* 2.7:
[HttpKernel] Fixed bug with purging of HTTPS URLs
fix some risky tests
[DI] [YamlFileLoader] change error message of a non existing file
[Security] Added option to return true in the method isRememberMeRequested
This PR was merged into the 2.7 branch.
Discussion
----------
fix some risky tests
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
PHPUnit 6 marks tests as risky when they have no assertions (and are not marked as skipped or incomplete). This PR will update our test suite accordingly.
Component that still need to be covered:
- [ ] Config
- [ ] Form
- [ ] HttpFoundation
- [ ] Security
- [ ] Workflow
Commits
-------
abf1787dcc fix some risky tests
* 3.2:
[Cache] Fix Redis pipelining/multi-ops
[Yaml] Fix the tests
[github] Add a reminder about CHANGELOG.md files
respect the umask argument in dumpFile()
dumpFile(), preserve existing file permissions
[Form] Fixed overridden choices option in extended choice types
Add validate method to mockec validator in form TypeTestCase
bumped Symfony version to 2.8.19
updated VERSION for 2.8.18
updated CHANGELOG for 2.8.18
bumped Symfony version to 2.7.26
updated VERSION for 2.7.25
update CONTRIBUTORS for 2.7.25
updated CHANGELOG for 2.7.25
[HttpKernel] fixed Kernel name when stored in a directory starting with a number
context listener: hardening user provider handling
[Console] Do not squash input changes made from console.command event
* 2.8:
respect the umask argument in dumpFile()
dumpFile(), preserve existing file permissions
Add validate method to mockec validator in form TypeTestCase
bumped Symfony version to 2.8.19
updated VERSION for 2.8.18
updated CHANGELOG for 2.8.18
bumped Symfony version to 2.7.26
updated VERSION for 2.7.25
update CONTRIBUTORS for 2.7.25
updated CHANGELOG for 2.7.25
[HttpKernel] fixed Kernel name when stored in a directory starting with a number
context listener: hardening user provider handling
[Console] Do not squash input changes made from console.command event
* 2.7:
respect the umask argument in dumpFile()
dumpFile(), preserve existing file permissions
Add validate method to mockec validator in form TypeTestCase
bumped Symfony version to 2.7.26
updated VERSION for 2.7.25
update CONTRIBUTORS for 2.7.25
updated CHANGELOG for 2.7.25
[HttpKernel] fixed Kernel name when stored in a directory starting with a number
context listener: hardening user provider handling
This PR was merged into the 2.7 branch.
Discussion
----------
[Security] context listener: hardening user provider handling
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #4498
| License | MIT
| Doc PR |
After the wrong fix in #21791 this is the second attempt to solve #4498. If more than one user provider support the user for the current context, all of them will be applied instead of returning prematurely when the first user provider does not find the logged in user.
Commits
-------
0fb09293fd context listener: hardening user provider handling
This PR was merged into the 3.3-dev branch.
Discussion
----------
[Security] fix test class location
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Keeping the test file in the old location means that it is not available in the `symfony/security-http` subtree split.
Commits
-------
b4e803a [Security] fix test class location
* 3.2:
[Security] fix Composer constraint
Provide less state in getRequestFormat
fix test class location
Static code analysis with Php Inspections (EA Extended): dead code dropped, couple bugs fixed
Adding use statement for InvalidArgumentException
* 2.8:
[Security] fix Composer constraint
Provide less state in getRequestFormat
fix test class location
Static code analysis with Php Inspections (EA Extended): dead code dropped, couple bugs fixed
* 2.7:
[Security] fix Composer constraint
Provide less state in getRequestFormat
fix test class location
Static code analysis with Php Inspections (EA Extended): dead code dropped, couple bugs fixed
This PR was merged into the 3.3-dev branch.
