This PR was merged into the 3.4 branch.
Discussion
----------
[SecurityBundle] Lazy load security listeners
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | yes
| BC breaks? | yes (edge case)
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Each of them is heavy and unused if a previous one sets a response or breaks in the middle.
Commits
-------
e3ee6bc349 Lazy load security listeners
This PR was merged into the 3.3 branch.
Discussion
----------
[EventDispatcher] Remove dead code in WrappedListener
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
The static `$cloner` property is unused since ab716c64de
Commits
-------
8b7de02413 [EventDispatcher] Remove dead code in WrappedListener
This PR was merged into the 3.3 branch.
Discussion
----------
[SecurityBundle] Fix non-dumped voters in profiler
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
As a bugfix since it was just forgot.
__before__
__after__
Commits
-------
c1fa308c0a Fix non-dumped voters in security panel
This PR was merged into the 3.4 branch.
Discussion
----------
[FrameworkBundle] KernelTestCase: deprecate not using KERNEL_CLASS
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | https://github.com/symfony/symfony/pull/22668#issuecomment-299875161
| License | MIT
| Doc PR | N/A
Commits
-------
d102fc08e4 [FrameworkBundle] KernelTestCase: deprecate not using KERNEL_CLASS
This PR was submitted for the 3.3 branch but it was merged into the 3.4 branch instead (closes#22917).
Discussion
----------
[VarDumper] Cycle prev/next searching in HTML dumps
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!--highly recommended for new features-->
This cycles the prev/next searching in html dumps and mimics (at least) chrome's search bar. It's truly convenient, hence 3.3
cc @ogizanagi
Commits
-------
73f24e8f48 search case insensitive
0821c5a059 [VarDumper] Cyclic searching dumps
This PR was merged into the 3.4 branch.
Discussion
----------
Automatically enable the routing annotation loader
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | yes <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | yes
| Fixed tickets | there's probably one but I didn't find it
| License | MIT
| Doc PR |
Thanks to fqcn services, most of the time, we don't need the SensioFrameworkExtraBundle to use `@Route`.
So I suggest to automatically enable it when annotations are enabled. This way we could simplify https://github.com/symfony/recipes/blob/master/symfony/framework-bundle/3.3/etc/routing.yaml#L5.
Note: I added priority support for routing loaders to make sure sensio loaders are executed before ours.
Commits
-------
c2f796fa15 Automatically enable the routing annotation loader
This PR was merged into the 3.3 branch.
Discussion
----------
[SecurityBundle] Made 2 service aliases private
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | yes
| Deprecations? | no
| Tests pass? | no
| Fixed tickets | -
| License | MIT
| Doc PR | -
We missed making them private :(
Is it too late to fix that?
Commits
-------
4442c636c8 [SecurityBundle] Made 2 service aliases private
This PR was merged into the 3.3 branch.
Discussion
----------
[Yaml] Remove line number in deprecation notices
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
While moving an app to 3.3, I noticed that my deprecation log is full of deprecation notices that differ only by some line number, but don't tell which file is concerned.
This makes the line number useless, and just prevents aggregation.
Commits
-------
f82b6185a4 [Yaml] Remove line number in deprecation notices
* 3.3:
[MonologBridge] Do not silence errors in ServerLogHandler::formatRecord
bumped Symfony version to 3.3.3
updated VERSION for 3.3.2
updated CHANGELOG for 3.3.2
[HttpKernel][Debug] Fix missing trace on deprecations collected during bootstrapping & silenced errors
This PR was merged into the 3.4 branch.
Discussion
----------
[PropertyInfo] Made ReflectionExtractor's prefix lists instance variables
| Q | A
| ------------- | ---
| Branch? | `3.4`
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| License | MIT
This PR makes `ReflectionExtractor`'s mutator/accessor prefixes instance variables in order to be able to override them to change its behavior.
Commits
-------
58e733b49e [PropertyInfo] Made ReflectionExtractor's prefix lists instance variables
This PR was merged into the 3.3 branch.
Discussion
----------
[MonologBridge] Do not silence errors in ServerLogHandler::formatRecord
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
<!--
- Bug fixes must be submitted against the lowest branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too).
- Features and deprecations must be submitted against the 3.4,
legacy code removals go to the master branch.
- Please fill in this template according to the PR you're about to submit.
- Replace this comment by a description of what your PR is solving.
