Merge branch '2.3' into 2.6
* 2.3: bumped Symfony version to 2.3.28 updated VERSION for 2.3.27 update CONTRIBUTORS for 2.3.27 updated CHANGELOG for 2.3.27 isFromTrustedProxy to confirm request came from a trusted proxy. Safe escaping of fragments for eval() Conflicts: src/Symfony/Component/HttpFoundation/Request.php src/Symfony/Component/HttpKernel/HttpCache/Esi.php src/Symfony/Component/HttpKernel/Kernel.php
This commit is contained in:
commit
ec2cb961cc
@ -7,6 +7,16 @@ in 2.3 minor versions.
|
|||||||
To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
|
To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
|
||||||
To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v2.3.0...v2.3.1
|
To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v2.3.0...v2.3.1
|
||||||
|
|
||||||
|
* 2.3.27 (2015-04-01)
|
||||||
|
|
||||||
|
* security #14167 CVE-2015-2308 (nicolas-grekas)
|
||||||
|
* security #14166 CVE-2015-2309 (neclimdul)
|
||||||
|
* bug #14010 Replace GET parameters when changed in form (WouterJ)
|
||||||
|
* bug #13991 [Dependency Injection] Improve PhpDumper Performance for huge Containers (BattleRattle)
|
||||||
|
* bug #13997 [2.3+][Form][DoctrineBridge] Improved loading of entities and documents (guilhermeblanco)
|
||||||
|
* bug #13953 [Translation][MoFileLoader] fixed load empty translation. (aitboudad)
|
||||||
|
* bug #13912 [DependencyInjection] Highest precedence for user parameters (lyrixx)
|
||||||
|
|
||||||
* 2.3.26 (2015-03-17)
|
* 2.3.26 (2015-03-17)
|
||||||
|
|
||||||
* bug #13927 Fixing wrong variable name from #13519 (weaverryan)
|
* bug #13927 Fixing wrong variable name from #13519 (weaverryan)
|
||||||
|
@ -11,8 +11,8 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Jordi Boggiano (seldaek)
|
- Jordi Boggiano (seldaek)
|
||||||
- Johannes S (johannes)
|
- Johannes S (johannes)
|
||||||
- Kris Wallsmith (kriswallsmith)
|
- Kris Wallsmith (kriswallsmith)
|
||||||
- Christophe Coevoet (stof)
|
|
||||||
- Nicolas Grekas (nicolas-grekas)
|
- Nicolas Grekas (nicolas-grekas)
|
||||||
|
- Christophe Coevoet (stof)
|
||||||
- Jakub Zalas (jakubzalas)
|
- Jakub Zalas (jakubzalas)
|
||||||
- Pascal Borreli (pborreli)
|
- Pascal Borreli (pborreli)
|
||||||
- Hugo Hamon (hhamon)
|
- Hugo Hamon (hhamon)
|
||||||
@ -21,9 +21,9 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Ryan Weaver (weaverryan)
|
- Ryan Weaver (weaverryan)
|
||||||
- Lukas Kahwe Smith (lsmith)
|
- Lukas Kahwe Smith (lsmith)
|
||||||
- Romain Neutron (romain)
|
- Romain Neutron (romain)
|
||||||
|
- Christian Flothmann (xabbuh)
|
||||||
- Jeremy Mikola (jmikola)
|
- Jeremy Mikola (jmikola)
|
||||||
- Jean-François Simon (jfsimon)
|
- Jean-François Simon (jfsimon)
|
||||||
- Christian Flothmann (xabbuh)
|
|
||||||
- Benjamin Eberlei (beberlei)
|
- Benjamin Eberlei (beberlei)
|
||||||
- Igor Wiedler (igorw)
|
- Igor Wiedler (igorw)
|
||||||
- Martin Hasoň (hason)
|
- Martin Hasoň (hason)
|
||||||
@ -37,16 +37,16 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- stealth35 (stealth35)
|
- stealth35 (stealth35)
|
||||||
- Alexander Mols (asm89)
|
- Alexander Mols (asm89)
|
||||||
- Bulat Shakirzyanov (avalanche123)
|
- Bulat Shakirzyanov (avalanche123)
|
||||||
|
- Abdellatif Ait boudad (aitboudad)
|
||||||
- Francis Besset (francisbesset)
|
- Francis Besset (francisbesset)
|
||||||
- Saša Stamenković (umpirsky)
|
- Saša Stamenković (umpirsky)
|
||||||
- Henrik Bjørnskov (henrikbjorn)
|
- Henrik Bjørnskov (henrikbjorn)
|
||||||
- Miha Vrhovnik
|
- Miha Vrhovnik
|
||||||
|
- Kévin Dunglas (dunglas)
|
||||||
|
- Sarah Khalil (saro0h)
|
||||||
- Konstantin Kudryashov (everzet)
|
- Konstantin Kudryashov (everzet)
|
||||||
- Bilal Amarni (bamarni)
|
- Bilal Amarni (bamarni)
|
||||||
- Kévin Dunglas (dunglas)
|
|
||||||
- Florin Patan (florinpatan)
|
- Florin Patan (florinpatan)
|
||||||
- Abdellatif Ait Boudad (aitboudad)
|
|
||||||
- Sarah Khalil (saro0h)
|
|
||||||
- Eric Clemmons (ericclemmons)
|
- Eric Clemmons (ericclemmons)
|