Discussion
----------
[HttpKernel] Deprecate X-Status-Code for better alternative
| Q | A |
| --- | --- |
| Branch? | master |
| Bug fix? | no |
| New feature? | yes |
| BC breaks? | no |
| Deprecations? | yes |
| Tests pass? | yes |
| Fixed tickets | #12343 |
| License | MIT |
| Doc PR | https://github.com/symfony/symfony-docs/pull/6948 |
This marks the X-Status-Code header method of setting a custom response status
code in exception listeners for a better alternative. There is now a new method
on the `GetResponseForExceptionEvent` that allows successful status codes in
the response sent to the client.
The old method of setting the X-Status-Code header will now throw a deprecation warning.
Instead, in your exception listener you simply call `GetResponseForExceptionEvent::allowCustomResponseCode()` which will tell the Kernel not to override the status code of the event's response object.
Currenty the `X-Status-Code` header will still be removed, so as not to change the existing behaviour, but this is something we can remove in 4.0.
TODO:
- [x] Replace usage of X-Status-Code in `FormAuthenticationEntryPoint`
- [x] Open Silex issue
- [x] Rename method on the response
- [x] Ensure correct response code is set in `AuthenticationEntryPointInterface` implementations
- [x] Ensure the exception listeners are marking `GetResponseForExceptionEvent` as allowing a custom response code
- [x] In the Security component we should only use the new method of setting a custom response code if it is available, and fall back to the `X-Status-Code` method
Commits
-------
cc0ef282cd [HttpKernel] Deprecate X-Status-Code for better alternative
Passing multiple user providers to the context listener does not make
much sense. The listener is only responsible to refresh users for a
particular firewall. Thus, it must only be aware of the user provider
for this particular firewall.
This marks the X-Status-Code header method of setting a custom response
status code in exception listeners as deprecated. Instead there is now
a new method on the GetResponseForExceptionEvent that allows successful
status codes in the response sent to the client.
* 3.2:
Refactored other PHPUnit method calls to work with namespaced PHPUnit 6
Refactored other PHPUnit method calls to work with namespaced PHPUnit 6
Further refactorings to PHPUnit namespaces
resolve parameters in definition classes
* 2.8:
Refactored other PHPUnit method calls to work with namespaced PHPUnit 6
Further refactorings to PHPUnit namespaces
resolve parameters in definition classes
This PR was squashed before being merged into the 2.8 branch (closes#21663).
Discussion
----------
Updated PHPUnit namespaces
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Follow Up of #21564
Commits
-------
205ced4 Updated PHPUnit namespaces
* 3.2:
Fix typo in process error message
Update to PHPUnit namespaces
Minor typo fix messsagesData -> messagesData
remove translation data collector when not usable
This PR was squashed before being merged into the 3.3-dev branch (closes#21450).
Discussion
----------
[Security] Lazy load guard authenticators and authentication providers
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Authentication stops on the first authenticator that fails or succeeds, let's instantiate them only if actually needed.
Commits
-------
cd6422ae73 [SecurityBundle] Lazy load authentication providers
b8a23ded63 [Security][Guard] Lazy load authenticators
* 3.2: (27 commits)
Improve tracking of environment variables in the case of private services
[DI] Align AutowirePass with 2.8
property constraints can be added in child classes
added test for staticClassLoader in LazyLoadingMetadatafactory
fixed PHPUnit setUp and tearDown method visibility
spelling fixes
Readd Symfony version status in the toolbar
[Security] LdapUserProvider should not throw an exception if the UID key does not exist in an LDAP entry
make sure that null can be the invalid value
[VarDumper] Improve dump of AMQP* Object
Fix annotations cache folder path
[FrameworkBundle] Wire ArrayCache for annotation reader at bootstrap
Ignore missing 'debug.file_link_formatter' service in Debug bundle
[VarDumper] Fixed dumping of terminated generator
bumped Symfony version to 3.2.4
updated VERSION for 3.2.3
updated CHANGELOG for 3.2.3
bumped Symfony version to 2.8.18
updated VERSION for 2.8.17
updated CHANGELOG for 2.8.17
...
