination (antoncpu)
• Bug #1916: CMssqlSchema::findColumns() issues an "invalid object name" error (resurtm)
• Bug #1924: CLogFilter::$dumper added: this property can be used to get around circular reference issue when using standard var_export dumper by changing it to print_r (resurtm)
• Bug #1933: fixed using "multiple" parameter with a value of false in CHtml::activeDropDownList, CHtml::ListBox and CHtml::DropDownList (adminnu)
• Bug #1941: yiiactiveform.js form reset now uses CHtml::errorCss instead of a hardcoded value (mdomba)
• Bug #1942: CActiveForm client/ajax validation will now remove error class from server side validation (mdomba)
• Bug #1945: Reference to undefined variable $column in CDbMigration::dropPrimaryKey (paystey)
• Bug #1955: Some validators used to cause warnings or errors in case non-scalar array typed values being checked (resurtm)
• Bug #1957: Add primary key support for MySQL schema (paystey)
• Bug #1984: CDbMigration: fix of undeclared variable usage in debug information in dropPrimaryKey (papulovskiy)
• Bug #1990: CDateFormatter::formatWeekInMonth(): incorrect result for a week which was last in a previous year and first in a next year simultaneously (resurtm)
• Bug #1996: Using yiic help for commands with parameters with array as default value resulted in PHP error with latest PHP versions (dInGd0nG, samdark)
• Bug #1997: Cache key in CGettextMessageSource::loadMessages wasn't specific enough (odevyatkov)
• Bug #2023: CHttpRequest::stripSlashes() now modifies array keys as well (etienneq)
• Bug #2030: Fixed problem with MySQL 4.x: Undefined Index: Comment in CMysqlSchema (cebe)
• Bug #2048: AR now uses alias from CActiveRecord::getTableAlias instead of always using default "t" (s-larionov)
• Bug #2049: CStatElement relation with join option throw exception when key-field present on joined table (Yiivgeny)
• Bug #2078: Fixed problem with "undefined" parameter in query string when using CListView or CGridView with enableHistory (Parpaing)
• Bug #2086: Fixed .hgignore rule for assets folder (GeXu3, Koduc)
• Bug #2087: CLocale: getLocaleDisplayName() was only returning the language display name, not the full locale display name (brandonkelly)
• Bug #2112: Fixed broken yiic shell CRUD command (mbischof)
• Bug #2121: CMssqlSchema::resetSequence() incorrectly resets sequence (resurtm, joewoodhouse)
• Bug #2122: CActiveRecord, lazy load: 'params' from relations used in 'through' option were not applied to the final SQL statement (resurtm)
• Bug #2123: Fixed error in plural rules handling if locale has no plural rules defined (cebe, stepanselyuk)
• Bug #2146: CEmailValidator fix when fsockopen() can output uncatched error 'Connection refused (61)' (armab)
• Bug #2159: Fixed SQL syntax for delete command with join in MySQL (serebrov)
• Bug #2184: CDbHttpSession now supports MS SQL Server BLOB data type (cheuschober, resurtm)
• Bug #2201: Cannot use "having" with bound params in CActiveRecord::count() (ivokund)
• Bug #2216: CDbCommandBuilder::createInCondition() has been updated, allowing to pass array of values with mixed keys for the single type column (klimov-paul)
• Bug #2223: CActiveForm::error does not respect CHtml::$errorMessageCss (ivokund)
• Bug #2239: Fixed CHtml::refresh() method to use proper syntax (mdomba)
• Bug #2241: COciSchema::resetSequence() now works the same way as the same methods for the other RDMBSes. PHPDocs of the CMssqlSchema::resetSequence(), CMysqlSchema::resetSequence(), CPgsqlSchema::resetSequence(), COciSchema::resetSequence() and CSqliteSchema::resetSequence() methods have been adjusted to fit their real functionality (resurtm)
• Bug #2244: MessageCommand has been updated, allowing to merge string with value '0' correctly (klimov-paul)
• Bug #2258: CJuiSliderInput didn't support string typed 'range' option (bookin)
• Bug #2283: Gii Model Generator's tooltips are not working and always invisible (resurtm)
• Bug #2289: CDbCacheDependency with reuseDependentData did not invalidate cache when getting cache across different requests (marcovtwout)
• Bug #2299: CMssqlSchema: findTableNames(), getTables() and getTableNames() methods used to prepend schema prefix to the table names twice (resurtm)
• Bug #2311: Fixed SQlite default value for timestamp CURRENT_TIMESTAMP (zeeke)
• Bug #2321: CGettextPoFile is now able to parse multiline msgid and msgstr declarations (resurtm)
• Bug #2325: Fixed UTF-8 troubles in CDateTimeParser (error in parsing chinese and thai dates) (s-larionov)
• Bug #2336: PostgreSQL: CDbCommandBuilder used NULL instead of DEFAULT as default value for the primary keys of serial type (resurtm)