||||||
- Andrej Hudec (pulzarraider)
|
- Andrej Hudec (pulzarraider)
|
||||||
- Deni
|
- Deni
|
||||||
@ -61,13 +61,14 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Daniel Holmes (dholmes)
|
- Daniel Holmes (dholmes)
|
||||||
- Bart van den Burg (burgov)
|
- Bart van den Burg (burgov)
|
||||||
- Jordan Alliot (jalliot)
|
- Jordan Alliot (jalliot)
|
||||||
|
- Kevin Bond (kbond)
|
||||||
- John Wards (johnwards)
|
- John Wards (johnwards)
|
||||||
- Fran Moreno (franmomu)
|
- Fran Moreno (franmomu)
|
||||||
- Antoine Hérault (herzult)
|
|
||||||
- Kevin Bond (kbond)
|
|
||||||
- Toni Uebernickel (havvg)
|
|
||||||
- Luis Cordova (cordoval)
|
- Luis Cordova (cordoval)
|
||||||
|
- Antoine Hérault (herzult)
|
||||||
|
- Toni Uebernickel (havvg)
|
||||||
- Arnaud Le Blanc (arnaud-lb)
|
- Arnaud Le Blanc (arnaud-lb)
|
||||||
|
- Gábor Egyed (1ed)
|
||||||
- Tim Nagel (merk)
|
- Tim Nagel (merk)
|
||||||
- Brice BERNARD (brikou)
|
- Brice BERNARD (brikou)
|
||||||
- marc.weistroff
|
- marc.weistroff
|
||||||
@ -78,7 +79,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Colin Frei
|
- Colin Frei
|
||||||
- Jérôme Tamarelle (gromnan)
|
- Jérôme Tamarelle (gromnan)
|
||||||
- Adrien Brault (adrienbrault)
|
- Adrien Brault (adrienbrault)
|
||||||
- Gábor Egyed (1ed)
|
|
||||||
- excelwebzone
|
- excelwebzone
|
||||||
- Jacob Dreesen (jdreesen)
|
- Jacob Dreesen (jdreesen)
|
||||||
- Fabien Pennequin (fabienpennequin)
|
- Fabien Pennequin (fabienpennequin)
|
||||||
@ -93,26 +93,29 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Daniel Gomes (danielcsgomes)
|
- Daniel Gomes (danielcsgomes)
|
||||||
- Hidenori Goto (hidenorigoto)
|
- Hidenori Goto (hidenorigoto)
|
||||||
- David Buchmann (dbu)
|
- David Buchmann (dbu)
|
||||||
|
- Guilherme Blanco (guilhermeblanco)
|
||||||
- Jérémy DERUSSÉ (jderusse)
|
- Jérémy DERUSSÉ (jderusse)
|
||||||
- Pablo Godel (pgodel)
|
- Pablo Godel (pgodel)
|
||||||
- Eric GELOEN (gelo)
|
- Eric GELOEN (gelo)
|
||||||
- Jérémie Augustin (jaugustin)
|
- Jérémie Augustin (jaugustin)
|
||||||
- Rafael Dohms (rdohms)
|
- Rafael Dohms (rdohms)
|
||||||
- Guilherme Blanco (guilhermeblanco)
|
|
||||||
- Tigran Azatyan (tigranazatyan)
|
- Tigran Azatyan (tigranazatyan)
|
||||||
- Javier Eguiluz (javier.eguiluz)
|
- Javier Eguiluz (javier.eguiluz)
|
||||||
- Arnaud Kleinpeter (nanocom)
|
- Arnaud Kleinpeter (nanocom)
|
||||||
- Richard Shank (iampersistent)
|
- Richard Shank (iampersistent)
|
||||||
|
- Dariusz Ruminski
|
||||||
- Clemens Tolboom
|
- Clemens Tolboom
|
||||||
- Helmer Aaviksoo
|
- Helmer Aaviksoo
|
||||||
- Sebastiaan Stok (sstok)
|
- Sebastiaan Stok (sstok)
|
||||||
- Hiromi Hishida (77web)
|
- Hiromi Hishida (77web)
|
||||||
- Matthieu Ouellette-Vachon (maoueh)
|
- Matthieu Ouellette-Vachon (maoueh)
|
||||||
- Michał Pipa (michal.pipa)
|
- Michał Pipa (michal.pipa)
|
||||||
|
- Issei Murasawa (issei_m)
|
||||||
- Amal Raghav (kertz)
|
- Amal Raghav (kertz)
|
||||||
- Jonathan Ingram (jonathaningram)
|
- Jonathan Ingram (jonathaningram)
|
||||||
- Artur Kotyrba
|
- Artur Kotyrba
|
||||||
- Rouven Weßling (realityking)
|
- Rouven Weßling (realityking)
|
||||||
|
- Andréia Bohner (andreia)
|
||||||
- Dmitrii Chekaliuk (lazyhammer)
|
- Dmitrii Chekaliuk (lazyhammer)
|
||||||
- Clément JOBEILI (dator)
|
- Clément JOBEILI (dator)
|
||||||
- Dorian Villet (gnutix)
|
- Dorian Villet (gnutix)
|
||||||
@ -123,14 +126,12 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Benjamin Dulau (dbenjamin)
|
- Benjamin Dulau (dbenjamin)
|
||||||
- Matthias Pigulla (mpdude)
|
- Matthias Pigulla (mpdude)
|
||||||
- Andreas Hucks (meandmymonkey)
|
- Andreas Hucks (meandmymonkey)
|
||||||
- Andréia Bohner (andreia)
|
|
||||||
- Noel Guilbert (noel)
|
- Noel Guilbert (noel)
|
||||||
- Joel Wurtz (brouznouf)
|
- Joel Wurtz (brouznouf)
|
||||||
- Charles Sarrazin (csarrazi)
|
- Charles Sarrazin (csarrazi)
|
||||||
- bronze1man
|
- bronze1man
|
||||||
- sun (sun)
|
- sun (sun)
|
||||||
- Larry Garfield (crell)
|