* 3.2: (40 commits)
fixed CS
fixed CS
fixed CS fixer config
fixed typo
Revert "fixed typo"
fixed typo
fixed CS
Avoid setting request attributes from signature arguments in AnnotationClassLoader
[DependencyInjection] Add some missing typehints in YamlFileLoader
[DependencyInjection] minor: Fix a DocBlock
[HttpKernel] Give higher priority to adding request formats
[Cache] Fix tags expiration
[PhpUnit] Blacklist DeprecationErrorHandler in stack traces
[PropertyInfo] Don't try to access a property thru a static method
[PropertyInfo] Exclude static methods form properties guessing
[Workflow] Added new validator to make sure each place has unique translation names
[Cache] [PdoAdapter] Fix MySQL 1170 error (blob as primary key)
[FrameworkBundle] Fix third level headers for MarkdownDescriptor
[Ldap] Using Ldap stored username instead of form submitted one
[Ldap] load users with the good username case
...
* 3.1: (31 commits)
fixed CS
fixed CS
fixed CS fixer config
fixed typo
Revert "fixed typo"
fixed typo
fixed CS
Avoid setting request attributes from signature arguments in AnnotationClassLoader
[DependencyInjection] Add some missing typehints in YamlFileLoader
[DependencyInjection] minor: Fix a DocBlock
[HttpKernel] Give higher priority to adding request formats
[PropertyInfo] Don't try to access a property thru a static method
[PropertyInfo] Exclude static methods form properties guessing
[FrameworkBundle] Fix third level headers for MarkdownDescriptor
[Ldap] Using Ldap stored username instead of form submitted one
[Ldap] load users with the good username case
[DoctrineBridge] Fixed invalid unique value as composite key
[Doctrine Bridge] fix UniqueEntityValidator for composite object primary keys
[TwigBundle] do not lose already set method calls
#20411 fix Yaml parsing for very long quoted strings
...
This PR was merged into the 3.3-dev branch.
Discussion
----------
[Security] use authenticated token for json authentication
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #21123
| License | MIT
| Doc PR | N/A
When using `UsernamePasswordJsonAuthenticationListener` with [LexikJWTAuthenticationBundle](https://github.com/lexik/LexikJWTAuthenticationBundle), we get a type exception
> Type error: Argument 1 passed to Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication\AuthenticationSuccessHandler::handleAuthenticationSuccess() must implement interface Symfony\Component\Security\Core\User\UserInterface, string given, called in .../vendor/lexik/jwt-authentication-bundle/Security/Http/Authentication/AuthenticationSuccessHandler.php on line 47
This error occurs because the `UsernamePasswordJsonAuthenticationListener` send to the authentication success handler the token which have the user as a string and not the authenticated one that have a UserInterface as user.
Commits
-------
208c617716 use authenticated token for json authentication
This PR was squashed before being merged into the 3.3-dev branch (closes#21088).
Discussion
----------
Rename DebugAccessDecisionManager to TraceableAccessDecisionManager
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #21085
| License | MIT
[EDIT] No longer WIP, test passing. Also, test added to preserve BC with the SecurityBundle.
Commits
-------
c5e0e59 Rename DebugAccessDecisionManager to TraceableAccessDecisionManager
* 3.1:
fixed obsolete getMock() usage
fixed obsolete getMock() usage
fixed obsolete getMock() usage
[WebProfilerBundle] Display multiple HTTP headers in WDT
do not remove the Twig ExceptionController service
removed obsolete condition
do not try to register incomplete definitions
* 2.8:
fixed obsolete getMock() usage
fixed obsolete getMock() usage
[WebProfilerBundle] Display multiple HTTP headers in WDT
do not remove the Twig ExceptionController service
removed obsolete condition
do not try to register incomplete definitions
* 2.7:
[Validator] add Indonesian translation
fixed CS
[config] Fix issue when key removed and left value only
[Security] AbstractVoter method supportsAttribute gives false positive if attribute is zero (0)
This PR was merged into the 2.7 branch.
Discussion
----------
[Security] AbstractVoter->supportsAttribute gives false positive if attribute is zero (0)
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Issue is easy to reproduce with test giving negative data set.
