Laravel 5.4.22 Is Now Released and Includes a Security Fix

Published on by

Laravel 5.4.22 Is Now Released and Includes a Security Fix image

Laravel 5.4.22 is now released and available. This release fixes a security vulnerability related to the password reset system and everyone should upgrade.

Laravel 5.4.22 patches a security vulnerability in the Laravel 5.4 release series that allows phishing attempts on users of the application. Using the password reset system, malicious users can attempt to trick your users into entering their login credentials into a separate application that they control. Since the password reset notification uses the host of the incoming request to build the password reset URL, the host of the password reset URL may be spoofed. If users do not notice that they are not on their intended application’s domain, they may accidentally enter their login credentials into a malicious application.

The release notes also mention the fix for those running Laravel 5.1 and you need to ensure the password reset link contains the full URL to your site. For example:

{{ url('http://example.com/password/reset/'.$token) }}

5.4.22 Complete Changelog

Added

  • Support dynamic number of keys in MessageBag::hasAny() (#19002)
  • Added Seeder::callSilent() method (#19007)
  • Add make() method to Eloquent query builder (#19015)
  • Support Arrayable on Eloquent’s find() method (#19019)
  • Added SendsPasswordResetEmails::validateEmail() method (#19042)
  • Allow factory attributes to be factory instances themselves (#19055)
  • Implemented until() method on EventFake (#19062)
  • Added $encoding parameter to Str::length() (#19047, #19079)

Changed

  • Throw exception when invalid first argument is passed to cache() helper (d9459b2)
  • Use getAuthIdentifierName() in Authenticatable::getAuthIdentifier() (#19038)
  • Clone queries without order by for aggregates (#19064)
  • Force host on password reset notification (cef1055)

Fixed

  • Set data key when testing file uploads in nested array (#18954)
  • Fixed a bug related to sub select queries and extra select statements (#19013)
  • Resolve aliases from container when using parameters (#19071)
  • Stop worker if database disconnect occurred (#19080, 583b1b8)
  • Fixed internal call to assertJson() in assertJsonStructure() (#19090)
Eric L. Barnes photo

Eric is the creator of Laravel News and has been covering Laravel since 2012.

Cube

Laravel Newsletter

Join 40k+ other developers and never miss out on new tips, tutorials, and more.

image
Laravel Cloud

Easily create and manage your servers and deploy your Laravel applications in seconds.

Visit Laravel Cloud
Curotec logo

Curotec

World class Laravel experts with GenAI dev skills. LATAM-based, embedded engineers that ship fast, communicate clearly, and elevate your product. No bloat, no BS.

Curotec
Bacancy logo

Bacancy

Supercharge your project with a seasoned Laravel developer with 4-6 years of experience for just $2500/month. Get 160 hours of dedicated expertise & a risk-free 15-day trial. Schedule a call now!

Bacancy
Laravel Forge logo

Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Laravel Forge
Tinkerwell logo

Tinkerwell

The must-have code runner for Laravel developers. Tinker with AI, autocompletion and instant feedback on local and production environments.

Tinkerwell
Cut PHP Code Review Time & Bugs into Half with CodeRabbit logo

Cut PHP Code Review Time & Bugs into Half with CodeRabbit

CodeRabbit is an AI-powered code review tool that specializes in PHP and Laravel, running PHPStan and offering automated PR analysis, security checks, and custom review features while remaining free for open-source projects.

Cut PHP Code Review Time & Bugs into Half with CodeRabbit
Join the Mastering Laravel community logo

Join the Mastering Laravel community

Connect with experienced developers in a friendly, noise-free environment. Get insights, share ideas, and find support for your coding challenges. Join us today and elevate your Laravel skills!

Join the Mastering Laravel community
Kirschbaum logo

Kirschbaum

Providing innovation and stability to ensure your web application succeeds.

Kirschbaum
Shift logo

Shift

Running an old Laravel version? Instant, automated Laravel upgrades and code modernization to keep your applications fresh.

Shift
Lucky Media logo

Lucky Media

Get Lucky Now - the ideal choice for Laravel Development, with over a decade of experience!

Lucky Media
Lunar: Laravel E-Commerce logo

Lunar: Laravel E-Commerce

E-Commerce for Laravel. An open-source package that brings the power of modern headless e-commerce functionality to Laravel.

Lunar: Laravel E-Commerce
LaraJobs logo

LaraJobs

The official Laravel job board

LaraJobs
SaaSykit: Laravel SaaS Starter Kit logo

SaaSykit: Laravel SaaS Starter Kit

SaaSykit is a Multi-tenant Laravel SaaS Starter Kit that comes with all features required to run a modern SaaS. Payments, Beautiful Checkout, Admin Panel, User dashboard, Auth, Ready Components, Stats, Blog, Docs and more.

SaaSykit: Laravel SaaS Starter Kit
MongoDB logo

MongoDB

Enhance your PHP applications with the powerful integration of MongoDB and Laravel, empowering developers to build applications with ease and efficiency. Support transactional, search, analytics and mobile use cases while using the familiar Eloquent APIs. Discover how MongoDB's flexible, modern database can transform your Laravel applications.

MongoDB

The latest

View all →
Laravel Simple RabbitMQ Package image

Laravel Simple RabbitMQ Package

Read article
Navigating Dates Elegantly with Carbon in Laravel image

Navigating Dates Elegantly with Carbon in Laravel

Read article
Memoized Cache Driver in Laravel 12.9 image

Memoized Cache Driver in Laravel 12.9

Read article
Laravel Cookie Consent image

Laravel Cookie Consent

Read article
Converting Non-Decimal Strings with Laravel's Enhanced toInteger() Method image

Converting Non-Decimal Strings with Laravel's Enhanced toInteger() Method

Read article
Herd Xdebug Toggler for Visual Studio Code image

Herd Xdebug Toggler for Visual Studio Code

Read article