This PR was merged into the 4.1-dev branch.
Discussion
----------
[Workflow] Add PlantUML dumper to workflow:dump command
| Q | A
| ------------- | ---
| Branch | 4.1
| Bug fix | no
| New feature | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| License | MIT
| Doc PR | Will do depending on the comments about that PR
Hello,
`workflow:dump` exports workflows in `dot` format. To me, this format is not the easiest and not the simplest to use. Styles and logic are mixed together which makes it hard to read.
[PlantUML](http://plantuml.com/) is a tool based on Graphviz like Dot but that
generates nicer diagrams, more readable and most of all easier to adapt to your
documentation. Just copy and paste the PUML on the website you will see the rendering live.
Also, there is a [PHPStorm Plugin](https://plugins.jetbrains.com/plugin/7017-plantuml-integration) and [plenty of integration](http://plantuml.com/running) of this format.
This PR adds 2 options
* a `--dump-format=puml` option to the `workflow:dump` command to generate the workflows in PlantUML.
* a `--puml-transition-format=square|arrow` option to the `workflow:dump` command to generate the workflows in PlantUML using a square shape or arrow for the transition. (see below)
The conversion requires the PlantUML JAR, and can be used like that:
```bash
php bin/console workflow:dump pull_request --dump-format=puml | java -jar plantuml.jar -p > workflow.png
```
> don't forget the `-p` to enable the "piping"
Here is an example with `pull_request` workflow of the documentation (with no style and no marking):
```
@startuml
title pull_request
state start <<initial>>
state coding
state travis
state review
state merged
state closed
start --> travis: submit
coding --> travis: update
travis --> travis: update
review --> travis: update
travis --> review: wait_for_review
review --> coding: request_change
review --> merged: accept
review --> closed: reject
closed --> review: reopen
@enduml
```
As PlantUML let us define styles, I have provided some by default that the user can override.
Adding some marking:
```bash
php bin/console workflow:dump pull_request travis review --dump-format=puml
```
will give us:
```
@startuml
sprite $sf_logo [81x20/16z] {
hPNRaYiX24K1xwBo_tyx6-qaCtDEJ-KXLYMTLbp0HWcHZr3KRDJ8z94HG3jZn4_mijbQ2ryJoFePtXLWA_qxyGy19DpdY_10z11ZAbGjFHRwcEbcKx5-wqsV
yIMo8StMCHKh8ZUxnEwrZiwRAUOvy1lLcPQF4lEFAjhzMd5WOAqvKflS0Enx8PbihiSYXM8ClGVAseIWTAjCgVSAcnYbQG79xKFsZ0VnDCNc7AVBoPSMcTsX
UnrujbYjjz0NnsObkTgnmolqJD4QgGUYTQiNe8eIjtx4b6Vv8nPGpncn3NJ8Geo9W9VW2wGACm_JzgIO8A8KXr2jUBCVGEAAJSZ6JUlsNnmOzmIYti9G7bjL
8InaHM9G40NkwTG7OxrggvNIejA8AZuqyWjOzTIKi-wwYvjeHYesSWuPiTGDN5THzkYLU4MD5r2_0PDhG7LIUG33z5HtM6CP3icyWEVOS61sD_2ZsBfJdbVA
qM53XHDUwhY0TAwPug3OG9NonRFhO8ynF3I4unuAMDHmSrXH57V1RGvl9jafuZF9ZhqjWOEh98y0tUYGsUxkBSllIyBdT2oM5Fn2-ut-fzsq_cQNuL6Uvwqr
knh4RrvOKzxZfLV3s0rs_R_1SdYt3VxeQ1_y2_W2
}
title pull_request
skinparam titleBorderRoundCorner 15
skinparam titleBorderThickness 2
skinparam state {
BackgroundColor<<initial>> #87b741
BackgroundColor<<marked>> #3887C6
BorderColor #3887C6
BorderColor<<marked>> Black
FontColor<<marked>> White
}
state start <<initial>>
state coding
state travis <<marked>>
state review <<marked>>
state merged
state closed
start --> travis: submit
coding --> travis: update
travis --> travis: update
review --> travis: update
travis --> review: wait_for_review
review --> coding: request_change
review --> merged: accept
review --> closed: reject
closed --> review: reopen
footer \nGenerated by <$sf_logo> **Workflow Component** and **PlantUML**
@enduml
```
Which gives you that:
With `square` as transition, it gives you that:
Hope you will find that interesting!
Commits
-------
1497d36cab Add option to the workflow:dump command to allow PlantUML format dump
This PR was merged into the 4.1-dev branch.