0 should not pass as supported attribute for any set of attributes but it does as in_array in the method does not use flag 'strict' set to true.
As this is abstract voter and is used by users with their code flag 'strict' should be set to true.
Since is there in 2.7 and 2.8 (LTS) IMHO it should be fixed.
Commits
-------
8306530 [Security] AbstractVoter method supportsAttribute gives false positive if attribute is zero (0)
* 3.2: (51 commits)
[FrameworkBundle] [Workflow] Fix service marking store configuration
Fix merge
[Validator] add class name to the cache key
[Serializer] Remove AbstractObjectNormalizer::isAttributeToNormalize
Throw less misleading exception when property access not found
[Twig] Fix deprecations with Twig 1.29
[FrameworkBundle] Fix validation cache warmer with failing or missing classes
Fixed typo
[FrameworkBundle] Removed the kernel.debug parameter from the cache pool namespace seed
Fix email address
fix the docblock in regard to the role argument
[Bridge\Twig] Trigger deprecation when using FormExtension::$renderer
Don't use the "app" global variable in the profiler
[VarDumper] fix tests when xdebug is enabled
Fix merge
FIXED NON EXISTING TYPE DECLARATION
[Form] Add failing test for data collector bug
[Cache] Fix dumping SplDoublyLinkedList iter mode
[Form] Fix FormDataCollector
Ignore missing 'debug.file_link_formatter' service in Debug and Twig bundles
...
* 3.1: (28 commits)
Fix merge
[Validator] add class name to the cache key
[Serializer] Remove AbstractObjectNormalizer::isAttributeToNormalize
Throw less misleading exception when property access not found
[Twig] Fix deprecations with Twig 1.29
Fixed typo
[FrameworkBundle] Removed the kernel.debug parameter from the cache pool namespace seed
Fix email address
fix the docblock in regard to the role argument
Don't use the "app" global variable in the profiler
[VarDumper] fix tests when xdebug is enabled
Fix merge
FIXED NON EXISTING TYPE DECLARATION
[Cache] Fix dumping SplDoublyLinkedList iter mode
[Console] fixed PHP7 Errors when not using Dispatcher
Regression test for missing controller arguments (3.1)
Regression test for missing controller arguments
fix a test checking for a value
[Form][DX] FileType "multiple" fixes
fixed CS
...
* 2.8:
[Twig] Fix deprecations with Twig 1.29
Fixed typo
Fix email address
fix the docblock in regard to the role argument
[VarDumper] fix tests when xdebug is enabled
Fix merge
[Cache] Fix dumping SplDoublyLinkedList iter mode
[Console] fixed PHP7 Errors when not using Dispatcher
Regression test for missing controller arguments
fix a test checking for a value
[Form][DX] FileType "multiple" fixes
fixed CS
[TwigBundle] Fix twig loader registered twice
[WebProfilerBundle] Fix dump block is unfairly restrained
[Console] Fix wrong handling of multiline arg/opt descriptions
[DependencyInjection] PhpDumper.php: hasReference() should not search references in lazy service arguments.
[Form] fixed "empty_value" option deprecation
Cast result to int before adding to it
* 3.2:
[Routing] Fail properly when a route parameter name cannot be used as a PCRE subpattern name
[FrameworkBundle] Improve performance of ControllerNameParser
Update documentation link to the component
[HttpFoundation] Add links to RFC-7231
[DI] Initialize properties before method calls
[Bridge/Doctrine] Use cache.prefix.seed parameter for generating cache namespace
Tag missing internals
Add missing example for 'path' argument in debug:config
[WebProfilerBundle] Dont use request attributes in RouterController
Fix complete config tests
* 3.1:
[Routing] Fail properly when a route parameter name cannot be used as a PCRE subpattern name
[FrameworkBundle] Improve performance of ControllerNameParser
Update documentation link to the component
[HttpFoundation] Add links to RFC-7231
[DI] Initialize properties before method calls
Tag missing internals
[WebProfilerBundle] Dont use request attributes in RouterController
Fix complete config tests
