Laravel 5.4.22 Is Now Released and Includes a Security Fix

Published on by

Laravel 5.4.22 Is Now Released and Includes a Security Fix image

Laravel 5.4.22 is now released and available. This release fixes a security vulnerability related to the password reset system and everyone should upgrade.

Laravel 5.4.22 patches a security vulnerability in the Laravel 5.4 release series that allows phishing attempts on users of the application. Using the password reset system, malicious users can attempt to trick your users into entering their login credentials into a separate application that they control. Since the password reset notification uses the host of the incoming request to build the password reset URL, the host of the password reset URL may be spoofed. If users do not notice that they are not on their intended application’s domain, they may accidentally enter their login credentials into a malicious application.

The release notes also mention the fix for those running Laravel 5.1 and you need to ensure the password reset link contains the full URL to your site. For example:

{{ url('http://example.com/password/reset/'.$token) }}

5.4.22 Complete Changelog

Added

  • Support dynamic number of keys in MessageBag::hasAny() (#19002)
  • Added Seeder::callSilent() method (#19007)
  • Add make() method to Eloquent query builder (#19015)
  • Support Arrayable on Eloquent’s find() method (#19019)
  • Added SendsPasswordResetEmails::validateEmail() method (#19042)
  • Allow factory attributes to be factory instances themselves (#19055)
  • Implemented until() method on EventFake (#19062)
  • Added $encoding parameter to Str::length() (#19047, #19079)

Changed

  • Throw exception when invalid first argument is passed to cache() helper (d9459b2)
  • Use getAuthIdentifierName() in Authenticatable::getAuthIdentifier() (#19038)
  • Clone queries without order by for aggregates (#19064)
  • Force host on password reset notification (cef1055)

Fixed

  • Set data key when testing file uploads in nested array (#18954)
  • Fixed a bug related to sub select queries and extra select statements (#19013)
  • Resolve aliases from container when using parameters (#19071)
  • Stop worker if database disconnect occurred (#19080, 583b1b8)
  • Fixed internal call to assertJson() in assertJsonStructure() (#19090)
Eric L. Barnes photo

Eric is the creator of Laravel News and has been covering Laravel since 2012.

Cube

Laravel Newsletter

Join 40k+ other developers and never miss out on new tips, tutorials, and more.

Laravel Forge logo

Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Laravel Forge
Tinkerwell logo

Tinkerwell

The must-have code runner for Laravel developers. Tinker with AI, autocompletion and instant feedback on local and production environments.

Tinkerwell
No Compromises logo

No Compromises

Joel and Aaron, the two seasoned devs from the No Compromises podcast, are now available to hire for your Laravel project. ⬧ Flat rate of $7500/mo. ⬧ No lengthy sales process. ⬧ No contracts. ⬧ 100% money back guarantee.

No Compromises
Kirschbaum logo

Kirschbaum

Providing innovation and stability to ensure your web application succeeds.

Kirschbaum
Shift logo

Shift

Running an old Laravel version? Instant, automated Laravel upgrades and code modernization to keep your applications fresh.

Shift
Bacancy logo

Bacancy

Supercharge your project with a seasoned Laravel developer with 4-6 years of experience for just $2500/month. Get 160 hours of dedicated expertise & a risk-free 15-day trial. Schedule a call now!

Bacancy
Lucky Media logo

Lucky Media

Bespoke software solutions built for your business. We ♥ Laravel

Lucky Media
Lunar: Laravel E-Commerce logo

Lunar: Laravel E-Commerce

E-Commerce for Laravel. An open-source package that brings the power of modern headless e-commerce functionality to Laravel.

Lunar: Laravel E-Commerce
LaraJobs logo

LaraJobs

The official Laravel job board

LaraJobs
Larafast: Laravel SaaS Starter Kit logo

Larafast: Laravel SaaS Starter Kit

Larafast is a Laravel SaaS Starter Kit with ready-to-go features for Payments, Auth, Admin, Blog, SEO, and beautiful themes. Available with Vue and Livewire stacks.

Larafast: Laravel SaaS Starter Kit
SaaSykit: Laravel SaaS Starter Kit logo

SaaSykit: Laravel SaaS Starter Kit

SaaSykit is a Laravel SaaS Starter Kit that comes with all features required to run a modern SaaS. Payments, Beautiful Checkout, Admin Panel, User dashboard, Auth, Ready Components, Stats, Blog, Docs and more.

SaaSykit: Laravel SaaS Starter Kit
Rector logo

Rector

Your partner for seamless Laravel upgrades, cutting costs, and accelerating innovation for successful companies

Rector
MongoDB logo

MongoDB

Get your ideas to market faster with a developer data platform built on the leading modern database. Support transactional, search, analytics, and mobile use cases while using a common query interface and the data model developers love.

MongoDB

The latest

View all →
Build Tables Based on Eloquent Models with Inertia Table image

Build Tables Based on Eloquent Models with Inertia Table

Read article
Behind the Code: A Discussion with Backend Experts including Taylor Otwell image

Behind the Code: A Discussion with Backend Experts including Taylor Otwell

Read article
Artisan `make` Commands Automatically Chop `.php` Extension in Laravel 11.12 image

Artisan `make` Commands Automatically Chop `.php` Extension in Laravel 11.12

Read article
The June 2024 Laravel Worldwide Meetup is Today image

The June 2024 Laravel Worldwide Meetup is Today

Read article
A Lightweight Cart Package for Laravel image

A Lightweight Cart Package for Laravel

Read article
SQLite Studio is a SQLite Database Explorer image

SQLite Studio is a SQLite Database Explorer

Read article