Discussion
----------
[Serializer] Fix security issue on CsvEncoder about CSV injection
| Q | A
| ------------- | ---
| Branch? | master (4.1)
| Bug fix? | no
| New feature? | yes
| BC breaks? | yes
| Deprecations? | no
| Tests pass? | yes
| License | MIT
I read [this article](http://georgemauer.net/2017/10/07/csv-injection.html) about CSV injection and I thought it best to update the `CsvEncoder` so that it does not generate potentially malicious CSV files by default.
Commits
-------
a1b0bdbbac Fix security issue on CsvEncoder
This PR was merged into the 4.1-dev branch.
Discussion
----------
[Security] The AuthenticationException should implements Security's ExceptionInterface
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #25770
| License | MIT
| Doc PR | ø
Dunno why this is the case right now but this probably should not. Was reported by @paq85.
Commits
-------
0ee4cf1019 The Security Component's exceptions should implements Security's ExceptionInterface
This PR was merged into the 4.1-dev branch.
Discussion
----------
[WebProfilerBundle] Improve controller linking
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes/no
| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!--highly recommended for new features-->
I propose to remove the `Controller class` entry from the request toolbar panel, IMHO it's confusing/useless compared to the linked `Controller` entry above. They represent the same.
To preserve its value it's now used as title attribute instead, favored over controller file currently being used here. We can read that from the statusbar anyway :-)
Before: (hovering ontroller link)
After: (hovering ontroller link)
Commits
-------
f6c0dc64e6 [WebProfilerBundle] Improve controller linking
This PR was squashed before being merged into the 4.1-dev branch (closes#26036).
Discussion
----------
Added support for getting default values in Accept headers
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #25877
| License | MIT
| Doc PR | -
Commits
-------
7e31fd94df Added support for getting default values in Accept headers
This PR was merged into the 4.1-dev branch.
Discussion
----------
Deprecated the AdvancedUserInterface
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | #23292
| License | MIT
| Doc PR | ~
This PR deprecates the usages of the `AdvancedUserInterface`.
Commits
-------
8456f3b Deprecated the AdvancedUserInterface
* 4.0:
Use the PCRE_DOLLAR_ENDONLY modifier in route regexes
[Form] Make sure errors are a part of the label on bootstrap 4 - this is a requirement for WCAG2
[Config] Only using filemtime to check file freshness
* 3.4:
Use the PCRE_DOLLAR_ENDONLY modifier in route regexes
[Form] Make sure errors are a part of the label on bootstrap 4 - this is a requirement for WCAG2
[Config] Only using filemtime to check file freshness
This PR was merged into the 4.1-dev branch.
Discussion
----------
[HttpFoundation] we should not pass size on FileBag removing the contruct parameter
| Q | A
| ------------- | ---
| Branch? | 4.1
| Bug fix? | yes
| New feature? | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #25466 <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | none
We may have forgotten this one, thanks to @craue for seeing it !
Commits
-------
0db65b5 fix tests
820186f [HttpFoundation] we should not pass size on FileBag
This PR was squashed before being merged into the 2.7 branch (closes#25373).
Discussion
----------
Use the PCRE_DOLLAR_ENDONLY modifier in route regexes
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
`UrlMatcher::match($pathinfo)` applies `rawurldecode()` to the `$pathinfo` before trying to match it against the routes.
If the URL contains a percent-encoded trailing newline (like in `/foo%0a`), the default PHP PCRE will still consider `#^/foo$#` a match, as the `$` metacharacter will also match *immediately before* the final character *if it is a newline*. This behavior can be changed by applying the [`PCRE_DOLLAR_ENDONLY` modifier](http://php.net/manual/en/reference.pcre.pattern.modifiers.php).
Without this change, URLs with trailing `%0a` lead to weird notices further down the road, for example when the `RedirectableUrlMatcher` or its equivalent in `PhpMatcherDumper` kick in, look at the last character (this time actually the newline), append a `/` and try to redirect to the resulting URL. Ultimately, PHP will complain with `Warning: Header may not contain more than a single header, new line detected` when sending the `Location` header.
Commits
-------
f713a3e Use the PCRE_DOLLAR_ENDONLY modifier in route regexes
This PR was merged into the 3.4 branch.
Discussion
----------
[Form] Make sure errors are a part of the label on bootstrap 4 - this is a requirement for WCAG2
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR | symfony/symfony-docs#... <!--highly recommended for new features-->
I recently let Europe's leading accessibility experts (Funkanu.se) review a site of mine, they gave me (among other) the feedback that errors should be a part of the label.
They said that it makes no sense for blind users to read label, read input and then read errors.
I know the implementation might look strange. But I wish something like this would be merged. That would be great for accessibility for all apps using Symfony.
