All notable changes to this project will be documented in this file, in reverse chronological order by release.
- Nothing.
- Nothing.
- Nothing.
- Nothing.
- Nothing.
- #42 adds support for PHP 7.3.
- Nothing.
- Nothing.
- #42 removes support for zend-stdlib v2 releases.
- Nothing.
- #39 adds support for PHP 7.1 and 7.2.
- Nothing.
- Nothing.
- #39 removes support for HHVM.
-
#23 fixes an issue with garbage collection of expired CAPTCHA images when concurrent requests trigger collection.
-
#31 fixes using the ReCaptcha response as the value parameter to isValid().
- #29 adds support for zend-recaptch v3.
- Nothing.
- Nothing.
- Nothing.
- Adds and publishes documentation to https://zendframework.github.io/zend-captcha/
- #20 adds support for zend-math v3.
- Nothing.
- #20 removes support for PHP 5.5
- Nothing.
- Nothing.
- Nothing.
- Nothing.
- #18 updates dependencies to known-stable, forwards-compatible versions.
- Nothing.
- Nothing.
- Nothing.
- #6 ensures that
nullvalues may be passed for options.
- Nothing.
- Nothing.
- Nothing.
- ZF2015-09:
Zend\Captcha\Wordgenerates a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this vulnerability announcement, the selection was performed using PHP's internalarray_rand()function. This function does not generate sufficient entropy due to its usage ofrand()instead of more cryptographically secure methods such asopenssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation. This release contains a patch that replaces thearray_rand()calls to useZend\Math\Rand::getInteger(), which provides better RNG.
- Nothing.
- Nothing.
- Nothing.
- ZF2015-09:
Zend\Captcha\Wordgenerates a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this vulnerability announcement, the selection was performed using PHP's internalarray_rand()function. This function does not generate sufficient entropy due to its usage ofrand()instead of more cryptographically secure methods such asopenssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation. This release contains a patch that replaces thearray_rand()calls to useZend\Math\Rand::getInteger(), which provides better RNG.