Every site on Apricot Manage shares one codebase for the parts visitors never see: sessions, logins, forms, the account area. That is the point of a platform. It also means a fault in that code is a fault on every site, so twice a year we read it with that in mind. This autumn's sweep changed four things.
Logging out now logs you out
The Log out link on the account area cleared the session but left a remember-me cookie behind, so the next visit signed you straight back in. It now clears both. Obvious in hindsight; invisible unless you share a computer.
Remember-me cookies are signed
The old remember-me cookie identified a member by a value that could, in principle, be guessed or copied. The new one is signed with a secret the server holds, so a cookie that was not issued by the site is simply ignored. Older cookie names no longer sign anyone in.
A shortcut that should never have existed
One code path allowed a member's email address alone to act as a sign-in on some sites. It was there for a convenience feature years ago. It is gone.
Missing pages are missing
A request for a page that did not exist used to answer with a copy of another site's home page and a success status. Search engines indexed those. Missing pages now answer with a real 404.
Why say so
Clubs hold parents' details. Associations hold members' details. The people running them are entitled to know what we do with the code that holds them, including the parts we had to fix. If you run a site with us and want the detail for your committee, ask.