• Bug #2368: Reset error CSS for ':input', which includes SELECT elements (blueyed)
• Bug #2398: Fixed 'Undefined variable: results' E_NOTICE at CProfileLogRoute (klimov-paul)
• Bug #2402: Fixed clientValidation incorrectly rendered as HTML attribute, when used in CActiveForm::error() (mdomba)
• Bug #2406: CUrlManager::$urlRuleClass now supports path alias value (as it was described in its PHPDoc before this fix) (resurtm)
• Bug #2423: Fixed CHtml::button() enforces "value" attribute for the image buttons (klimov-paul)
• Bug #2426: CDbCriteria::__wakeup() used to issue an error in case SQL containing fields were arrays and criteria parameters were specified (resurtm)
• Bug #2438: CViewAction now checks if requested view is a string to not fail when array was given (cebe)
• Bug #2449: CSqlDataProvider causes an error when CDbCommand with enabled PDO::FETCH_OBJ mode used as SQL source (resurtm)
• Bug #2454: Fix CMysqlColumnSchema::extractLimit for ENUM values containing comma (blueyed)
• Bug #2491: Prevent SQL exception being thrown when inserting a row into the session table whilst regenerating the session ID (mynameiszanders)
• Bug #2502: Fix match controller in access rule, match uniqueId instead id (slavcodev)
• Bug #2508: Fix CHtml::activeLabel() to resolve attribute input name for tabular input with custom 'for' (klimov-paul)
• Bug #2516: Fixed the bug that some $.fn.yiiGridView methods were not working always if a custom CGridView::template was used (buakos)
• Bug #2524: Fixed incorrect HTTPS detection (resurtm)
• Bug #2551: CWebUser::loginRequired() AJAX response now properly sends 403 (creocoder)
• Bug #2554: Fixed CRangeValidator when allowEmpty is false (samdark, creocoder)
• Bug #2565: CCaptchaAction in ImageMagick mode used to issue an exception in case $backColor or $foreColor have had leading zeros (resurtm)
• Bug #2581: Fixed the bug with empty ajaxVar in jquery.yiilistview.js and jquery.yiigridview.js (seregagl)
• Bug #2602: CUrlValidator and CEmailValidator now works correctly with display_errors = on and validateIDN = true (creocoder)
• Bug #2662: CLocale::getTerritory() used to return null value even for proper input values, bug fix #1622 made in 1.1.13 has been reverted (resurtm)
• Bug #2632: Fixed inability import non-build aliases by config on some case (Yiivgeny)
• Bug #2651: CHttpSession was using hardcoded GC probability/divisor values (marcovtwout, cebe, samdark)
• Enh: Better CFileLogRoute performance (Qiang, samdark)
• Enh: Refactored CHttpRequest::getDelete and CHttpRequest::getPut not to use _restParams directly (samdark)
• Enh #100: CLogFilter::$logVars can now be array of arrays intended for designating particular items of the $GLOBALS (resurtm, tomtomsen)
• Enh #129: Proper support of namespaced models in forms (LastDragon-ru, Ekstazi, pgaultier)
• Enh #169: Allow to set AJAX request type for CListView and CGridView (klimov-paul)
• Enh #289: Gii module could be submodule of an another module (resurtm)
• Enh #315: COciSchema::checkIntegrity() method added: allows to toggle integrity check (resurtm)
• Enh #755: Allow to get currently running command from CConsoleApplication (klimov-paul)
• Enh #1065: CJuiSliderInput now supports ranged slider when using it without model (resurtm)
• Enh #1142: CSecurityManager::computeHMAC() has been made public (resurtm)
• Enh #1353: Added onBeforeCount event to CActiveRecord (jakob-stoeck)
• Enh #1391: CDetailView: callables (including anonymous functions for PHP 5.3+) could be used as value generators of the attributes (resurtm)
• Enh #1447: CSqliteSchema: added enabling/disabling integrity check for sqlite (gleb-sternharz, resurtm)
• Enh #1589: Added HTTP range responses support to CHttpRequest::sendFile (Ragazzo, samdark)
• Enh #1604: Added method CDbCommandBuilder::createMultipleInsertCommand() to support multiple insertion (klimov-paul)
• Enh #1725: Added CFileHelper::removeDirectory() static method (resurtm)
• Enh #1743: Added CActiveForm::searchField() and CHtml::activeSearchField() to create HTML input field of type SEARCH (njasm)
• Enh #1794: Added ability to change widget ID via $htmlOptions['id'] array item in: CTabView, CBaseListView, CListView, CGridView, CDetailView, CMenu, and CPortlet (umrs)
• Enh #1796: Separate count criteria has been added to the CActiveDataProvider, it's useful for the counting queries simplification (resurtm)
• Enh #1818: Created a CLocalizedFormatter application component that allows formatting values according to current locale (cebe)
• Enh #1842: Added support for MySQL BIT(M) data type default values (migelsabre, cebe)