- Larry Garfield (crell)
|
||||||
- Issei Murasawa (issei_m)
|
|
||||||
- Martin Schuhfuß (usefulthink)
|
- Martin Schuhfuß (usefulthink)
|
||||||
- Thomas Rabaix (rande)
|
- Thomas Rabaix (rande)
|
||||||
- Matthieu Bontemps (mbontemps)
|
- Matthieu Bontemps (mbontemps)
|
||||||
@ -163,6 +164,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Xavier Montaña Carreras (xmontana)
|
- Xavier Montaña Carreras (xmontana)
|
||||||
- Michele Orselli (orso)
|
- Michele Orselli (orso)
|
||||||
- Chris Wilkinson (thewilkybarkid)
|
- Chris Wilkinson (thewilkybarkid)
|
||||||
|
- Joshua Thijssen
|
||||||
- Xavier Perez
|
- Xavier Perez
|
||||||
- Arjen Brouwer (arjenjb)
|
- Arjen Brouwer (arjenjb)
|
||||||
- Katsuhiro OGAWA
|
- Katsuhiro OGAWA
|
||||||
@ -181,16 +183,18 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Jeremy Livingston (jeremylivingston)
|
- Jeremy Livingston (jeremylivingston)
|
||||||
- Nikita Konstantinov
|
- Nikita Konstantinov
|
||||||
- Wodor Wodorski
|
- Wodor Wodorski
|
||||||
|
- Matthieu Auger (matthieuauger)
|
||||||
- julien pauli (jpauli)
|
- julien pauli (jpauli)
|
||||||
- Beau Simensen (simensen)
|
- Beau Simensen (simensen)
|
||||||
- Robert Kiss (kepten)
|
- Robert Kiss (kepten)
|
||||||
|
- John Kary (johnkary)
|
||||||
- Ruben Gonzalez (rubenrua)
|
- Ruben Gonzalez (rubenrua)
|
||||||
- Kim Hemsø Rasmussen (kimhemsoe)
|
- Kim Hemsø Rasmussen (kimhemsoe)
|
||||||
- Florian Lonqueu-Brochard (florianlb)
|
- Florian Lonqueu-Brochard (florianlb)
|
||||||
- Tom Van Looy (tvlooy)
|
- Tom Van Looy (tvlooy)
|
||||||
- Wouter Van Hecke
|
- Wouter Van Hecke
|
||||||
- Joshua Thijssen
|
|
||||||
- Peter Kruithof (pkruithof)
|
- Peter Kruithof (pkruithof)
|
||||||
|
- Vladimir Reznichenko (kalessil)
|
||||||
- Michael Holm (hollo)
|
- Michael Holm (hollo)
|
||||||
- Warnar Boekkooi (boekkooi)
|
- Warnar Boekkooi (boekkooi)
|
||||||
- Marc Weistroff (futurecat)
|
- Marc Weistroff (futurecat)
|
||||||
@ -222,7 +226,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Marco Pivetta (ocramius)
|
- Marco Pivetta (ocramius)
|
||||||
- Ricard Clau (ricardclau)
|
- Ricard Clau (ricardclau)
|
||||||
- Erin Millard
|
- Erin Millard
|
||||||
- John Kary (johnkary)
|
|
||||||
- Matthew Lewinski (lewinski)
|
- Matthew Lewinski (lewinski)
|
||||||
- alquerci
|
- alquerci
|
||||||
- Francesco Levorato
|
- Francesco Levorato
|
||||||
@ -232,7 +235,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Inal DJAFAR (inalgnu)
|
- Inal DJAFAR (inalgnu)
|
||||||
- Christian Gärtner (dagardner)
|
- Christian Gärtner (dagardner)
|
||||||
- Felix Labrecque
|
- Felix Labrecque
|
||||||
- Vladimir Reznichenko (kalessil)
|
|
||||||
- Yaroslav Kiliba
|
- Yaroslav Kiliba
|
||||||
- Sébastien Lavoie (lavoiesl)
|
- Sébastien Lavoie (lavoiesl)
|
||||||
- Terje Bråten
|
- Terje Bråten
|
||||||
@ -283,7 +285,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Brian King
|
- Brian King
|
||||||
- Michel Salib (michelsalib)
|
- Michel Salib (michelsalib)
|
||||||
- geoffrey
|
- geoffrey
|
||||||
- Matthieu Auger (matthieuauger)
|
|
||||||
- Lorenz Schori
|
- Lorenz Schori
|
||||||
- Jeanmonod David (jeanmonod)
|
- Jeanmonod David (jeanmonod)
|
||||||
- Jan Schumann
|
- Jan Schumann
|
||||||
@ -309,7 +310,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Christian Schmidt
|
- Christian Schmidt
|
||||||
- Marcin Sikoń (marphi)
|
- Marcin Sikoń (marphi)
|
||||||
- franek (franek)
|
- franek (franek)
|
||||||
- Dariusz Ruminski
|
|
||||||
- Adam Harvey
|
- Adam Harvey
|
||||||
- Diego Saint Esteben (dii3g0)
|
- Diego Saint Esteben (dii3g0)
|
||||||
- Alex Bakhturin
|
- Alex Bakhturin
|
||||||
@ -336,6 +336,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- mmoreram
|
- mmoreram
|
||||||
- Markus Lanthaler (lanthaler)
|
- Markus Lanthaler (lanthaler)
|
||||||
- Vicent Soria Durá (vicentgodella)
|
- Vicent Soria Durá (vicentgodella)
|
||||||
|
- Anthony Ferrara
|
||||||
- Ioan Negulescu
|
- Ioan Negulescu
|
||||||
- Jakub Škvára (jskvara)
|
