Merge branch '4.0' into 4.1

* 4.0:
  [HttpKernel] reset kernel start time on reboot
  Add code of Conduct links in our README
  bumped Symfony version to 4.0.12
  [DI] never inline lazy services
  updated VERSION for 4.0.11
  updated CHANGELOG for 4.0.11
  bumped Symfony version to 3.4.12
  updated VERSION for 3.4.11
  updated CHANGELOG for 3.4.11
  Default testsuite to latest PHPUnit 6.*
  [Github] Update the pull-request template
  bumped Symfony version to 2.8.42
  updated VERSION for 2.8.41
  updated CHANGELOG for 2.8.41
  [HttpFoundation] Fix cookie test with xdebug
  [Serializer] Check the value of enable_max_depth if defined
  [DI] remove dead code
  [PhpUnitBridge] silence some stderr outputs
  [Validator] Update sl translation

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 | Q             | A
 | ------------- | ---
-| Branch?       | master for features / 2.7 up to 4.0 for bug fixes <!-- see below -->
+| Branch?       | master for features / 2.8 up to 4.1 for bug fixes <!-- see below -->
 | Bug fix?      | yes/no
 | New feature?  | yes/no <!-- don't forget to update src/**/CHANGELOG.md files -->
 | BC breaks?    | no     <!-- see https://symfony.com/bc -->

CHANGELOG-4.0.md

@@ -7,6 +7,19 @@ in 4.0 minor versions.
 To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
 To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v4.0.0...v4.0.1
 
+* 4.0.11 (2018-05-25)
+
+ * bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (nicolas-grekas)
+ * bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas)
+ * security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured
+ * security #cve-2018-11406 clear CSRF tokens when the user is logged out
+ * security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener
+ * security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation
+ * security #cve-2018-11385 Adding session strategy to ALL listeners to avoid *any* possible fixation
+ * security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
+ * bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (yceruto)
+ * bug #27337  [FrameworkBundle] fix typo in CacheClearCommand (emilielorenzo)
+
 * 4.0.10 (2018-05-21)
 
  * bug #27264 [Validator] Use strict type in URL validator (mimol91)

README.md

@@ -29,6 +29,7 @@ Community
 * [Join the Symfony Community][11] and meet other members at the [Symfony events][12].
 * [Get Symfony support][13] on Stack Overflow, Slack, IRC, etc.
 * Follow us on [GitHub][14], [Twitter][15] and [Facebook][16].
+* Read our [Code of Conduct][24] and meet the [CARE Team][25]
 
 Contributing
 ------------
@@ -71,3 +72,5 @@ Symfony development is sponsored by [SensioLabs][21], led by the
 [21]: https://sensiolabs.com
 [22]: https://symfony.com/doc/current/contributing/code/core_team.html
 [23]: https://github.com/symfony/symfony-demo
+[24]: https://symfony.com/coc
+[25]: https://symfony.com/doc/current/contributing/code_of_conduct/care_team.html

phpunit

@@ -8,7 +8,7 @@ if (!file_exists(__DIR__.'/vendor/symfony/phpunit-bridge/bin/simple-phpunit')) {
     exit(1);
 }
 if (\PHP_VERSION_ID >= 70000 && !getenv('SYMFONY_PHPUNIT_VERSION')) {
-    putenv('SYMFONY_PHPUNIT_VERSION=6.0');
+    putenv('SYMFONY_PHPUNIT_VERSION=6.5');
 }
 putenv('SYMFONY_PHPUNIT_DIR='.__DIR__.'/.phpunit');
 require __DIR__.'/vendor/symfony/phpunit-bridge/bin/simple-phpunit';

src/Symfony/Bridge/PhpUnit/Tests/CoverageListenerTest.php

@@ -27,11 +27,11 @@ class CoverageListenerTest extends TestCase
         $dir = __DIR__.'/../Tests/Fixtures/coverage';
         $phpunit = $_SERVER['argv'][0];
 
-        exec("$php $phpunit -c $dir/phpunit-without-listener.xml.dist $dir/tests/ --coverage-text", $output);
+        exec("$php $phpunit -c $dir/phpunit-without-listener.xml.dist $dir/tests/ --coverage-text 2> /dev/null", $output);
         $output = implode("\n", $output);
         $this->assertContains('FooCov', $output);
 
-        exec("$php $phpunit -c $dir/phpunit-with-listener.xml.dist $dir/tests/ --coverage-text", $output);
+        exec("$php $phpunit -c $dir/phpunit-with-listener.xml.dist $dir/tests/ --coverage-text 2> /dev/null", $output);
         $output = implode("\n", $output);
         $this->assertNotContains('FooCov', $output);
         $this->assertContains("SutNotFoundTest::test\nCould not find the tested class.", $output);

src/Symfony/Bridge/PhpUnit/bin/simple-phpunit

@@ -77,7 +77,7 @@ if ('phpdbg' === PHP_SAPI) {
     $PHP .= ' -qrr';
 }
 
-$COMPOSER = file_exists($COMPOSER = $oldPwd.'/composer.phar') || ($COMPOSER = rtrim('\\' === DIRECTORY_SEPARATOR ? preg_replace('/[\r\n].*/', '', `where.exe composer.phar`) : `which composer.phar`))
+$COMPOSER = file_exists($COMPOSER = $oldPwd.'/composer.phar') || ($COMPOSER = rtrim('\\' === DIRECTORY_SEPARATOR ? preg_replace('/[\r\n].*/', '', `where.exe composer.phar`) : `which composer.phar 2> /dev/null`))
     ? $PHP.' '.escapeshellarg($COMPOSER)
     : 'composer';
 

src/Symfony/Component/DependencyInjection/Compiler/InlineServiceDefinitionsPass.php

