Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
e7152d0
Initial plan
Copilot Jan 29, 2026
a0f1c07
Initial plan
Copilot Jan 29, 2026
bb2de14
Fix password reset security issues: user enumeration, weak tokens, pl…
Copilot Jan 29, 2026
a9270b5
Address code review feedback: token format validation, TTL validation…
Copilot Jan 29, 2026
758227b
Fix order token generator entropy by using random_int() and 32-char t…
Copilot Jan 29, 2026
90d75b5
[Security] fix pull_request_target workflow injection (pwn request)
dpfaffenbauer Apr 15, 2026
7ea1e51
[OrderBundle] remove web2print, not needed anymore
dpfaffenbauer Apr 15, 2026
7690306
Merge pull request #2989 from coreshop/fix/pull-request-target-cve
dpfaffenbauer Apr 15, 2026
768ec9f
Bump follow-redirects
dependabot[bot] Apr 15, 2026
366c188
Merge pull request #2992 from coreshop/dependabot/npm_and_yarn/src/Co…
dpfaffenbauer Apr 15, 2026
4aa5721
Merge pull request #2991 from coreshop/fix/remove-web-to-print-bundle…
dpfaffenbauer Apr 15, 2026
391cc55
bump symfony constraints to ^6.4 || ^7.3
dpfaffenbauer Apr 15, 2026
b72257e
Merge pull request #2993 from coreshop/fix/bump-symfony-constraints
dpfaffenbauer Apr 15, 2026
6b024bc
skip prefer-lowest on PHP 8.4 (old libs not 8.4-clean)
dpfaffenbauer Apr 15, 2026
2b05249
Merge pull request #2994 from coreshop/fix/ci-skip-lowest-on-php84
dpfaffenbauer Apr 15, 2026
cbf5764
Merge pull request #2964 from coreshop/copilot/fix-token-generator-en…
dpfaffenbauer Apr 15, 2026
abc21ac
Merge pull request #2961 from coreshop/copilot/improve-password-reset…
dpfaffenbauer Apr 15, 2026
84f85cb
Merge branch '5.0' into upmerge/4.1_5.0
dpfaffenbauer Apr 15, 2026
214d3f5
fix stray character from merge
dpfaffenbauer Apr 15, 2026
ca19681
fix Carbon type for password reset timestamp
dpfaffenbauer Apr 15, 2026
4066a6d
Merge pull request #2995 from coreshop/upmerge/4.1_5.0
dpfaffenbauer Apr 15, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 1 addition & 10 deletions .github/workflows/behat.yml
Original file line number Diff line number Diff line change
Expand Up @@ -73,16 +73,7 @@ jobs:
name: "${{ matrix.pimcore }}, PHP ${{ matrix.php }}, Deps ${{ matrix.dependencies }}"

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
Expand Down
11 changes: 1 addition & 10 deletions .github/workflows/behat_ui.yml
Original file line number Diff line number Diff line change
Expand Up @@ -74,16 +74,7 @@ jobs:
name: "${{ matrix.pimcore }}, PHP ${{ matrix.php }}, Deps ${{ matrix.dependencies }}"

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- uses: browser-actions/setup-chrome@v1
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs_next.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: "Documentation"
on:
pull_request_target:
pull_request:
paths:
- 'docs/**'
- '.github/workflows/docs_next.yml'
Expand Down
13 changes: 2 additions & 11 deletions .github/workflows/license-check.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ on:
- 'composer.json'
- '*/**/composer.json'
- '.github/workflows/license-check.yaml'
pull_request_target:
pull_request:
branches: [ '5.0', 'next' ]
paths:
- 'composer.json'
Expand Down Expand Up @@ -50,16 +50,7 @@ jobs:
name: "${{ matrix.pimcore }}, PHP ${{ matrix.php }}, Deps ${{ matrix.dependencies }}"

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
Expand Down
27 changes: 6 additions & 21 deletions .github/workflows/packages_bundles.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
paths:
- 'src/CoreShop/Bundle/**'
- '.github/workflows/packages_bundles.yml'
pull_request_target:
pull_request:
branches: [ '5.0', 'next' ]
paths:
- 'src/CoreShop/Bundle/**'
Expand All @@ -32,16 +32,7 @@ jobs:
name: "Create a list of packages"

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: "List Packages"
id: create-list
Expand All @@ -61,18 +52,12 @@ jobs:
pimcore: [ ^12.3 ]
dependencies: [ highest, lowest ]
package: "${{ fromJson(needs.list.outputs.packages) }}"
exclude:
- php: 8.4
dependencies: lowest