• Enh #1847: Added COutputCache::varyByLanguage to generate separate cache for different languages (Obramko)
• Enh #1863: Added CActiveFinder::getModel, added CActiveRecord::getActiveFinder, CExistValidator::getModel, CUniqueValidator::getModel, CActiveDataProvider::getModel, CSort::getModel (denisarius, samdark)
• Enh #1928: Gii is now able to use table columns' comments as the attribute labels of a new generated model (resurtm, tlikai)
• Enh #1948: Tidy up and improve html5 input support in CHtml and CActiveForm (phpnode)
• Enh #1977: CFormatter::normalizeDateValue() now is protected instead of private to enable child classes to override it (etienneq)
• Enh #2003: Gii now allows namespaced base classes to be defined in generators (etienneq)
• Enh #2038: CFormatter::formatNtext() method can replace newlines with <p></p> not just with <br /> as it was before (resurtm)
• Enh #2053: CPasswordHelper has been refactored, CSecurityManager has been enhanced and is now able to generate cryptographically strong random bytes and strings (resurtm, tom--, ekerazha, samdark)
• Enh #2062: CWsdlGenerator now supports soap indicators (sequence, choice), injecting of custom WSDL string block and generation of human-friendly documentation for complex types. Added unit test. (lubosdz)
• Enh #2090: Allow passing array of columns to CDbSchema::addPrimaryKey() (paystey)
• Enh #2096: CAPTCHA: non-free Duality.ttf font replaced by open/free SpicyRice.ttf (licensed under SIL OFL v1.1) (resurtm)
• Enh #2131: Added Accept header parsing to CHttpRequest to give an array of accepted types in order of preference (Rupert-RR)
• Enh #2135: MessageCommand can now handles Yii::t() messages with files in subfolders (firsyura)
• Enh #2205: CActiveForm::error() now depends on CHtml::$errorContainerTag (malyshev)
• Enh #2213: Added comment with hint on ajax validaton which may lead to duplicate entries in the database to gii form template (elmig, cebe)
• Enh #2217: Support of the empty option for CHtml::radioButtonList() has been introduced (resurtm)
• Enh #2254: CForm::$showErrors property has been added, it controls whether error elements of the form attributes should be rendered (resurtm)
• Enh #2275: Added primary log rotation by copy and truncate to CFileLogRoute (bdstevens)
• Enh #2415: Cancel current ajax request before create a new one in CGridView and CListView (gusnips)
• Enh #2416: Avoid instantiating HTMLPurifier on each CHtmlPurifier::purify() call. Allow to pass array as argument of CHtmlPurifier::purify() (twisted1919)
• Enh #2435: CFileCache entry expiration time could now be embedded into the cache file instead of changing file's modification time to be in future (resurtm)
• Enh #2459: Absolute session timeout in CWebUser (ivokund)
• Enh #2494: Allow to configure CBaseListView emptyText container tag name (ifdattic)
• Enh #2529: Silenced all chmod calls to prevent "chmod() operation not allowed" error on NTFS (samdark)
• Enh #2602: CEmailValidator and CUrlValidator now uses native PHP idn extension in case it is available (idn_to_ascii and idn_ to_ utf8 functions) and Net_IDNA2 otherwise (resurtm, creocoder)
• Enh #2642: Support third party autoloaders when importing classes via Yii::import() (phpnode)
• Chg: Upgraded HTMLPurifier to v4.5.0 (samdark)
• Chg #645: CDbConnection now throws CDbException when failed to open DB connection instead of failing with a warning (kidol, eirikhm, samdark, cebe)
• Chg #895: Add second argument $params to client validation function (slavcodev)
• Chg #1891: Changed order of methods in models generated by Gii and yiic, added better description of search method (hijarian, samdark)
• Chg #2069: Upgraded jQuery BBQ Plugin to 1.4pre to fix jQuery compatibility problems (samdark)
• Chg #2183: Vendors: phlymail's Net_IDNA was replaced by PEAR Net_IDNA2 (resurtm, DaSourcerer)
• Chg #2187: Vendors: punycode.js updated from 1.1.1 (June 27, 2012) to 1.2.0 (October 10, 2012) (resurtm)
• Chg #2461: Upgraded jquery star rating to 4.11 (samdark)
• Chg #2531: Upgraded jquery masked input to 1.3.1 (samdark)
• New: Added CRedisCache which uses redis key value store as cache backend (cebe, maxlun86)
• New #575: Yii registering at Packagist, added composer info file (schmunk42)
• New #1785: Added CPasswordHelper (tom--)
• New #2178: Added Catalan Translation (ArnauAregall)
• New #2370: New template placeholders for CHtml::radioButtonList() and CHtml::checkBoxList() (creocoder)
• New #2530: Added 'through' option to CActiveRecord::BELONGS_TO relation (creocoder)

• Added [CPasswordHelper]
• Added [CRedisCache]