- Jakub Škvára (jskvara)
|
||||||
- Daniel Beyer
|
- Daniel Beyer
|
||||||
@ -343,9 +344,11 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- alexpods
|
- alexpods
|
||||||
- Erik Trapman (eriktrapman)
|
- Erik Trapman (eriktrapman)
|
||||||
- De Cock Xavier (xdecock)
|
- De Cock Xavier (xdecock)
|
||||||
|
- Scott Arciszewski
|
||||||
- Norbert Orzechowicz (norzechowicz)
|
- Norbert Orzechowicz (norzechowicz)
|
||||||
- Tobias Nyholm (tobias)
|
- Tobias Nyholm (tobias)
|
||||||
- Matthijs van den Bos (matthijs)
|
- Matthijs van den Bos (matthijs)
|
||||||
|
- Loick Piera (pyrech)
|
||||||
- Lenard Palko
|
- Lenard Palko
|
||||||
- Nils Adermann (naderman)
|
- Nils Adermann (naderman)
|
||||||
- Gábor Fási
|
- Gábor Fási
|
||||||
@ -371,9 +374,11 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Zach Badgett (zachbadgett)
|
- Zach Badgett (zachbadgett)
|
||||||
- Aurélien Fredouelle
|
- Aurélien Fredouelle
|
||||||
- Pavel Campr (pcampr)
|
- Pavel Campr (pcampr)
|
||||||
|
- Maxime Steinhausser (ogizanagi)
|
||||||
- Disquedur
|
- Disquedur
|
||||||
- Geoffrey Tran (geoff)
|
- Geoffrey Tran (geoff)
|
||||||
- Jan Behrens
|
- Jan Behrens
|
||||||
|
- Mantas Var (mvar)
|
||||||
- Sebastian Krebs
|
- Sebastian Krebs
|
||||||
- Christopher Davis (chrisguitarguy)
|
- Christopher Davis (chrisguitarguy)
|
||||||
- Thomas Lallement (raziel057)
|
- Thomas Lallement (raziel057)
|
||||||
@ -387,6 +392,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Max Rath (drak3)
|
- Max Rath (drak3)
|
||||||
- Stéphane Escandell (sescandell)
|
- Stéphane Escandell (sescandell)
|
||||||
- Sinan Eldem
|
- Sinan Eldem
|
||||||
|
- Alexandre Dupuy (satchette)
|
||||||
- Nahuel Cuesta (ncuesta)
|
- Nahuel Cuesta (ncuesta)
|
||||||
- Chris Boden (cboden)
|
- Chris Boden (cboden)
|
||||||
- Asmir Mustafic (goetas)
|
- Asmir Mustafic (goetas)
|
||||||
@ -484,7 +490,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Xavier Lacot (xavier)
|
- Xavier Lacot (xavier)
|
||||||
- Olivier Maisonneuve (olineuve)
|
- Olivier Maisonneuve (olineuve)
|
||||||
- Francis Turmel (fturmel)
|
- Francis Turmel (fturmel)
|
||||||
- Loick Piera (pyrech)
|
|
||||||
- cgonzalez
|
- cgonzalez
|
||||||
- Ben
|
- Ben
|
||||||
- Jayson Xu (superjavason)
|
- Jayson Xu (superjavason)
|
||||||
@ -506,6 +511,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Fabian Vogler (fabian)
|
- Fabian Vogler (fabian)
|
||||||
- Korvin Szanto
|
- Korvin Szanto
|
||||||
- Maksim Kotlyar (makasim)
|
- Maksim Kotlyar (makasim)
|
||||||
|
- Ivan Kurnosov
|
||||||
- Neil Ferreira
|
- Neil Ferreira
|
||||||
- Dmitry Parnas (parnas)
|
- Dmitry Parnas (parnas)
|
||||||
- DQNEO
|
- DQNEO
|
||||||
@ -516,6 +522,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- David Romaní
|
- David Romaní
|
||||||
- Patrick Allaert
|
- Patrick Allaert
|
||||||
- Gustavo Falco (gfalco)
|
- Gustavo Falco (gfalco)
|
||||||
|
- Matt Robinson (inanimatt)
|
||||||
- Aleksey Podskrebyshev
|
- Aleksey Podskrebyshev
|
||||||
- David Marín Carreño (davefx)
|
- David Marín Carreño (davefx)
|
||||||
- Jörn Lang (j.lang)
|
- Jörn Lang (j.lang)
|
||||||
@ -580,6 +587,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Michael Tibben
|
- Michael Tibben
|
||||||
- Sander Marechal
|
- Sander Marechal
|
||||||
- Radosław Benkel
|
- Radosław Benkel
|
||||||
|
- Marcos Sánchez
|
||||||
- ttomor
|
- ttomor
|
||||||
- Mei Gwilym (meigwilym)
|
- Mei Gwilym (meigwilym)
|
||||||
- Michael H. Arieli (excelwebzone)
|
- Michael H. Arieli (excelwebzone)
|
||||||
@ -622,6 +630,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- nacho
|
- nacho
|
||||||
- Piotr Antosik (antek88)
|
- Piotr Antosik (antek88)
|
||||||
- Artem Lopata
|
- Artem Lopata
|
||||||
|
- Samuel ROZE (sroze)
|
||||||
- Marcos Quesada (marcos_quesada)
|
- Marcos Quesada (marcos_quesada)
|
||||||
- Matthew Vickery (mattvick)
|
- Matthew Vickery (mattvick)
|
||||||
- Dan Finnie
|
- Dan Finnie
|
||||||
@ -675,6 +684,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Yannick
