Commit Graph

1579 Commits

Author SHA1 Message Date
Fabien Potencier
2dbb75aef4 removed usage of the deprecated StringUtils::equals() method 2015-11-23 11:39:33 +01:00
Fabien Potencier
8a6da3f021 Merge branch '2.7' into 2.8
* 2.7:
  fixed tests
  migrate session after remember me authentication
  prevent timing attacks in digest auth listener
  mitigate CSRF timing attack vulnerability
  fix potential timing attack issue
2015-11-23 11:34:41 +01:00
Fabien Potencier
5edc71e2fc Merge branch '2.3' into 2.7
* 2.3:
  migrate session after remember me authentication
  prevent timing attacks in digest auth listener
  mitigate CSRF timing attack vulnerability
  fix potential timing attack issue
2015-11-23 11:34:14 +01:00
Fabien Potencier
f95078c409 security #16631 n/a (xabbuh)
This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

f88e600 migrate session after remember me authentication
2015-11-23 11:22:15 +01:00
Christian Flothmann
f88e600833 migrate session after remember me authentication 2015-11-23 11:04:06 +01:00
Christian Flothmann
819aa54fe4 prevent timing attacks in digest auth listener 2015-11-23 11:02:49 +01:00
Christian Flothmann
f1fd7686c5 fix potential timing attack issue 2015-11-23 11:02:49 +01:00
Nicolas Grekas
ecdd681898 Merge branch '2.7' into 2.8
* 2.7:
  Fix undefined array $server
  Fix bug in windows detection
  [ProxyManager] Tmp fix composer reqs issue in ZF
  Add missing exclusions from phpunit.xml.dist
  [Serializer] ObjectNormalizer: don't serialize static methods and props
  Fix the server variables in the router_*.php files
  [Validator] Allow an empty path with a non empty fragment or a query
  The following change adds support for Armenian pluralization.
  [2.3][Process] fix Proccess run with pts enabled

Conflicts:
	composer.json
	src/Symfony/Bridge/ProxyManager/composer.json
	src/Symfony/Component/Security/phpunit.xml.dist
2015-11-18 14:45:00 +01:00
Nicolas Grekas
a8d21b5ca9 Merge branch '2.3' into 2.7
* 2.3:
  Fix undefined array $server
  [ProxyManager] Tmp fix composer reqs issue in ZF
  Add missing exclusions from phpunit.xml.dist
  Fix the server variables in the router_*.php files
  [Validator] Allow an empty path with a non empty fragment or a query
  The following change adds support for Armenian pluralization.
  [2.3][Process] fix Proccess run with pts enabled

Conflicts:
	composer.json
	src/Symfony/Bridge/ProxyManager/composer.json
	src/Symfony/Bundle/DebugBundle/phpunit.xml.dist
	src/Symfony/Component/Security/phpunit.xml.dist
2015-11-18 14:41:01 +01:00
Nicolas Grekas
d4880c4785 Add missing exclusions from phpunit.xml.dist 2015-11-18 09:19:46 +01:00
WouterJ
55f59d55a2 Renamed key to secret 2015-11-07 18:34:16 +01:00
Nicolas Grekas
770bd8cfda [Security\Core] Deprecate passing $salt to BCryptPasswordEncoder::encodePassword() 2015-11-04 14:11:51 +01:00
Fabien Potencier
4fd60aacd4 minor #16416 [Security][Guard] Check whether $this->logger is not null on GuardAuthenticationListener (aeoris, Diego Agulló)
This PR was merged into the 2.8 branch.

Discussion
----------

[Security][Guard] Check whether $this->logger is not null on GuardAuthenticationListener

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   |  yes
| Fixed tickets | #16415
| License       | MIT
| Doc PR        |

Commits
-------

ebc751d Write the log message on a single line againn
713b99f Check whether $this->logger is not null on GuardAuthenticationListener
2015-11-04 01:18:15 +01:00
Nicolas Grekas
5805cc5040 Merge branch '2.7' into 2.8
* 2.7:
  [Security][2.7] Clean deps
  [HttpKernel] Fix time-sensitive test case
  [travis] Fail early when an invalid composer.json is found