-->
Commits
-------
f1edfa7ec2 [MonologBridge] Do not silence errors in ServerLogHandler::formatRecord
* 3.3:
[TwigBridge] Fix namespaced classes
bumped Symfony version to 3.3.2
updated VERSION for 3.3.1
updated CHANGELOG for 3.3.1
[DependencyInjection] Fix named args support in ChildDefinition
[Cache] Fallback to positional when keyed results are broken
[HttpFoundation][FrameworkBundle] Revert "trusted proxies" BC break
[Cache] MemcachedAdapter not working with TagAwareAdapter
Remove closure-proxy leftovers
[DependencyInjection] Use more clear message when unused environment variables detected
[Form][Profiler] Fixes form collector triggering deprecations
mitigate BC break with empty trusted_proxies
[Profiler] Never wrap in code excerpts
[Form][FrameworkBundle] Remove non-existing arg for data_collector.form
explain that a role can be an instance of Role
[Cache] fix Redis scheme detection
mix attr options between type-guess options and user options
* 3.2:
[TwigBridge] Fix namespaced classes
[Cache] MemcachedAdapter not working with TagAwareAdapter
[DependencyInjection] Use more clear message when unused environment variables detected
mix attr options between type-guess options and user options
This PR was merged into the 3.3 branch.
Discussion
----------
[HttpFoundation][FrameworkBundle] Revert "trusted proxies" BC break
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Basically reverts #22238 + cleanups some comments + adds missing syncing logic in setTrustedHeaderName.
The reason for this proposal is that the BC break can go un-noticed until prod, *even if you have proper CI*. That's because your CI may not replicate exactly what your prod have (ie a reverse proxy), so that maybe only prod has a trusted-proxies configuration. I realized this while thinking about #23049: it made this situation even more likely, by removing an opportunity for you to notice the break before prod.
The reasons for the BC break are still valid and all of this is security-related. But the core security issue is already fixed. The remaining issue still exists (an heisenbug related to some people having both Forwarded and X-Forwarded-* set for some reason), but deprecating might still be enough.
WDYT? (I'm sure everyone is going to be happy with the BC break reversal, but I'm asking for feedback from people who actually could take the time to *understand* and *balance* the rationales here, thanks :) )
Commits
-------
2132333059 [HttpFoundation][FrameworkBundle] Revert "trusted proxies" BC break
This PR was merged into the 3.3 branch.
Discussion
----------
[Cache] Fallback to positional when keyed results are broken
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Works around https://github.com/krakjoe/apcu/issues/247 ~~and https://github.com/facebook/hhvm/issues/7867~~
Commits
-------
28aaa8eb05 [Cache] Fallback to positional when keyed results are broken
This PR was squashed before being merged into the 3.3 branch (closes#22981).
Discussion
----------
[DependencyInjection] Fix named args support in ChildDefinition
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Following @Tobion's review of #21383.
Commits
-------
1ab3e413d4 [DependencyInjection] Fix named args support in ChildDefinition
This PR was submitted for the 3.3 branch but it was merged into the 3.2 branch instead (closes#23063).
Discussion
----------
[Cache] Fix extensibility of TagAwareAdapter::TAGS_PREFIX
| Q | A
| ------------- | ---
| Branch? | 3.3
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
It seems that when MemcachedAdapter is used with TagAwareAdapter, it fails to fetch items, even though I thoroughly tested fetching items with the exact same keys under the same namespace.
Edit: Just to clarify, `CacheItem::isHit()` always returned `false`. This is what I meant with the above.
Turns out the issue lies in `const TAGS_PREFIX = "\0tags\0";` for unknown to me reasons. Hardcoding that to `'__tags__'` in my project did the trick and I've been using it for a couple of days now and it seems fine.
The reason I had to completely copy/paste this file in my local project is `self::` instead of `static::` usage. I am not sure whether that is a mistake or is done on purpose, but in order to have this work for me I need to be able to override that constant. Going with static:: seems like a good solution to me, then I can set whatever prefix I need for the tags.
PS: Not exactly sure what to do with tests. Any help would be appreciated.
Commits
-------
405f64b [Cache] MemcachedAdapter not working with TagAwareAdapter
It seems that when MemcachedAdapter is used with TagAwareAdapter, it fails to fetch items, even though I thoroughly tested fetching items with the exact same keys under the same namespace.
Turns out the issue lies in `const TAGS_PREFIX = "\0tags\0";` for unknown to me reasons. Hardcoding that to '__tags__' in my project did the trick and I've been using it for a couple of days now and it seems fine.
The reason I had to completely copy/paste this file in my local project is self:: instead of static:: usage. I am not sure whether that is a mistake or is done on purpose, but in order to have this work for me I need to be able to override that constant. Going with static:: seems like a good solution to me, then I can set whatever prefix I need for the tags.
