What Is New in CakePHP 2.9
CakePHP 2.9 is a maintenance release focused on security enhancements, bug fixes, and preparing the codebase for the future. It introduces a new CSRF protection component, deprecates several older features, and resolves numerous issues.
| Category | Key Changes |
|---|---|
| Security | New CSRF (Cross-Site Request Forgery) protection component. |
| Deprecations | Marked several methods and classes for removal in 3.0 (e.g., String, Set classes, some View helpers). |
| Improvements | Enhanced Security component with HMAC salt, better hash generation. Updates to Composer support and core code. |
| Bug Fixes | Multiple fixes across Routing, Console, Database, and View layers. |
How does CakePHP 2.9 handle CSRF protection?
CakePHP 2.9 adds a dedicated CsrfComponent to guard against Cross-Site Request Forgery attacks. You enable it by adding 'Csrf' to your controller's components array. In practice, this component automatically checks POST, PUT, DELETE, and PATCH requests, making your forms more secure with less manual work.
It works by generating a unique token for each user session and embedding it in forms. When a form is submitted, the component validates this token. This approach is common in web frameworks and is a solid addition to CakePHP's existing Security component features.
What features are deprecated in version 2.9?
This release signals the end for several legacy classes and helpers to streamline the path to CakePHP 3.0. The main deprecations include the String and Set utility classes, which are replaced by CakeText and the Hash class respectively.
Key Deprecated Items:
Stringclass (useCakeText)Setclass (useHashclass)ViewHelperslikeJsBase,Paginatorin theClassRegistry- The
$baseand$fullarguments inRouter::url()
You'll see deprecation warnings in your debug logs. Start updating your code now to avoid breakage in a future 3.x upgrade.
Are there improvements to the Security component?
Yes, the existing SecurityComponent gets important upgrades. It now uses an HMAC salt by default for generating form hashes, which strengthens security against certain types of tampering. The hash generation process itself was also refined for better consistency.
This matters because it hardens one of CakePHP's core security mechanisms. If you have complex forms with unlocked fields, test them thoroughly after upgrading, as the hash changes might affect behavior.
What bug fixes should developers be aware of?
The release squashes bugs across several core areas. Notable fixes include corrections to Router parsing for URLs with specific extensions, improvements to Console output handling, and fixes for database behavior in certain edge-case scenarios.
Fixed Areas:
- Routing: Issues with URL parsing and extensions.
- Console: Problems with output and argument parsing.
- Database: Corrections to query generation and behavior callbacks.
- Views: Fixes for helper output and element rendering.
These fixes improve stability but are unlikely to break existing applications if you weren't relying on the buggy behavior.
FAQ
Should I use the new CsrfComponent or stick with the SecurityComponent?
Use the new CsrfComponent specifically for CSRF protection on your forms. The SecurityComponent still handles form tampering protection and other security features. They can be used together, but for pure CSRF, the new component is more straightforward.
I use the String class everywhere. What's the immediate impact?
It's deprecated, not removed. Your code will keep working in 2.9 but will log deprecation notices. You should plan to replace all String class calls with the CakeText class equivalents as soon as possible to ensure compatibility with future versions.
Does the HMAC salt change in SecurityComponent break my current forms?
It might. The change makes hashes more secure but could invalidate existing form tokens. Test your application's forms, especially those with unlockedFields, after upgrading. The upgrade guide provides details on managing this transition.
Are there any changes to how Composer is used with CakePHP 2.9?
Yes, there are updates to the composer.json file and autoloading to better align with modern Composer standards. This smooths the integration of CakePHP 2.x into projects managed by Composer.
Is this a required upgrade for CakePHP 2.8 users?
Due to the security enhancements (CSRF component and Security component improvements), upgrading is highly recommended. The deprecation warnings also give you a head start on migrating to patterns that will be required for any future CakePHP 3.x move.