Conflicts:
	src/Symfony/Component/Security/Core/composer.json
	src/Symfony/Component/Security/composer.json
2015-11-03 15:28:10 +01:00
Nicolas Grekas
ae072b7366 [Security] Clean deps 2015-11-03 15:10:28 +01:00
Nicolas Grekas
d51ab88541 [Security][2.7] Clean deps 2015-11-03 15:07:35 +01:00
Nicolas Grekas
2c1bb06e54 Merge branch '2.7' into 2.8
* 2.7:
  [Security] Fix composer.json
2015-11-03 12:42:49 +01:00
Nicolas Grekas
39420e1eb9 [Security] Fix composer.json 2015-11-03 12:34:55 +01:00
Diego Agulló
ebc751d868 Write the log message on a single line againn 2015-11-03 10:13:43 +01:00
Fabien Potencier
e3f09df02a Merge branch '2.7' into 2.8
* 2.7:
  removed @covers annotations in tests
  removed all @covers annotations
  [PropertyAccess] Major performance improvement
2015-11-02 21:29:24 +01:00
Fabien Potencier
d3008b420a removed @covers annotations in tests 2015-11-02 21:25:31 +01:00
Fabien Potencier
db54164a87 Merge branch '2.3' into 2.7
* 2.3:
  removed all @covers annotations
  [PropertyAccess] Major performance improvement
2015-11-02 21:20:53 +01:00
Fabien Potencier
30bd397366 minor #16414 removed all @covers annotations (fabpot)
This PR was merged into the 2.3 branch.

Discussion
----------

removed all @covers annotations

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Some unit tests have a `@covers` PHPUnit annotations. Most of them were added a very long time ago, but since then, we did not use them anymore and the existing ones are not maintained (see #16413). So, I propose to remove them all.

Commits
-------

1e0af36 removed all @covers annotations
2015-11-02 19:22:02 +01:00
Diego Agulló
713b99fc8f Check whether $this->logger is not null on GuardAuthenticationListener 2015-11-01 23:24:34 +01:00
Fabien Potencier
1e0af36c7d removed all @covers annotations 2015-11-01 14:17:24 -08:00
Fabien Potencier
64917c726d feature #16395 checkCredentials() force it to be an affirmative yes! (weaverryan)
This PR was squashed before being merged into the 2.8 branch (closes #16395).

Discussion
----------

checkCredentials() force it to be an affirmative yes!

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no (because 2.8 isn't released)
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

This changes `GuardAuthenticatorInterface::checkCredentials()`: you now *must* return true in order for authentication to pass.

Before: You could do nothing (i.e. return null) and authentication would pass. You threw an AuthenticationException to cause a failure.

New: You *must* return `true` for authentication to pass. If you do nothing, we will throw a `BadCredentialsException` on your behalf. You can still throw your own exception.

This was a suggestion at symfony_live to make things more secure. I think it makes sense.

Commits
-------

14acadd checkCredentials() force it to be an affirmative yes!
2015-10-31 08:07:27 -07:00
Ryan Weaver
14acadda45 checkCredentials() force it to be an affirmative yes! 2015-10-31 08:07:17 -07:00
Fabien Potencier
a15c9eb82d Merge branch '2.7' into 2.8
* 2.7:
  added the new Composer exclude-from-classmap option
  added the new Composer exclude-from-classmap option
  fix expected argument type docblock
  Set back libxml settings after testings.
  fixed Twig deprecation notices
2015-10-30 13:15:42 -07:00
Fabien Potencier
6d0e05cd1d added the new Composer exclude-from-classmap option 2015-10-30 13:13:17 -07:00
Fabien Potencier
05c2ecc124 Merge branch '2.3' into 2.7
* 2.3:
  added the new Composer exclude-from-classmap option
  fix expected argument type docblock
  Set back libxml settings after testings.
  fixed Twig deprecation notices
2015-10-30 13:10:21 -07:00
Fabien Potencier
ebd55fcb38 minor #16397 added the new Composer exclude-from-classmap option (annesosensio)
This PR was merged into the 2.3 branch.

