Shopware Files

System requirements

• tested on PHP 8.2, 8.4 and 8.5
• tested on MySQL 8 and MariaDB 11

Critical Fixes

Double signature verification in app-reregistration flow

Introduces a secure, asynchronous app secret rotation feature to the app system, including both API and CLI interfaces. Added a new API endpoint and command for rotating app secrets, implemented the underlying rotation logic, and adjusted the app registration process to support secret updates and dual signature confirmation. This increases security by enforcing a two-step verification process during app re-registration, ensuring that only authorized parties can update app secrets.

LoginRoute and AccountService don't throw CustomerNotFoundException

The LoginRoute and AccountService have been updated to no longer throw a CustomerNotFoundException when a login attempt is made with an email address that does not exist in the system. Instead, they will now throw a generic BadCredentialsException without revealing whether the email address is registered or not. This change enhances security by preventing potential attackers from enumerating valid email addresses through error messages.

Improve OrderRoute deepLinkCode filter type validation

Improve the logic in \Shopware\Core\Checkout\Order\SalesChannel\OrderRoute::load to ensure the deepLinkCode filter is an instance of \Shopware\Core\Framework\DataAbstractionLayer\Search\Filter\EqualsFilter.

What's Changed

• GHSA-c4p7-rwrg-pf6p - Double signature verification in app-reregistration flow
• GHSA-gqc5-xv7m-gcjq - Limit account enumeration via Store API
• GHSA-7vvp-j573-5584 - Proper check for the deepLinkCode filter type

Full Changelog: https://github.com/shopware/shopware/compare/v6.7.8.0...v6.7.8.1

Get in touch

Discuss about decisions, bugs you might stumble upon, etc in our community discord. See you there ;)