|
- Yannick
|
||||||
- Eduardo García Sanz (coma)
|
- Eduardo García Sanz (coma)
|
||||||
- Sebastian Grodzicki (sgrodzicki)
|
- Sebastian Grodzicki (sgrodzicki)
|
||||||
|
- Michael Lee (zerustech)
|
||||||
- Roy Van Ginneken
|
- Roy Van Ginneken
|
||||||
- David de Boer (ddeboer)
|
- David de Boer (ddeboer)
|
||||||
- Gilles Doge (gido)
|
- Gilles Doge (gido)
|
||||||
@ -721,6 +731,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Malaney J. Hill
|
- Malaney J. Hill
|
||||||
- Christian Flach (cmfcmf)
|
- Christian Flach (cmfcmf)
|
||||||
- Cédric Girard (enk_)
|
- Cédric Girard (enk_)
|
||||||
|
- Lars Ambrosius Wallenborn (larsborn)
|
||||||
- Oriol Mangas Abellan (oriolman)
|
- Oriol Mangas Abellan (oriolman)
|
||||||
- Sebastian Göttschkes (sgoettschkes)
|
- Sebastian Göttschkes (sgoettschkes)
|
||||||
- Tatsuya Tsuruoka
|
- Tatsuya Tsuruoka
|
||||||
@ -847,6 +858,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Gunnar Lium (gunnarlium)
|
- Gunnar Lium (gunnarlium)
|
||||||
- Tiago Garcia (tiagojsag)
|
- Tiago Garcia (tiagojsag)
|
||||||
- Artiom
|
- Artiom
|
||||||
|
- Jakub Simon
|
||||||
- Bouke Haarsma
|
- Bouke Haarsma
|
||||||
- Martin Eckhardt
|
- Martin Eckhardt
|
||||||
- Denis Zunke
|
- Denis Zunke
|
||||||
@ -876,7 +888,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Vasily Khayrulin (sirian)
|
- Vasily Khayrulin (sirian)
|
||||||
- Stefan Koopmanschap (skoop)
|
- Stefan Koopmanschap (skoop)
|
||||||
- Stefan Hüsges (tronsha)
|
- Stefan Hüsges (tronsha)
|
||||||
- Ivan Kurnosov
|
|
||||||
- stloyd
|
- stloyd
|
||||||
- Chris Tickner
|
- Chris Tickner
|
||||||
- Andrew Coulton
|
- Andrew Coulton
|
||||||
@ -905,7 +916,6 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Julius Beckmann
|
- Julius Beckmann
|
||||||
- Romain Dorgueil
|
- Romain Dorgueil
|
||||||
- Grayson Koonce (breerly)
|
- Grayson Koonce (breerly)
|
||||||
- Matt Robinson (inanimatt)
|
|
||||||
- Karim Cassam Chenaï (ka)
|
- Karim Cassam Chenaï (ka)
|
||||||
- Nicolas Bastien (nicolas_bastien)
|
- Nicolas Bastien (nicolas_bastien)
|
||||||
- Andy Stanberry
|
- Andy Stanberry
|
||||||
@ -992,6 +1002,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- grifx
|
- grifx
|
||||||
- Robert Campbell
|
- Robert Campbell
|
||||||
- Matt Lehner
|
- Matt Lehner
|
||||||
|
- Hidde Wieringa
|
||||||
- Hein Zaw Htet™
|
- Hein Zaw Htet™
|
||||||
- Ruben Kruiswijk
|
- Ruben Kruiswijk
|
||||||
- Michael J
|
- Michael J
|
||||||
@ -1048,9 +1059,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Muriel (metalmumu)
|
- Muriel (metalmumu)
|
||||||
- Michaël Perrin (michael.perrin)
|
- Michaël Perrin (michael.perrin)
|
||||||
- Michael Pohlers (mick_the_big)
|
- Michael Pohlers (mick_the_big)
|
||||||
- Mantas Var (mvar)
|
|
||||||
- Cayetano Soriano Gallego (neoshadybeat)
|
- Cayetano Soriano Gallego (neoshadybeat)
|
||||||
- Maxime Steinhausser (ogizanagi)
|
|
||||||
- Pablo Monterde Perez (plebs)
|
- Pablo Monterde Perez (plebs)
|
||||||
- Jimmy Leger (redpanda)
|
- Jimmy Leger (redpanda)
|
||||||
- Cyrille Jouineau (tuxosaurus)
|
- Cyrille Jouineau (tuxosaurus)
|
||||||
@ -1128,6 +1137,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Brian Freytag
|
- Brian Freytag
|
||||||
- Skorney
|
- Skorney
|
||||||
- mieszko4
|
- mieszko4
|
||||||
|
- Neophy7e
|
||||||
- Arrilot
|
- Arrilot
|
||||||
- Markus Staab
|
- Markus Staab
|
||||||
- Pierre-Louis LAUNAY
|
- Pierre-Louis LAUNAY
|
||||||
@ -1140,6 +1150,8 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Sema
|
- Sema
|
||||||
- Thorsten Hallwas
|
- Thorsten Hallwas
|
||||||
- Michael Squires
|
- Michael Squires
|
||||||
|
- Norman Soetbeer
|
||||||
|
- Benjamin Long
|
||||||
- Matt Janssen
|
- Matt Janssen
|
||||||
- Peter Gribanov
|
- Peter Gribanov
|
||||||
- kwiateusz
|
- kwiateusz
|
||||||
@ -1235,6 +1247,7 @@ Symfony is the result of the work of many people who made the code better
|
|||||||
- Vincent (vincent1870)
|
- Vincent (vincent1870)
|
||||||
- Eugene Babushkin (warl)
|
