cakephp/cakephp — pull request #1464 by markstory (2013-07-30 15:43:43+00:00)
Title: 3.0 security improvements

Remove really bad crypto features in Security. I've opted to make Security::cipher() throw exceptions for now instead of removing it entirely. The backwards compatibility in rijndael has also been removed. I'll update the migration guide to recommend re-encrypting all data before upgrading.

The CookieComponent now only uses rijndael, this is a big BC break as all previous cookies may be "encrypted" with cipher. I don't have a good plan on how people can migrate other than they can't.

I've also considered adding AES-256 as new methods on Security class, does that sound like a reasonable thing to do?