Yii 1.1.18 is released

CeBe · April 19, 2017, 5:04pm

We are very pleased to announce that Yii Framework version 1.1.18 is released. You can download it at yiiframework.com/download/.

This release is a maintenance release of Yii 1.1 which has reached maintenance mode and will from now on only receive security fixes, if necessary. We may also accept fixes to adjust the code for compatibility with PHP 7 if they do not cause breaking changes. This allows you to keep your servers PHP version up to date on the environments where old Yii 1.1 applications are hosted to stay in the version ranges supported by the PHP team. Yii 1.1.18 is compatible with PHP 7.1, which at the time of this writing has a announced security issue support until December 1, 2019.

We recommend to use Yii 2.0 for new projects and also to introduce Yii 2.0 for developing new features in existing Yii 1.1 apps, as described in the Yii 2 guide.

Upgrading a whole app to Yii 2.0 will result in a rewrite in most cases so this option provides a way for upgrading step by step and allows you to keep old applications up to date even with low budget.

This release includes a bunch of PHP 7 compatibility fixes and two security improvements.

CSRF tokens have been adjusted to use masked token approach to mitigate attacks like the BREACH attack. Furthermore, the CJavascript::quote() method has been adjusted to properly escape strings passed to it in more complex circumstances and for more encodings than before.

For the complete list of changes in this release, please see the change log.

We would like to express our gratitude to all contributors who have spent their precious time helping improve Yii and made this release possible.