This PR was merged into the 3.3-dev branch.
Discussion
----------
[Security] Fix json_login default success/failure handling
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no (master only)
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #22483
| License | MIT
| Doc PR | n/a
This makes the `json_login` listener default configuration stateless oriented by:
- Not using the default (redirect based) failure handler, it returns a 401 (json) response containing the failure reason instead
- Not using the default (redirect based) success handler, just let the original request continue instead (reaching the targeted resource without being redirected).
- Setting `require_previous_session` to `false` by default (I have to set it on `form-login` each time I want it to be stateless)
- Removing the options related to redirections (`default_target_path`, `login_path`, ...) from the listener factory, if one wants redirections then one has to write its own handlers, not the inverse
Commits
-------
9749618ff5 Fix json_login default success/failure handling
This PR was squashed before being merged into the 3.3-dev branch (closes#22234).
Discussion
----------
[DI] Introducing autoconfigure: automatic _instanceof configuration
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes (mostly, a continuation of a new feature)
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | https://github.com/symfony/symfony-docs/issues/7538
This is a proposal to allow the user to opt into some automatic `_instanceof` config. Suppose I want to auto-tag all of my voters and event subscribers
```yml
# current
services:
_defaults:
autowire: true
_instanceof:
Symfony\Component\Security\Core\Authorization\Voter\VoterInterface:
tags: [security.voter]
Symfony\Component\EventDispatcher\EventSubscriberInterface:
tags: [kernel.event_subscriber]
# services using the above tags
AppBundle\Security\PostVoter: ~
AppBundle\EventListener\CheckRequirementsSubscriber: ~
```
If I'm registering a service with a class that implements `VoterInterface`, when would I ever *not* want that to be tagged with `security.voter`? Here's the proposed code:
```yml
# proposed
services:
_defaults:
autowire: true
autoconfigure: true
# services using the auto_configure_instanceof functionality
AppBundle\Security\PostVoter: ~
AppBundle\EventListener\CheckRequirementsSubscriber: ~
```
The user must opt into this and it only applies locally to this configuration file. It works because each enabled bundle would have the opportunity to add one or more "automatic instanceof" definitions - e.g. SecurityBundle would add the `security.voter` instanceof config, FrameworkBundle would add the `kernel.event_subscriber` instanceof config, etc.
For another example, you can check out the proposed changes to `symfony-demo` - symfony/symfony-demo#483 - the `_instanceof` section is pretty heavy: 81694ac21e/app/config/services.yml (L20)
Thanks!
Commits
-------
18627bf9f6 [DI] Introducing autoconfigure: automatic _instanceof configuration
This PR was merged into the 3.3-dev branch.
Discussion
----------
Persist app bootstrapping logs for logger datacollector
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | no
| New feature? | yes
| BC breaks? | ?
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #21405
| License | MIT
Logs generated during the container build are catched by the BufferingLogger with a special flag.
They are persist by the LoggerDataCollector and are available in the logger profiler.
In the profiler toolbar, the "container build" logs increment the current logs counter (even if the container was previously built).
<img width="540" alt="capture d ecran 2017-02-01 a 20 56 40" src="https://cloud.githubusercontent.com/assets/1017746/22523826/0bc12e4a-e8c1-11e6-830f-7f6238ea7423.png">
<img width="1022" alt="capture d ecran 2017-02-01 a 20 57 55" src="https://cloud.githubusercontent.com/assets/1017746/22523859/2c48a698-e8c1-11e6-9bdb-d85f3e692938.png">
The BufferingLogger now require the cachePath and the filesystem to persist a (unique) container build logs.
If the current workflow is ok, I will update the test coverage (actually they fail). Maybe we can display the appDevDebugProjectContainerCompiler.log content in that logger profile.
Commits
-------
2fd18b5503 [VarDumper] Fine tune dumping log messages
ce3ef6a96e Persist app bootstrapping logs for logger datacollector
The conflict rule already forbids installing releases before 3.3 of the
Asset component. This will bring the constraint in the `require-dev`
section inline with the conflict rule.
* 3.2:
Make .travis.yml more readable
Fold Travis CI output by component
[VarDumper] Minor tweaks to html/css dumps
Add trhows PHPDoc in Application::run
[Debug] Set exit status to 255 on error
[HttpFoundation] Store IANA's RNG files in the repository
[PropertyInfo] Remove a useless call to count() in SerializerExtractor
[PropertyInfo] Prevent returning int values in some cases.
