Magento Commerce 2.0.6 Release Notes

We are pleased to present Magento Commerce (formerly Enterprise Edition) 2.0.6. This release includes security enhancements as well as several functional fixes and enhancements.

Backward-incompatible changes are documented in Magento 2.0 Backward Incompatible Changes.

Fixed issues

• Varnish no longer returns a 400 bad request error message when clearing its cache. Previously, this issue occurred with Magento instances running on GoDaddy.

Functional enhancements

• Starting with Magento 2.0.6, Magento provides a more flexible way for you to set file ownership and permissions. Instead of setting permissions explicitly, you only need to make sure files and directories are writable for installation. We provide different suggestions for doing this, depending on whether you access your Magento server with one user account (typical of shared hosting) or two user accounts (typical of private hosting or having your own server). After installation, to further restrict access to files and directories, you can optionally create a file named magento_umask in your Magento root directory. By default, the umask is 002, which means that directories have 775 permissions and files have 664 permissions. For more details, see Magento file system ownership and permissions.

• You can now use the Redis adapter to provide session storage in Magento 2.0.6. For more information, see Redis for session storage.

Security enhancements

This release includes enhancements to improve the security of your Magento installation. While there are no confirmed attacks related to these issues to date, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. We recommend that you upgrade your existing Magento installation to the latest version as soon as possible.

The following list provides an overview of the security issues fixed in this release. We describe each issue in greater detail in the Magento Security Center.

• Magento no longer permits an unauthenticated user to remotely execute code on the server through APIs.

• Magento no longer allows authenticated customers to change other customers’ account information using either SOAP or REST calls. Magento now confirms that the ID of the customer whose account is being edited matches the authentication token in use.

• Anonymous users can no longer retrieve the private data of registered customers. To prevent malicious attacks of this type, the quote_id_mask table of the Quote API no longer includes a cart id mask value.

• Several parameters in the Authorize.net payment module are vulnerable to reflected Cross-Site Scripting (XSS) attacks. Existing protection against such malicious parameters is not enough to stop all types of attacks.

• Magento no longer allows users with minimum privileges (for example, access to the dashboard only) to force re-installation of Magento, which could allow them to potentially execute malicious code.

• The Magento installation code is no longer accessible once the installation process has completed.

• When an integration is created, Magento now bases the OAuth consumer key expiration from when the token exchange begins instead of when the consumer key is created. (GITHUB-3449)

• Only a registered customer can assign a guest cart to himself. Previously, an anonymous user could modify the state (that is, set an active quote) of a registered customer.

• Magento no longer discloses information about its internal path during installation.

• Magento no longer discloses the administrator URL to an unauthenticated user during setup.

• Application error messages no longer include the path to the file where the error occurred.

System requirements

Our technology stack is built on PHP and MySQL. Magento 2.0.1 and later supports PHP 5.5, 5.6, 7.0.2, and MySQL 5.6. For more information, see System Requirements.

Installation instructions

New installations

New users can now complete a full installation of Magento Commerce 2.0.6 from an archive file.

Download a new installation

1. Go to the Magento website, and click My Account. Then, log in to your account.

2. In the panel on the left, choose Downloads. Choose Magento Commerce 2.x, and do the following:

   a. Click Magento Commerce 2.x Release.

   b. In the list, choose Version 2.0.6.

   c. Click Download.

3. Follow the instructions to upgrade and verify your installation. If you need help, go to the Support tab of your Magento account, and Open a Ticket.

Upgrade existing installations

If you installed Magento Commerce 2.0.0 from an archive, you must perform some additional tasks before you can upgrade your installation. Current users of Magento 2.0.0/2.0.1/2.0.2/2.0.3/2.0.4/2.0.5 must first update the installer from the command line. Then, update the installation from the Web Setup Wizard or command line. For detailed instructions, see the technical bulletin.

Upgrade an existing installation from the Setup Wizard

1. Log in to the Admin panel with Administrator privileges.

2. On the Admin sidebar, click System. Under Tools, choose Web Setup Wizard.

3. Click System Upgrade. Follow the onscreen instructions to complete the upgrade.

For more information, see Upgrade the Magento installation and components.

Magento Partners

Magento partners can download the release and the release notes in PDF format from the Partner Portal.

1. Log in to the Partner Portal.
2. Under Magento Commerce, choose Magento Commerce 2.x.
3. Find the Magento Commerce 2.x Release, and choose Version 2.0.6.

Migration toolkits

The Data Migration Tool helps transfer existing Magento 1.x store data to Magento 2.x. This command-line interface includes verification, progress tracking, logging, and testing functions. For installation instructions, see Install the Data Migration Tool. Consider exploring or contributing to the Magento Data Migration repository.

The Code Migration Toolkit helps transfer existing Magento 1.x store extensions and customizations to Magento 2.0.x. The command-line interface includes scripts for converting Magento 1.x modules and layouts.