@@ -88,11 +88,15 @@ class InlineServiceDefinitionsPass extends AbstractRecursivePass implements Repe
      */
     private function isInlineableDefinition($id, Definition $definition, ServiceReferenceGraph $graph)
     {
+        if ($definition->getErrors() || $definition->isDeprecated() || $definition->isLazy() || $definition->isSynthetic()) {
+            return false;
+        }
+
         if (!$definition->isShared()) {
             return true;
         }
 
-        if ($definition->isDeprecated() || $definition->isPublic() || $definition->isLazy() || $definition->getErrors()) {
+        if ($definition->isPublic()) {
             return false;
         }
 

src/Symfony/Component/DependencyInjection/LazyProxy/ProxyHelper.php

@@ -54,17 +54,4 @@ class ProxyHelper
             return $prefix.$parent->name;
         }
     }
-
-    private static function export($value)
-    {
-        if (!is_array($value)) {
-            return var_export($value, true);
-        }
-        $code = array();
-        foreach ($value as $k => $v) {
-            $code[] = sprintf('%s => %s', var_export($k, true), self::export($v));
-        }
-
-        return sprintf('array(%s)', implode(', ', $code));
-    }
 }

src/Symfony/Component/DependencyInjection/Tests/Dumper/PhpDumperTest.php

@@ -11,7 +11,6 @@
 
 namespace Symfony\Component\DependencyInjection\Tests\Dumper;
 
-use DummyProxyDumper;
 use PHPUnit\Framework\TestCase;
 use Psr\Container\ContainerInterface;
 use Symfony\Component\Config\FileLocator;
@@ -530,6 +529,19 @@ class PhpDumperTest extends TestCase
         $this->assertStringEqualsFile(self::$fixturesPath.'/php/services13.php', $dumper->dump(), '->dump() dumps inline definitions which reference service_container');
     }
 
+    public function testNonSharedLazyDefinitionReferences()
+    {
+        $container = new ContainerBuilder();
+        $container->register('foo', 'stdClass')->setShared(false)->setLazy(true);
+        $container->register('bar', 'stdClass')->addArgument(new Reference('foo', ContainerBuilder::EXCEPTION_ON_INVALID_REFERENCE, false))->setPublic(true);
+        $container->compile();
+
+        $dumper = new PhpDumper($container);
+        $dumper->setProxyDumper(new \DummyProxyDumper());
+
+        $this->assertStringEqualsFile(self::$fixturesPath.'/php/services_non_shared_lazy.php', $dumper->dump());
+    }
+
     public function testInitializePropertiesBeforeMethodCalls()
     {
         require_once self::$fixturesPath.'/includes/classes.php';
@@ -598,7 +610,7 @@ class PhpDumperTest extends TestCase
 
         $dumper = new PhpDumper($container);
 
-        $dumper->setProxyDumper(new DummyProxyDumper());
+        $dumper->setProxyDumper(new \DummyProxyDumper());
         $dumper->dump();
 
         $this->addToAssertionCount(1);

src/Symfony/Component/DependencyInjection/Tests/Fixtures/includes/classes.php

@@ -85,17 +85,17 @@ class DummyProxyDumper implements ProxyDumper
 {
     public function isProxyCandidate(Definition $definition)
     {
-        return false;
+        return $definition->isLazy();
     }
 
     public function getProxyFactoryCode(Definition $definition, $id, $factoryCall = null)
     {
-        return '';
+        return "        // lazy factory\n\n";
     }
 
     public function getProxyCode(Definition $definition)
     {
-        return '';
+        return "// proxy code\n";
     }
 }
 

src/Symfony/Component/DependencyInjection/Tests/Fixtures/php/services_non_shared_lazy.php