- Eugene Babushkin (warl)
|
||||||
- Xavier Amado (xamado)
|
- Xavier Amado (xamado)
|
||||||
|
- Jesper Søndergaard Pedersen (zerrvox)
|
||||||
- Florent Cailhol
|
- Florent Cailhol
|
||||||
- szymek
|
- szymek
|
||||||
- craigmarvelley
|
- craigmarvelley
|
||||||
|
@ -825,7 +825,7 @@ class Request
|
|||||||
{
|
{
|
||||||
$ip = $this->server->get('REMOTE_ADDR');
|
$ip = $this->server->get('REMOTE_ADDR');
|
||||||
|
|
||||||
if (!self::$trustedProxies) {
|
if (!$this->isFromTrustedProxy()) {
|
||||||
return array($ip);
|
return array($ip);
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -991,7 +991,7 @@ class Request
|
|||||||
*/
|
*/
|
||||||
public function getPort()
|
public function getPort()
|
||||||
{
|
{
|
||||||
if (self::$trustedProxies) {
|
if ($this->isFromTrustedProxy()) {
|
||||||
if (self::$trustedHeaders[self::HEADER_CLIENT_PORT] && $port = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PORT])) {
|
if (self::$trustedHeaders[self::HEADER_CLIENT_PORT] && $port = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PORT])) {
|
||||||
return $port;
|
return $port;
|
||||||
}
|
}
|
||||||
@ -1172,7 +1172,7 @@ class Request
|
|||||||
*/
|
*/
|
||||||
public function isSecure()
|
public function isSecure()
|
||||||
{
|
{
|
||||||
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
|
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
|
||||||
return in_array(strtolower(current(explode(',', $proto))), array('https', 'on', 'ssl', '1'));
|
return in_array(strtolower(current(explode(',', $proto))), array('https', 'on', 'ssl', '1'));
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -1200,7 +1200,7 @@ class Request
|
|||||||
*/
|
*/
|
||||||
public function getHost()
|
public function getHost()
|
||||||
{
|
{
|
||||||
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
|
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
|
||||||
$elements = explode(',', $host);
|
$elements = explode(',', $host);
|
||||||
|
|
||||||
$host = $elements[count($elements) - 1];
|
$host = $elements[count($elements) - 1];
|
||||||
@ -1917,4 +1917,9 @@ class Request
|
|||||||
|
|
||||||
return new static($query, $request, $attributes, $cookies, $files, $server, $content);
|
return new static($query, $request, $attributes, $cookies, $files, $server, $content);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
private function isFromTrustedProxy()
|
||||||
|
{
|
||||||
|
return self::$trustedProxies && IpUtils::checkIp($this->server->get('REMOTE_ADDR'), self::$trustedProxies);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
@ -723,35 +723,37 @@ class RequestTest extends \PHPUnit_Framework_TestCase
|
|||||||
'HTTP_X_FORWARDED_PROTO' => 'https',
|
'HTTP_X_FORWARDED_PROTO' => 'https',
|
||||||
'HTTP_X_FORWARDED_PORT' => '8443',
|
'HTTP_X_FORWARDED_PORT' => '8443',
|
||||||
));
|
));
|
||||||
$port = $request->getPort();
|
$this->assertEquals(80, $request->getPort(), 'With PROTO and PORT on untrusted connection server value takes precedence.');
|
||||||
|
$request->server->set('REMOTE_ADDR', '1.1.1.1');
|
||||||
$this->assertEquals(8443, $port, 'With PROTO and PORT set PORT takes precedence.');
|
$this->assertEquals(8443, $request->getPort(), 'With PROTO and PORT set PORT takes precedence.');
|
||||||
|
|
||||||
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
||||||
'HTTP_X_FORWARDED_PROTO' => 'https',
|
'HTTP_X_FORWARDED_PROTO' => 'https',
|
||||||
));
|
));
|
||||||
$port = $request->getPort();
|
$this->assertEquals(80, $request->getPort(), 'With only PROTO set getPort() ignores trusted headers on untrusted connection.');
|
||||||
|
$request->server->set('REMOTE_ADDR', '1.1.1.1');
|
||||||
$this->assertEquals(443, $port, 'With only PROTO set getPort() defaults to 443.');
|
$this->assertEquals(443, $request->getPort(), 'With only PROTO set getPort() defaults to 443.');
|
||||||
|
|
||||||
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
||||||
'HTTP_X_FORWARDED_PROTO' => 'http',
|
'HTTP_X_FORWARDED_PROTO' => 'http',
