Yii ≥ 2.0.50: What's New, Release History & EOL Status

What Is New in Yii 2.0.50

This release brings a mix of enhancements, bug fixes, and new features to the framework. The changes primarily focus on the database layer, security, and overall code quality.

What database improvements were made?

The database layer received significant attention in this release. For MSSQL, the query builder now supports SELECT ... FOR UPDATE statements, which is crucial for handling row-level locking in transactional operations.

PostgreSQL users get a fix for the yii\db\pgsql\QueryBuilder that ensures the ::character varying type cast is applied correctly in IN conditions. This prevents type mismatch errors when querying against string primary keys.

Code Example: MSSQL FOR UPDATE

$users = (new \yii\db\Query())
    ->from('users')
    ->where(['status' => 1])
    ->forUpdate()
    ->all();

How is host header security handled?

A new security filter, yii\filters\HostControl, has been introduced to mitigate host header attacks. This filter allows you to specify a whitelist of allowed hostnames for the application.

In practice, this prevents attackers from exploiting the host header to poison password reset emails or conduct cache poisoning. You can enable it by adding it to your application's bootstrap configuration.

Configuration Example

'bootstrap' => [
    [
        'class' => 'yii\filters\HostControl',
        'allowedHosts' => [
            'example.com',
            '*.example.com',
        ],
        'fallbackHostInfo' => 'https://example.com',
    ],
],

What new behaviors and validators are available?

The SluggableBehavior now includes a skipOnEmpty property. When set to true, the behavior will not generate a slug if the source attribute is empty, leaving the slug attribute unchanged.

For IP validation, the IpValidator exposes its ipv6Pattern property, allowing for deeper customization of the validation pattern for IPv6 addresses if the default one doesn't fit your needs.

SluggableBehavior Usage

public function behaviors()
{
    return [
        [
            'class' => SluggableBehavior::class,
            'attribute' => 'title',
            'skipOnEmpty' => true, // New property
        ],
    ];
}

Were there any notable bug fixes?

Yes, several important bugs were squashed. A critical fix was applied to the yii\i18n\Formatter where the asRelativeTime method could previously throw an exception when comparing dates with different timezones.

Another fix resolved an issue with URL rule matching. The problem occurred when a rule's pattern contained a slash at the end and the requested URL had parameters, causing the rule to fail to match correctly.

RBAC managers (DbManager and PhpManager) were also updated to properly handle the yii\rbac\Item::updatedAt property during assignment updates.