* 4.3:
[Config] Disable default alphabet sorting in glob function due of unstable sort
[HttpClient] always return the empty string when the response cannot have a body
[TwigBundle][exception] Added missing css variable to highlight line in trace
[Serializer] Improve messages for unexpected resources values
[SecurityBundle] correct types for default arguments for firewall configs
* 3.4:
[Config] Disable default alphabet sorting in glob function due of unstable sort
[Serializer] Improve messages for unexpected resources values
[SecurityBundle] correct types for default arguments for firewall configs
This PR was squashed before being merged into the 3.4 branch.
Discussion
----------
[Config] Disable default alphabet sorting in glob function due of unstable sort
…table sort
| Q | A
| ------------- | ---
| Branch? | 3.4 <!-- see below -->
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | Fix#33990 <!-- prefix each issue number with "Fix #", if any -->
| License | MIT
| Doc PR | no <!-- required for new features -->
`\Symfony\Component\Config\Resource\GlobResource::getIterator` loads files using `glob` not it the stable sorting, e.g several files: `doctrine.yml` and `doctrine_mongodb.yaml` in `config/packages` folder.
On requests these files come(randomly) in a different order, which leads to reinitialization of symfony kernel in `dev` environment. It's a little bit annoying and takes a lot of time in a common :(
<!--
Additionally (see https://symfony.com/roadmap):
- Always add tests and ensure they pass.
- Never break backward compatibility (see https://symfony.com/bc).
- Bug fixes must be submitted against the lowest maintained branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too.)
- Features and deprecations must be submitted against branch 4.4.
- Legacy code removals go to the master branch.
-->
Commits
-------
3bed0247c0 [Config] Disable default alphabet sorting in glob function due of unstable sort
This PR was merged into the 3.4 branch.
Discussion
----------
[Serializer] Improve messages for unexpected resources values
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
Before: `An unexpected value could not be serialized: NULL` - very misleading
After: `An unexpected value could not be serialized: a "stream" resource`
Commits
-------
ad2ce276c7 [Serializer] Improve messages for unexpected resources values
This PR was merged into the 4.3 branch.
Discussion
----------
[HttpClient] always return the empty string when the response cannot have a body
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
This will fix tests on 4.4 also.
Commits
-------
f78e14332e [HttpClient] always return the empty string when the response cannot have a body
* 4.4:
[HttpFoundation][FrameworkBundle] allow configuring the session handler with a DSN
[Validator] Add AutoMapping constraint to enable or disable auto-validation
[DI] Fix "!tagged" related upgrade/changelog notes
This PR was merged into the 4.4 branch.
Discussion
----------
[HttpFoundation][FrameworkBundle] allow configuring the session handler with a DSN
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
```yaml
framework:
session:
handler_id: 'redis://localhost'
handler_id: '%env(REDIS_URL)%'
handler_id: '%env(DATABASE_URL)%'
handler_id: 'file://%kernel.project_dir%/var/sessions'
```
etc.
the database connection is not shared with the ORM (don't mess with transactions.)
redis/memcached connections are shared between cache and session.
(as a reminder, cache and ORM share the db connection: we're ok with trashing the cache on a rollback)
Lock-related changes are a follow up of #34043.
(fabbot failure is false positive)
Commits
-------
de9c61f423 [HttpFoundation][FrameworkBundle] allow configuring the session handler with a DSN
This PR was squashed before being merged into the 4.4 branch (closes#32107).
Discussion
----------
[Validator] Add AutoMapping constraint to enable or disable auto-validation
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #32070, #32015 <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | todo
As discussed in #32070 and #32015, it's sometimes mandatory to prevent some classes or properties to be auto mapped (auto-validated). This PR introduces a new constraint, `@AutoMapping` allowing to do exactly that. Examples:
Class:
```php
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Validator\Constraints as Assert;
/**
* @ORM\Entity
* @Assert\AutoMapping(false)
*/
class DoctrineLoaderNoAutoMappingEntity
{
/**
* @ORM\Id
* @ORM\Column
*/
public $id;
/**
* @ORM\Column(length=20, unique=true)
*/
public $maxLength;
}
```
Property:
```php
namespace Symfony\Bridge\Doctrine\Tests\Fixtures;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
use Symfony\Component\Validator\Constraints as Assert;
/**
* @ORM\Entity
*/
class DoctrineLoaderEntity extends DoctrineLoaderParentEntity
{
/**
* @ORM\Id
* @ORM\Column
*/
public $id;
/**
* @ORM\Column(length=10)
* @Assert\AutoMapping(false)
*/
public $noAutoMapping;
}
```
The rules are the following:
* If the constraint is present on a property, and set to true, auto-mapping is always on, regardless of the config, and of any class level annotation
* If the constraint is present on a property, and set to false, auto-mapping is always off, regardless of the config, and of any class level annotation
* If the constraint is present on a class, and set to true, auto-mapping is always on except if a the annotation has been added to a specific property, and regardless of the config
* If the constraint is present on a class, and set to false, auto-mapping is always off except if a the annotation has been added to a specific property, and regardless of the config
Commits
-------
f6519ce88b [Validator] Add AutoMapping constraint to enable or disable auto-validation
This PR was merged into the 4.3 branch.