|
||||||
));
|
));
|
||||||
$port = $request->getPort();
|
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() ignores trusted headers on untrusted connection.');
|
||||||
|
$request->server->set('REMOTE_ADDR', '1.1.1.1');
|
||||||
$this->assertEquals(80, $port, 'If X_FORWARDED_PROTO is set to HTTP return 80.');
|
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() returns port of the original request.');
|
||||||
|
|
||||||
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
||||||
'HTTP_X_FORWARDED_PROTO' => 'On',
|
'HTTP_X_FORWARDED_PROTO' => 'On',
|
||||||
));
|
));
|
||||||
$port = $request->getPort();
|
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is On, getPort() ignores trusted headers on untrusted connection.');
|
||||||
$this->assertEquals(443, $port, 'With only PROTO set and value is On, getPort() defaults to 443.');
|
$request->server->set('REMOTE_ADDR', '1.1.1.1');
|
||||||
|
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is On, getPort() defaults to 443.');
|
||||||
|
|
||||||
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
||||||
'HTTP_X_FORWARDED_PROTO' => '1',
|
'HTTP_X_FORWARDED_PROTO' => '1',
|
||||||
));
|
));
|
||||||
$port = $request->getPort();
|
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is 1, getPort() ignores trusted headers on untrusted connection.');
|
||||||
$this->assertEquals(443, $port, 'With only PROTO set and value is 1, getPort() defaults to 443.');
|
$request->server->set('REMOTE_ADDR', '1.1.1.1');
|
||||||
|
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is 1, getPort() defaults to 443.');
|
||||||
|
|
||||||
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
|
||||||
'HTTP_X_FORWARDED_PROTO' => 'something-else',
|
'HTTP_X_FORWARDED_PROTO' => 'something-else',
|
||||||
@ -1021,6 +1023,8 @@ class RequestTest extends \PHPUnit_Framework_TestCase
|
|||||||
$request->headers->set('X_FORWARDED_PROTO', 'https');
|
$request->headers->set('X_FORWARDED_PROTO', 'https');
|
||||||
|
|
||||||
Request::setTrustedProxies(array('1.1.1.1'));
|
Request::setTrustedProxies(array('1.1.1.1'));
|
||||||
|
$this->assertFalse($request->isSecure());
|
||||||
|
$request->server->set('REMOTE_ADDR', '1.1.1.1');
|
||||||
$this->assertTrue($request->isSecure());
|
$this->assertTrue($request->isSecure());
|
||||||
Request::setTrustedProxies(array());
|
Request::setTrustedProxies(array());
|
||||||
|
|
||||||
@ -1480,7 +1484,15 @@ class RequestTest extends \PHPUnit_Framework_TestCase
|
|||||||
$this->assertEquals(443, $request->getPort());
|
$this->assertEquals(443, $request->getPort());
|
||||||
$this->assertTrue($request->isSecure());
|
$this->assertTrue($request->isSecure());
|
||||||
|
|
||||||
|
// trusted proxy via setTrustedProxies()
|
||||||
|
Request::setTrustedProxies(array('3.3.3.4', '2.2.2.2'));
|
||||||
|
$this->assertEquals('3.3.3.3', $request->getClientIp());
|
||||||
|
$this->assertEquals('example.com', $request->getHost());
|
||||||
|
$this->assertEquals(80, $request->getPort());
|
||||||
|
$this->assertFalse($request->isSecure());
|
||||||
|
|
||||||
// check various X_FORWARDED_PROTO header values
|
// check various X_FORWARDED_PROTO header values
|
||||||
|
Request::setTrustedProxies(array('3.3.3.3', '2.2.2.2'));
|
||||||
$request->headers->set('X_FORWARDED_PROTO', 'ssl');
|
$request->headers->set('X_FORWARDED_PROTO', 'ssl');
|
||||||
$this->assertTrue($request->isSecure());
|
$this->assertTrue($request->isSecure());
|
||||||
|
|
||||||
|
@ -29,6 +29,10 @@ use Symfony\Component\HttpKernel\HttpKernelInterface;
|
|||||||
class Esi implements SurrogateInterface
|
class Esi implements SurrogateInterface
|
||||||
{
|
{
|
||||||
private $contentTypes;
|
private $contentTypes;
|
||||||
|
private $phpEscapeMap = array(
|
||||||
|
array('<?', '<%', '<s', '<S'),
|
||||||
|
array('<?php echo "<?"; ?>', '<?php echo "<%"; ?>', '<?php echo "<s"; ?>', '<?php echo "<S"; ?>'),
|
||||||
|
);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Constructor.
|
* Constructor.