[HttpFoundation] Fix getClientIp @return docblock
Add @throws phpdoc
unify PHPUnit config files
This PR was squashed before being merged into the 3.3-dev branch (closes#22425).
Discussion
----------
[Security] Allow to set a check_path on json_login listener
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no, master only
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #21948, ~~#22423~~
| License | MIT
| Doc PR | n/a
The listener should allow to restrict authentication to a given check_path, as stated in the docs http://symfony.com/doc/master/security/json_login_setup.html
Commits
-------
9f7eb618a4 [Security] Allow to set a check_path on json_login listener
This PR was merged into the 3.3-dev branch.
Discussion
----------
[FrameworkBundle][Workflow] Deprecate the default type of a workflow
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
---
Before this patch, the default type is "workflow". Most of the time a
"state_machine" is better because it's simpler and it involves less
knowledge to be able to use it.
So this patch deprecate a missing type in Symfony 3.3. And In Symfony
4.0 the default value will become "state_machine".
Commits
-------
004751c [FrameworkBundle][Workflow] Deprecate the default type of a workflow
This PR was squashed before being merged into the 3.3-dev branch (closes#22420).
Discussion
----------
[DI] Make tagged abstract services throw earlier
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
As spotted by @stof in https://github.com/symfony/symfony/pull/22388#issuecomment-293565243, skipping abstract tagged services removes an opportunity to report config mistakes to users.
Instead of skipping them, let's throw as done before (thus reverting #22039, ping @chalasr).
I made `$container->findTaggedServiceIds()` accept a 2nd arg to make this more systematic.
To keep the possibility to have abstract tagged services *for the purpose of tag inheritance*, `ResolveTagsInheritancePass` now resets their tags.
Commits
-------
388e4b3389 [DI] Make tagged abstract services throw earlier
cd06c1297b Revert "minor #22039 Skip abstract definitions in compiler passes (chalasr)"
Before this patch, the default type is "workflow". Most of the time a
"state_machine" is better because it's simpler and it involves less
knowledge to be able to use it.
So this patch deprecate a missing type in Symfony 3.3. And In Symfony
4.0 the default value will become "state_machine".
* 3.2:
[2.8] Prevent double registrations related to tag priorities
Prevent double registrations related to tag priorities
[3.2] Prevent double registrations related to tag priorities
This PR was merged into the 2.8 branch.
Discussion
----------
[2.8] Prevent double registrations related to tag priorities
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
#22396 on 2.8
Commits
-------
2be5821743 [2.8] Prevent double registrations related to tag priorities
This PR was merged into the 2.7 branch.
Discussion
----------
Prevent double registrations related to tag priorities
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
The current logic is inconsistent, and allows the same id to be used several times. This makes the first explicit priority to always win.
Commits
-------
6764dcdf39 Prevent double registrations related to tag priorities
This PR was merged into the 3.3-dev branch.
Discussion
----------
added a more specialized exception for a better error message
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes/no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
When trying to load a resource, it is very interesting to understand why a resource cannot be loaded. Especially when you get `Cannot load resource "../src/Controller/".`... when the real error is that annotation support is disabled. This PR adds more information in that case.
Commits
-------
aeb9bffa8f added a more specialized exception for a better error message
This PR was merged into the 3.3-dev branch.
Discussion
----------
[FrameworkBundle] Use findDefinition() instead of getDefinition() on aliases
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
The services for which `has()` is called might be aliases at this point so `getDefinition()` gives an exception, I ran into by executing this pass but not the removing ones (skipping ReplaceAliasByActualDefinitionPass) while working on https://github.com/symfony/symfony/issues/16388. Let's make it safe to use independently.
Commits
-------
41f3d1f166 Use findDefinition() instead of getDefinition() after calling has()
This PR was squashed before being merged into the 3.3-dev branch (closes#22344).
Discussion
----------
[DX] [TwigBundle] Improve default expand states of exception template
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | yes
| Fixed tickets | #22334
| License | MIT
As discussed in #22334 this PR changes the default exception template to more intelligently decide which call stack to initially expand:
- All exceptions are scanned for user code, ignoring the front controller and callbacks
- Only exceptions containing user code are expanded
- If no user code is found the first exception is expanded
Commits
-------
df25691250 [DX] [TwigBundle] Improve default expand states of exception template