Discussion
----------
[TwigBundle][exception] Added missing css variable to highlight line in trace
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets |
| License | MIT
| Doc PR |
---
To get the yellow background
![image](https://user-images.githubusercontent.com/408368/67779323-c331b880-fa64-11e9-9a2f-97730a89a6d6.png)
Commits
-------
5f19501 [TwigBundle][exception] Added missing css variable to highlight line in trace
* 4.4:
Re-allow to use "tagged" in service definitions
[HttpFoundation] Allow to not pass a parameter to Request::isMethodSafe()
Add missing lock connection string in FrameworkExtension
[DomCrawler] normalizeWhitespace should be true by default
[DoctrineBridge] Auto-validation must work if no regex are passed
Allows URL DSN in Lock and Cache
This PR was merged into the 4.4 branch.
Discussion
----------
Re-allow to use "tagged" in service definitions
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
Re-allow to use `tagged` in 4.4 and 5.0. It makes it easier for bundles to support both Symfony 4.3- and Symfony 4.4+.
Needed to make API Platform compatible with Symfony 5 (api-platform/core#3009)
Commits
-------
7b7dc0df9a Re-allow to use "tagged" in service definitions
This PR was merged into the 4.4 branch.
Discussion
----------
[Lock] Add missing lock connection string in FrameworkExtension
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| Deprecations? | yes
| Tickets | -
| License | MIT
| Doc PR | TODO
This PR adds support to missing DSN in Lock component
```
framework:
lock: sqlite:/tmp/db
lock: mysql:host=localhost;dbname=test
lock: zookeeper://localhost:2181
```
The PR also removes intermediate "internal" services `.lock_connection.*` in favor of factory `StoreFactory::createStore`. Which remove duplicate code.
This PR also deprecate unused services `lock.store.*` and `lock.store.*.abstract`
Commits
-------
2db24cf582 Add missing lock connection string in FrameworkExtension
This PR was squashed before being merged into the 4.3 branch.
Discussion
----------
[HttpFoundation] Allow to not pass a parameter to Request::isMethodSafe()
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
This parameter was already deprecated in Symfony 4. Allowing to not pass it in Symfony 4.3 without triggering a deprecation allows to support both HttpFoundation 4.3 and 4.4, otherwise it's not possible.
Needed to make API Platform compatible with Symfony 5 (https://github.com/api-platform/core/pull/3009)
Commits
-------
e819256ea0 [HttpFoundation] Allow to not pass a parameter to Request::isMethodSafe()
This PR was merged into the 4.4 branch.
Discussion
----------
[Lock][Cache] Allows URL DSN in PDO adapters
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | TODO
This PR duplicate a feature from PdoSessionHandler that convert URL DSN ( ie. mysql://localhost/test) into PDO DSN (ie. mysql:host=localhost;dbname=test)
that would ease configuration by using the same well-known variable
```
framework:
lock: '%env(DATABASE_URL)%'
```
note: I applied the same change on Cache component for consistency.
Commits
-------
474daf976e Allows URL DSN in Lock and Cache
This PR was squashed before being merged into the 4.4 branch (closes#34151).
Discussion
----------
[DomCrawler] normalizeWhitespace should be true by default
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
According to the [DOM](https://www.w3.org/TR/DOM-Level-3-Core/core.html#Text3-isElementContentWhitespace) and [WebDriver](https://www.w3.org/TR/webdriver/#get-element-text) specs, browsers always return the normalized text. In Panther, because of WebDriver, it's not even possible without dirty hacks to retrieve the "non normalized" text.
For compatibility with Panther it's mandatory to set this new parameter (introduced in 4.4) to `true` by default.
I propose to change the default value to true in 5.0, it has the benefit of:
* being spec-compliant (in 5.0, text will be normalized by default)
* being cleaner when using Panther (`$node->text()` instead of `$node->text(null, true)`, passing true is mandatory because Panther doesn't support retrieving the non-normalized text)
For backward compatible with 4.x versions, if no argument is passed and the returned text isn't the same than the normalized one, a notice is triggered.
Commits
-------
54d46eef67 [DomCrawler] normalizeWhitespace should be true by default
This PR was squashed before being merged into the 4.3 branch (closes#33828).
Discussion
----------
[DoctrineBridge] Auto-validation must work if no regex are passed
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
Backport of https://github.com/symfony/symfony/pull/32107/files#r295762928.
This behavior if faulty, if no regex are passed, autvalidation must be triggered, [as done in `PropertyInfoLoader`](https://github.com/symfony/symfony/blob/4.3/src/Symfony/Component/Validator/Mapping/Loader/PropertyInfoLoader.php#L50).
Commits
-------
5ed7d6c759 [DoctrineBridge] Auto-validation must work if no regex are passed
This PR was merged into the 4.4 branch.
Discussion
----------
[ErrorRenderer] Security fix: hide sensitive error messages
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
This PR fixes a security issue. Exception messages must not be displayed except when debugging, because they can contain sensitive data including credentials.
For instance, PDO and Doctrine throw exception with message such as `The details are: SQLSTATE[HY000] [1045] Access denied for user 'root'@'db.example.com' (using password: NO)` revealing internal details about the infrastructure usful for an attacker.
Also, I still think that ErrorRenderer should be removed in favor of using the Serializer directly (see https://github.com/symfony/symfony/pull/33650#issuecomment-534441889). I'll try to open some PRs to do that in tomorrow.
Commits
-------
d7d7f22 [ErrorRenderer] Security fix: hide sensitive error messages