Skip to content

Commit d458553

Browse files
authored
Merge pull request #4424 from intrepidws/patch-1
Fix redundancy in sentence on Upgrade page
2 parents ffee0f9 + 9a45063 commit d458553

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

upgrade.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Laravel 5.6.30 is a security release of Laravel and is recommended as an immedia
1414

1515
Laravel 5.6.30 disables all serialization / unserialization of cookie values. Since all Laravel cookies are encrypted and signed, cookie values are typically considered safe from client tampering. **However, if your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitary class methods within your application.**
1616

17-
Disabling serialization on all cookie values will invalidate all of your application's sessions and users will need to log into the application again. In addition, any other encrypted cookies your application is setting will have invalid values. For this reason, you may wish to add additional logic to your application to validate that your custom cookie values match an expected list of values you expect; otherwise, you should discard them.
17+
Disabling serialization on all cookie values will invalidate all of your application's sessions and users will need to log into the application again. In addition, any other encrypted cookies your application is setting will have invalid values. For this reason, you may wish to add additional logic to your application to validate that your custom cookie values match an expected list of values; otherwise, you should discard them.
1818

1919
#### Configuring Cookie Serialization
2020

0 commit comments

Comments
 (0)