Discussion
----------

added the new Composer exclude-from-classmap option

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Commits
-------

65bef75 added the new Composer exclude-from-classmap option
2015-10-30 13:03:18 -07:00
Anne-Sophie Bachelard
65bef75bef added the new Composer exclude-from-classmap option 2015-10-30 12:48:51 -07:00
Pierre du Plessis
8ab8ca02eb Add the PHP 7 polyfill for the random_bytes function 2015-10-28 12:33:15 +02:00
Fabien Potencier
dd61084ecb Merge branch '2.7' into 2.8
* 2.7:
  added missing quotes in YAML files
  [HttpKernel] Add `@group time-sensitive` on some transient tests
  [DoctrineBridge] Fix issue which prevent the profiler to explain a query
  Use mb_detect_encoding with $strict = true
  don't allow to install the split Security packages
  bumped Symfony version to 2.3.35
  updated VERSION for 2.3.34
  update CONTRIBUTORS for 2.3.34
  updated CHANGELOG for 2.3.34
2015-10-27 21:17:44 -07:00
Fabien Potencier
5f707a64d0 Merge branch '2.3' into 2.7
* 2.3:
  added missing quotes in YAML files
  [HttpKernel] Add `@group time-sensitive` on some transient tests
  [DoctrineBridge] Fix issue which prevent the profiler to explain a query
  Use mb_detect_encoding with $strict = true
  don't allow to install the split Security packages
  bumped Symfony version to 2.3.35
  updated VERSION for 2.3.34
  update CONTRIBUTORS for 2.3.34
  updated CHANGELOG for 2.3.34
2015-10-27 21:15:55 -07:00
Nicolas Grekas
303f05baaf Rely on iconv and symfony/polyfill-* 2015-10-28 03:15:07 +01:00
Fabien Potencier
dd9de5be75 bug #16144 [Security] don't allow to install the split Security packages (xabbuh)
This PR was merged into the 2.3 branch.

Discussion
----------

[Security] don't allow to install the split Security packages

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #16134
| License       | MIT
| Doc PR        |

Currently, you would be able to install the Security component fromm
Symfony 2.3 together with one of the split packages from a higher
Symfony vesion like this:

```json
{
    "require": {
        "symfony/symfony": "2.3.*",
        "symfony/security-core": "~2.7"
    }
}
```

However, you will end up with classes being present twice.

This must be reverted after merging up in the `2.7` branch.

Commits
-------

0d14064 don't allow to install the split Security packages
2015-10-27 18:53:37 -07:00
Christian Flothmann
0d140642e0 don't allow to install the split Security packages
Currently, you would be able to install the Security component fromm
Symfony 2.3 together with one of the split packages from a higher
Symfony vesion like this:

```json
{
    "require": {
        "symfony/symfony": "2.3.*",
        "symfony/security-core": "~2.7"
    }
}
```

However, you will end up with classes being present twice.

This must be reverted after merging up in the `2.7` branch.
2015-10-27 21:57:16 +01:00
Tobias Schultze
912fc4de8f [Routing] deprecate the old url generator reference type values 2015-10-18 22:34:15 +02:00
Fabien Potencier
945630a8fa Merge branch '2.7' into 2.8
* 2.7:
  [Routing] use constants in tests
  [Process] tweaked README
  [Validator] Allow an empty path in a URL with only a fragment or a query
  [HttpFoundation] Fix some typo in the Request doc
  fixed CS
  Added separated handling of root paths
2015-10-18 22:23:24 +02:00
Fabien Potencier
fa6c58c90d Merge branch '2.3' into 2.7
* 2.3:
  [Routing] use constants in tests
  [Validator] Allow an empty path in a URL with only a fragment or a query
  [HttpFoundation] Fix some typo in the Request doc
  fixed CS
  Added separated handling of root paths
2015-10-18 22:23:18 +02:00
Tobias Schultze
608c8d25a3 [Routing] use constants in tests 2015-10-18 22:22:24 +02:00
Fabien Potencier
6f48ec5be6 Merge branch '2.7' into 2.8
* 2.7:
  [TwigBundle] Fix Twig cache is not properly warmed
  [Security] Use SessionAuthenticationStrategy on RememberMe login
2015-10-17 17:40:24 +02:00
Michal Trojanowski
a8d3d124ca Added UserLoaderInterface for loading users through Doctrine. 2015-10-16 13:51:34 +02:00
Sergey Novikov
795c8b3249 [Security] Use SessionAuthenticationStrategy on RememberMe login
Regenerate session ID with default session strategy
2015-10-16 13:32:26 +02:00
Nicolas Grekas
9d9c252c89 Merge branch '2.3' into 2.7
* 2.3:
  [ci] Fix tests requirements

Conflicts:
	src/Symfony/Component/Validator/Tests/Mapping/Cache/LegacyApcCacheTest.php
2015-10-12 11:20:33 +02:00
Nicolas Grekas
3c0b441371 [ci] Fix tests requirements 2015-10-12 11:06:32 +02:00
Nicolas Grekas
f30ae9a9bb Merge branch '2.3' into 2.7
* 2.3:
  [ci] SymfonyTestsListener is now auto-registered
  adds validation messages missing italian translations
2015-10-11 11:39:48 +02:00
Nicolas Grekas
d1d0e041c2 [ci] SymfonyTestsListener is now auto-registered 2015-10-11 11:37:49 +02:00
Nicolas Grekas
9e2bb0082f [PhpUnit] Auto-register SymfonyTestsListener 2015-10-11 10:29:26 +02:00