This PR was merged into the 2.3 branch.
Discussion
----------
n/a
n/a
Commits
-------
1ee96a8 Test examples from Drupal SA-CORE-2014-003
5506ee8 Fix potential DoS when parsing HOST
This PR was merged into the 2.3 branch.
Discussion
----------
[Security] fixing typo in a comment
| Q | A
| ------------- | ---
| Fixed tickets |
| License | MIT
As reported [here](https://github.com/symfony/symfony/pull/11574/files#r16934052).
Commits
-------
faefd66 fixing typo in a comment
This PR was merged into the 2.3 branch.
Discussion
----------
[Security] Made optimization on constant-time algorithm removing modulus operator
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
This fix improves the constant-time algorithm used to compare strings, as it removes the `%` operator inside the loop.
Commits
-------
000bd0d Made optimization deprecating modulus operator
This PR was merged into the 2.3 branch.
Discussion
----------
[Yaml] fixed mapping keys containing a quoted #
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11700, #11723
| License | MIT
| Doc PR | n/a
Commits
-------
110f999 [Yaml] fixed mapping keys containing a quoted #
8ba3b28 Added fixture to test parsing of hash keys ending with a space and #
This PR was squashed before being merged into the 2.3 branch (closes#11768).
Discussion
----------
[ClassLoader] Add a __call() method to XcacheClassLoader
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11733
| License | MIT
| Doc PR |
Commits
-------
dd0d6af [ClassLoader] Add a __call() method to XcacheClassLoader
This PR was merged into the 2.3 branch.
Discussion
----------
[YAML] resolve variables in inlined YAML
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11665
| License | MIT
| Doc PR |
#11569 does not resolve variables in inline YAML.
Commits
-------
45a5863 [YAML] resolve variables in inlined YAML
This PR was merged into the 2.3 branch.
Discussion
----------
[Validator] Fixed wrong translations for Collection constraints
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11630
| License | MIT
| Doc PR |
The error messages for a missing field and an unexpected field did not match the Constraint class.
Commits
-------
808de2b [Validator] Fixed wrong translation keys/messages for Collection constraint. The error messages for a missing field and an unexpected field did not match the Contraint class
This PR was merged into the 2.3 branch.
Discussion
----------
[DomCrawler] check for the correct field type
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11689
| License | MIT
| Doc PR |
HTML allow to define different form fields with the same name. Imagine the following form:
```html
<html>
<body>
<form action="/">
<input type="hidden" name="option" value="default">
<input type="radio" name="option" value="A">
<input type="radio" name="option" value="B">
<input type="hidden" name="settings[1]" value="0">
<input type="checkbox" name="settings[1]" value="1" id="setting-1">
<button>klickme</button>
</form>
</body>
</html>
```
Since the `FormFieldRegistry` can only handle one field per name, the hidden field option is registered first before the radio field with the same name is evaluated. Thus, the `FormFieldRegistry` returns an `InputFormField` instance on which the `addChoices()` method can not be called.
Commits
-------
169b397 check for the correct field type
This PR was merged into the 2.3 branch.
Discussion
----------
[Routing] fix handling of nullable XML attributes
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
As @Tobion pointed out in #11394, ``true`` and ``1`` are valid values in boolean XML attributes. The XmlFileLoader didn't handle ``1`` values properly.
Commits
-------
7b4d4b6 fix handling of nullable XML attributes
This PR was merged into the 2.3 branch.
Discussion
----------
[DomCrawler] fix the axes handling in a bc way
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11503
| License | MIT
| Doc PR |
The previous fix in #11548 for handling XPath axes was not backward compatible. In previous Symfony versions the Crawler handled nodes by holding a "fake root node". This must be taken into account when evaluating (relativizing) XPath expressions.
Commits
-------
d26040f [DomCrawler] fix the axes handling in a bc way
This PR was merged into the 2.3 branch.
Discussion
----------
[Validator] return empty metadata collection if none do exist
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR | [The reference to the documentation PR if any]
Backport of #11614 for Symfony 2.3 and 2.4.
Commits
-------
f5bc18d return empty metadata collection if none do exist
HTML allow to define different form fields with the same name.
Imagine the following form:
<html>
<body>
<form action="/">
<input type="hidden" name="option" value="default">
<input type="radio" name="option" value="A">
<input type="radio" name="option" value="B">
<input type="hidden" name="settings[1]" value="0">
<input type="checkbox" name="settings[1]" value="1" id="setting-1">
<button>klickme</button>
</form>
</body>
</html>
Since the `FormFieldRegistry` can only handle one field per name, the
hidden field option is registered first before the radio field with
the same name is evaluated. Thus, the `FormFieldRegistry` returns an
`InputFormField` instance on which the `addChoices()` method can not
be called.
This PR was merged into the 2.3 branch.
Discussion
----------
[HttpFoundation] revert #11510, moved to 2.6
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | none
| License | MIT
| Doc PR | none
This reverts PR #11510 from 2.3.
Commits
-------
fb120c7 revert #11510, moved to 2.6
This PR was merged into the 2.3 branch.
Discussion
----------
[Validator] Convert objects to string in comparison validators
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
In the [latest merge from 2.3 into 2.4](/symfony/symfony/commit/3bed1b7988e94a897a64c6a2ad3bf70bde9005c1), the changes from 6cf5e0812e in 2.4 got lost. This PR brings back these changes and backports them to 2.3.
The change is BC, because the former value `true` of the `$prettyDateTime` will be cast to `1`, which corresponds to the `PRETTY_DATE` format constant.
Commits
-------
273671e [Validator] Convert objects to string in comparison validators. Reapplies 6cf5e0812e
This PR was squashed before being merged into the 2.3 branch (closes#11510).
Discussion
----------
[HttpFoundation] MongoDbSessionHandler supports auto expiry via configurable expiry_field
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11508
| License | MIT
| Doc PR | no
ToDo
* [x] Fix Tests
Looking for feedback on this early PR.
This adds a config option that disables the PHP GC method call from doing anything,
It also means that the write method sets up the auto expiring index.
Ref: #11508
Commits
-------
b56b740 [HttpFoundation] MongoDbSessionHandler supports auto expiry via configurable expiry_field
This PR was merged into the 2.3 branch.
Discussion
----------
[Console] fixed style creation when providing an unknown tag option
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
When formatting a string, the console ignore style it cannot parse. But if a string looks like an option (`<setting=value>`) for instance, instead of displaying the text as is, it currently throws an exception.
Commits
-------
8814920 [Console] fixed style creation when providing an unknown tag option
The previous fix in #11548 for handling XPath axes was not backward
compatible. In previous Symfony versions the Crawler handled nodes
by holding a "fake root node". This must be taken into account when
evaluating (relativizing) XPath expressions.
The PropertyMetadataContainerInterface defines that the method
getPropertyMetadata() has to return an empty collection if no
metadata have been configured for the given property. Though, its
implementation in the ClassMetadata class didn't check for
existence of such metadata. This behavior led to unexpected PHP
notices when validating a property or a property value of a property
without any configured constraints (only affects the new 2.5 API).
Additionally, the getMemberMetadatas() didn't check for existing
array keys as well which has also been fixed.