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
Expand Down
27 changes: 6 additions & 21 deletions .github/workflows/packages_components.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
paths:
- 'src/CoreShop/Component/**'
- '.github/workflows/packages_components.yml'
pull_request_target:
pull_request:
branches: [ '5.0', 'next' ]
paths:
- 'src/CoreShop/Component/**'
Expand All @@ -32,16 +32,7 @@ jobs:
name: "Create a list of packages"

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: "List Packages"
id: create-list
Expand All @@ -62,18 +53,12 @@ jobs:
pimcore: [ ^12.3 ]
dependencies: [ highest, lowest ]
package: "${{ fromJson(needs.list.outputs.packages) }}"
exclude:
- php: 8.4
dependencies: lowest

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
Expand Down
16 changes: 5 additions & 11 deletions .github/workflows/static.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ on:
- '*.xml'
- 'composer.json'
- '.github/workflows/static.yml'
pull_request_target:
pull_request:
branches: [ '5.0', 'next' ]
paths:
- 'features/**'
Expand Down Expand Up @@ -48,6 +48,9 @@ jobs:
php: [ 8.3, 8.4 ]
pimcore: [ ^12.3 ]
dependencies: [ highest, lowest ]
exclude:
- php: 8.4
dependencies: lowest
services:
database:
image: "mysql:8"
Expand All @@ -60,16 +63,7 @@ jobs:
name: "${{ matrix.pimcore }}, PHP ${{ matrix.php }}, Deps ${{ matrix.dependencies }}"

steps:
- name: Checkout PR head (only for pull_request_target)
if: github.event_name == 'pull_request_target'
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout PR head (for push or other events)
if: github.event_name != 'pull_request_target'
uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
Expand Down
24 changes: 12 additions & 12 deletions composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -108,15 +108,15 @@
"sebastian/diff": "^4.0 | ^5.0 | ^6.0",
"stof/doctrine-extensions-bundle": "^1.14",
"sylius/theme-bundle": "^2.2",
"symfony/config": "^6.3 || ^7.4",
"symfony/dotenv": "^6.3 || ^7.0",
"symfony/form": "^6.3 || ^7.0",
"symfony/http-client": "^6.3 || ^7.0",
"symfony/intl": "^6.3 || ^7.0",
"symfony/notifier": "^6.3 || ^7.0",
"symfony/scheduler": "^6.4 || ^7.0",
"symfony/serializer": "^6.3 || ^7.0",
"symfony/twig-bundle": "^6.3 || ^7.0",
"symfony/config": "^6.4 || ^7.3",
"symfony/dotenv": "^6.4 || ^7.3",
"symfony/form": "^6.4 || ^7.3",
"symfony/http-client": "^6.4 || ^7.3",
"symfony/intl": "^6.4 || ^7.3",
"symfony/notifier": "^6.4 || ^7.3",
"symfony/scheduler": "^6.4 || ^7.3",
"symfony/serializer": "^6.4 || ^7.3",
"symfony/twig-bundle": "^6.4 || ^7.3",
"symfony/webpack-encore-bundle": "^2.4",
"webmozart/assert": "^1.12"
},
Expand Down Expand Up @@ -146,9 +146,9 @@
"robertfausk/behat-panther-extension": "^1.2",
"symfony/panther": "^2.3",
"php-webdriver/webdriver": "^1.15",
"symfony/browser-kit": "^6.3 || ^7.0",
"symfony/runtime": "^6.4 || ^7.0",
"symfony/css-selector": "^6.4 || ^7.0",
"symfony/browser-kit": "^6.4 || ^7.3",
"symfony/runtime": "^6.4 || ^7.3",
"symfony/css-selector": "^6.4 || ^7.3",
"symplify/easy-coding-standard": "^11.1",
"vimeo/psalm": "^6.10"
},
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,28 @@
"visibleGridView": false,
"visibleSearch": false
},
{
"fieldtype": "datetime",
"queryColumnType": "bigint",
"columnType": "bigint",
"phpdocType": "\\Carbon\\Carbon",
"defaultValue": null,
"useCurrentDate": false,
"name": "passwordResetHashCreatedAt",
"title": "Reset Password Hash Created At",
"tooltip": "",
"mandatory": false,
"noteditable": true,
"index": false,
"locked": false,
"style": "",
"permissions": null,
"datatype": "data",
"relationType": false,
"invisible": true,
"visibleGridView": false,
"visibleSearch": false
},
{
"fieldtype": "coreShopRelation",
"stack": "coreshop.customer",
Expand Down
2 changes: 1 addition & 1 deletion src/CoreShop/Bundle/CurrencyBundle/composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"coreshop/currency": "^5.0",
"coreshop/resource-bundle": "^5.0",
"pimcore/pimcore": "^12.3",
"symfony/intl": "^6.3 || ^7.0"
"symfony/intl": "^6.4 || ^7.3"
},
"require-dev": {
"phpstan/phpstan": "^2.1",
Expand Down
Loading
Loading