@@ -0,0 +1,90 @@
+<?php
+
+use Symfony\Component\DependencyInjection\Argument\RewindableGenerator;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\DependencyInjection\Container;
+use Symfony\Component\DependencyInjection\Exception\InvalidArgumentException;
+use Symfony\Component\DependencyInjection\Exception\LogicException;
+use Symfony\Component\DependencyInjection\Exception\RuntimeException;
+use Symfony\Component\DependencyInjection\ParameterBag\FrozenParameterBag;
+
+/**
+ * This class has been auto-generated
+ * by the Symfony Dependency Injection Component.
+ *
+ * @final since Symfony 3.3
+ */
+class ProjectServiceContainer extends Container
+{
+    private $parameters;
+    private $targetDirs = array();
+
+    /**
+     * @internal but protected for BC on cache:clear
+     */
+    protected $privates = array();
+
+    public function __construct()
+    {
+        $this->services = $this->privates = array();
+        $this->methodMap = array(
+            'bar' => 'getBarService',
+        );
+
+        $this->aliases = array();
+    }
+
+    public function reset()
+    {
+        $this->privates = array();
+        parent::reset();
+    }
+
+    public function compile()
+    {
+        throw new LogicException('You cannot compile a dumped container that was already compiled.');
+    }
+
+    public function isCompiled()
+    {
+        return true;
+    }
+
+    public function getRemovedIds()
+    {
+        return array(
+            'Psr\\Container\\ContainerInterface' => true,
+            'Symfony\\Component\\DependencyInjection\\ContainerInterface' => true,
+            'foo' => true,
+        );
+    }
+
+    protected function createProxy($class, \Closure $factory)
+    {
+        return $factory();
+    }
+
+    /**
+     * Gets the public 'bar' shared service.
+     *
+     * @return \stdClass
+     */
+    protected function getBarService()
+    {
+        return $this->services['bar'] = new \stdClass($this->getFooService());
+    }
+
+    /**
+     * Gets the private 'foo' service.
+     *
+     * @return \stdClass
+     */
+    protected function getFooService($lazyLoad = true)
+    {
+        // lazy factory
+
+        return new \stdClass();
+    }
+}
+
+// proxy code

src/Symfony/Component/HttpFoundation/Tests/Fixtures/response-functional/common.inc

@@ -22,6 +22,10 @@ error_reporting(-1);
 ini_set('html_errors', 0);
 ini_set('display_errors', 1);
 
+if (ini_get('xdebug.default_enable')) {
+    xdebug_disable();
+}
+
 header_remove('X-Powered-By');
 header('Content-Type: text/plain; charset=utf-8');
 

src/Symfony/Component/HttpKernel/Kernel.php

@@ -79,18 +79,10 @@ abstract class Kernel implements KernelInterface, RebootableInterface, Terminabl
         $this->debug = $debug;
         $this->rootDir = $this->getRootDir();
         $this->name = $this->getName();
-
-        if ($this->debug) {
-            $this->startTime = microtime(true);
-        }
     }
 
     public function __clone()
     {
-        if ($this->debug) {
-            $this->startTime = microtime(true);
-        }
-
         $this->booted = false;
         $this->container = null;
         $this->requestStackSize = 0;
@@ -102,6 +94,10 @@ abstract class Kernel implements KernelInterface, RebootableInterface, Terminabl
      */
     public function boot()
     {
+        if ($this->debug) {
+            $this->startTime = microtime(true);
+        }
+
         if (true === $this->booted) {
             if (!$this->requestStackSize && $this->resetServices) {
                 if ($this->container->has('services_resetter')) {

src/Symfony/Component/HttpKernel/Tests/KernelTest.php

@@ -589,6 +589,21 @@ EOF;
         $this->assertEquals(1, ResettableService::$counter);
     }
 
+    /**
+     * @group time-sensitive
+     */
+    public function testKernelStartTimeIsResetWhileBootingAlreadyBootedKernel()
+    {
+        $kernel = $this->getKernelForTest(array('initializeBundles'), true);
+        $kernel->boot();
+        $preReBoot = $kernel->getStartTime();
+
+        sleep(3600); //Intentionally large value to detect if ClockMock ever breaks
+        $kernel->boot();
+
+        $this->assertGreaterThan($preReBoot, $kernel->getStartTime());
+    }
+
     /**
      * Returns a mock for the BundleInterface.
      *
@@ -658,10 +673,10 @@ EOF;
         return $kernel;
     }
 
-    protected function getKernelForTest(array $methods = array())
+    protected function getKernelForTest(array $methods = array(), $debug = false)
     {
         $kernel = $this->getMockBuilder('Symfony\Component\HttpKernel\Tests\Fixtures\KernelForTest')
-            ->setConstructorArgs(array('test', false))
+            ->setConstructorArgs(array('test', $debug))
             ->setMethods($methods)
             ->getMock();
         $p = new \ReflectionProperty($kernel, 'rootDir');

src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php

@@ -376,6 +376,7 @@ abstract class AbstractObjectNormalizer extends AbstractNormalizer
     {
         if (
             !isset($context[static::ENABLE_MAX_DEPTH]) ||
+            !$context[static::ENABLE_MAX_DEPTH] ||
             !isset($attributesMetadata[$attribute]) ||
             null === $maxDepth = $attributesMetadata[$attribute]->getMaxDepth()
         ) {

src/Symfony/Component/Validator/Resources/translations/validators.sl.xlf

@@ -314,6 +314,10 @@
                 <source>This is not a valid Business Identifier Code (BIC).</source>
                 <target>To ni veljavna identifikacijska koda podjetja (BIC).</target>
             </trans-unit>
+            <trans-unit id="82">
+                <source>Error</source>
+                <target>Napaka</target>
+            </trans-unit>
         </body>
     </file>
 </xliff>