We *could* also make sure it prints something like:
```
<label for=”name”>Name: <span class=”hidden”>Error message</span></label>
<input id=”name” type=”text”>
<span aria-hidden=”true”>Error message</span>
```
Commits
-------
a0b40f5 [Form] Make sure errors are a part of the label on bootstrap 4 - this is a requirement for WCAG2
This PR was merged into the 4.1-dev branch.
Discussion
----------
Unwrap errors in FlattenException
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | maybe
| Deprecations? | no
| Tests pass? | no (but probably unrelated?)
| Fixed tickets | #26025
| License | MIT
| Doc PR | N/A
This is probably the most straightforward way to solve #26025. `FlattenException` is now unwrapping `FatalThrowableError` instances and logs the wrapped error instead. The consequence of this change is that the real error class is displayend on TwigBundle's exception page and the profiler.
Regarding BC: If we assume that `FlattenException` is used for rendering and logging, everything should be fine. But this PR changes `FlattenException`'s internal behavior. If a piece of code relied on errors appearing `FatalThrowableError` inside a `FlattenException`, that code would break.
<img width="402" alt="bildschirmfoto 2018-02-02 um 20 08 42" src="https://user-images.githubusercontent.com/1506493/35760077-0b202940-087e-11e8-9b98-8e4ba269780c.png">
Commits
-------
f14d7d6 Unwrap errors in FlattenException.
This PR was merged into the 3.4 branch.
Discussion
----------
[Config] Only using filemtime to check file freshness
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #25999
| License | MIT
Commits
-------
52c9cb4 [Config] Only using filemtime to check file freshness
This PR was merged into the 2.7 branch.
Discussion
----------
[travis] cache compiled php extensions
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Should save more that 80s per job on PHP 7 esp.
Commits
-------
b9def8a [travis] cache compiled php extensions
This PR was merged into the 4.1-dev branch.
Discussion
----------
[DI] Put non-shared service factories in closures
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
With this change, non-shared services are moved to dedicated files (unless they are on the hot path).
Previously, they were always dumped as methods.
The goal of this change is to dump factories as methods *if and only if* the services they build are on the hot-path. By doing so, it will become very easy to figure out which services are on the hot path, vs the rest. And then people will be able to optimize their configurations: if too many things are dumped as methods, it will trivially mean some laziness is missing in definitions.
I spotted this while reviewing the dumped container of Blackfire, where we sometimes have long chains of dependencies that are on the hot path for no real reason - mixed with big non-shared factories (Sonata admin blocks in our case.)
Commits
-------
22c5325 [DI] Put non-shared service factories in closures
This PR was merged into the 3.4 branch.
Discussion
----------
[Config] Handle Service/EventSubscriberInterface in ReflectionClassResource
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #25906
| License | MIT
| Doc PR | -
@weaverryan that should fix an issue you reported.
Commits
-------
67e821b [Config] Handle Service/EventSubscriberInterface in ReflectionClassResource
This PR was merged into the 3.4 branch.
Discussion
----------
[DI][Routing] Fix tracking of globbed resources
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #25904
| License | MIT
| Doc PR | -
The current `GlobFileLoader` in `Config` misses resource tracking, so we can't use it and have to use a per-component one instead.
(deps=high failures will be fixed after merging up to master.)
Commits
-------
945c753 Add tests for glob loaders
ad98c1fa [DI][Routing] Fix tracking of globbed resources
This PR was merged into the 3.4 branch.
Discussion
----------
[SecurityBundle] Allow remember-me factory creation when multiple user providers are configured.
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | none
| License | MIT
| Doc PR | none
When more than one user provider is configured, and `remember_me` is enabled on a firewall, this avoids the deprecation notice in 3.4 and thrown `InvalidConfigurationException` in 4.0 ("Not configuring explicitly the provider for the "remember_me" listener on "foo" firewall is ambiguous as there is more than one registered provider."). The `RememberMeFactory` ignores the `$userProvider` argument and uses the secret configured for the firewall. (If no secret is configured, it throws its own exception.)
The added test passes in 3.4 with a deprecation notice without the change, so would expect it to fail in 4.0 without the change.
Other tests in the `SecurityBundle` already included two errors and one failure, not related to this change.
Commits
-------
6ab8dd9 Allow remember-me factory creation when multiple user providers are configured.
This PR was submitted for the master branch but it was merged into the 3.4 branch instead (closes#26037).
Discussion
----------
[Lock] Fix strategy tests
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Not sure if it is a mistake, but in Phpunit tests need to begin with ` test ` to be played, right ?
Commits
-------
afbb8be Fix lock strategy tests