|
||||||
@ -203,10 +207,34 @@ class Esi implements SurrogateInterface
|
|||||||
|
|
||||||
// we don't use a proper XML parser here as we can have ESI tags in a plain text response
|
// we don't use a proper XML parser here as we can have ESI tags in a plain text response
|
||||||
$content = $response->getContent();
|
$content = $response->getContent();
|
||||||
$content = str_replace(array('<?', '<%'), array('<?php echo "<?"; ?>', '<?php echo "<%"; ?>'), $content);
|
|
||||||
$content = preg_replace_callback('#<esi\:include\s+(.*?)\s*(?:/|</esi\:include)>#', array($this, 'handleEsiIncludeTag'), $content);
|
|
||||||
$content = preg_replace('#<esi\:comment[^>]*(?:/|</esi\:comment)>#', '', $content);
|
|
||||||
$content = preg_replace('#<esi\:remove>.*?</esi\:remove>#', '', $content);
|
$content = preg_replace('#<esi\:remove>.*?</esi\:remove>#', '', $content);
|
||||||
|
$content = preg_replace('#<esi\:comment[^>]*(?:/|</esi\:comment)>#', '', $content);
|
||||||
|
|
||||||
|
$chunks = preg_split('#<esi\:include\s+(.*?)\s*(?:/|</esi\:include)>#', $content, -1, PREG_SPLIT_DELIM_CAPTURE);
|
||||||
|
$chunks[0] = str_replace($this->phpEscapeMap[0], $this->phpEscapeMap[1], $chunks[0]);
|
||||||
|
|
||||||
|
$i = 1;
|
||||||
|
while (isset($chunks[$i])) {
|
||||||
|
$options = array();
|
||||||
|
preg_match_all('/(src|onerror|alt)="([^"]*?)"/', $chunks[$i], $matches, PREG_SET_ORDER);
|
||||||
|
foreach ($matches as $set) {
|
||||||
|
$options[$set[1]] = $set[2];
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!isset($options['src'])) {
|
||||||
|
throw new \RuntimeException('Unable to process an ESI tag without a "src" attribute.');
|
||||||
|
}
|
||||||
|
|
||||||
|
$chunks[$i] = sprintf('<?php echo $this->surrogate->handle($this, %s, %s, %s) ?>'."\n",
|
||||||
|
var_export($options['src'], true),
|
||||||
|
var_export(isset($options['alt']) ? $options['alt'] : '', true),
|
||||||
|
isset($options['onerror']) && 'continue' == $options['onerror'] ? 'true' : 'false'
|
||||||
|
);
|
||||||
|
++$i;
|
||||||
|
$chunks[$i] = str_replace($this->phpEscapeMap[0], $this->phpEscapeMap[1], $chunks[$i]);
|
||||||
|
++$i;
|
||||||
|
}
|
||||||
|
$content = implode('', $chunks);
|
||||||
|
|
||||||
$response->setContent($content);
|
$response->setContent($content);
|
||||||
$response->headers->set('X-Body-Eval', 'ESI');
|
$response->headers->set('X-Body-Eval', 'ESI');
|
||||||
@ -259,32 +287,4 @@ class Esi implements SurrogateInterface
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Handles an ESI include tag (called internally).
|
|
||||||
*
|
|
||||||
* @param array $attributes An array containing the attributes.
|
|
||||||
*
|
|
||||||
* @return string The response content for the include.
|
|
||||||
*
|
|
||||||
* @throws \RuntimeException
|
|
||||||
*/
|
|
||||||
private function handleEsiIncludeTag($attributes)
|
|
||||||
{
|
|
||||||
$options = array();
|
|
||||||
preg_match_all('/(src|onerror|alt)="([^"]*?)"/', $attributes[1], $matches, PREG_SET_ORDER);
|
|
||||||
foreach ($matches as $set) {
|
|
||||||
$options[$set[1]] = $set[2];
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isset($options['src'])) {
|
|
||||||
throw new \RuntimeException('Unable to process an ESI tag without a "src" attribute.');
|
|
||||||
}
|
|
||||||
|
|
||||||
return sprintf('<?php echo $this->surrogate->handle($this, %s, %s, %s) ?>'."\n",
|
|
||||||
var_export($options['src'], true),
|
|
||||||
var_export(isset($options['alt']) ? $options['alt'] : '', true),
|
|
||||||
isset($options['onerror']) && 'continue' == $options['onerror'] ? 'true' : 'false'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
@ -124,10 +124,10 @@ class EsiTest extends \PHPUnit_Framework_TestCase
|
|||||||
$esi = new Esi();
|
$esi = new Esi();
|
||||||
|
|
||||||
$request = Request::create('/');
|
$request = Request::create('/');
|
||||||
$response = new Response('foo <?php die("foo"); ?><%= "lala" %>');
|
$response = new Response('<?php <? <% <script language=php>');
|
||||||
$esi->process($request, $response);
|
$esi->process($request, $response);
|
||||||
|
|
||||||
$this->assertEquals('foo <?php echo "<?"; ?>php die("foo"); ?><?php echo "<%"; ?>= "lala" %>', $response->getContent());
|
$this->assertEquals('<?php echo "<?"; ?>php <?php echo "<?"; ?> <?php echo "<%"; ?> <?php echo "<s"; ?>cript language=php>', $response->getContent());
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
Reference in New Issue
Block a user