Commit Graph

555 Commits

Author SHA1 Message Date
Fabien Potencier
3e99f4e976 merged branch asm89/issue-837 (PR #4935)
This PR was merged into the master branch.

Commits
-------

73db84f [Security] Move translations file to 'security' domain
324703a [Security] Switch to English messages as message keys
aa74769 [Security] Fix CS + unreachable code
2d7a7ba [Security] Fix `AuthenticationException` serialization
50d5724 [Security] Introduced `UsernameNotFoundException#get/setUsername`
39da27a [Security] Removed `get/setExtraInformation`, added `get/set(Token|User)`
837ae15 [Security] Add note about changed constructor to changelog
d6c57cf [FrameworkBundle] Register security exception translations
d7129b9 [Security] Fix exception constructors called in `UserChecker`
0038fbb [Security] Add initial translations for AccountStatusException childs
50e2cfc [Security] Add custom `getMessageKey` AccountStatusException childs
1147977 [Security] Fix InsufficientAuthenticationException constructor calls
79430b8 [Security] Fix AuthenticationServiceException constructor calls
42cced4 [Security] Fix AuthenticationException constructor calls
963a1d7 [Security] Add initial translations for the exceptions
ed6eed4 [Security] Add `getMessageKey` and `getMessageData` to auth exceptions
694c47c [Security] Change signature of `AuthenticationException` to match `\Exception`

Discussion
----------

[2.2][Security] AuthenticationException enhancements

Bug fix: semi
Feature addition: yes
Backwards compatibility break: yes
Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=issue-837)](http://travis-ci.org/asm89/symfony)
Fixes the following tickets: #837
License of the code: MIT

This PR adds the functionality discussed in #837 and changes the constructor of the `AuthenticationException` to match that of `\Exception`. This PR will allow developers to show a translated (save) authentication exception message to the user. :)

*Todo:*
- Add some functional test to check that the exceptions can indeed be translated?
- Get feedback on the current English messages

---------------------------------------------------------------------------

by asm89 at 2012-07-15T14:04:11Z

ping @schmittjoh

---------------------------------------------------------------------------

by schmittjoh at 2012-07-15T14:57:32Z

Looks good to me.

While you are at the exceptions, I think we can also get rid of the "extra information" thing and replace it by explicit getters/setters. Mostly that will mean adding set/getToken, set/getUser, set/getUsername. Bundles might add custom exceptions which have other data. This will make it a bit more useful and predictable.

---------------------------------------------------------------------------

by asm89 at 2012-07-15T15:40:45Z

@schmittjoh I removed the `get/setExtraInformation` and added the more explicit getters/setters as you suggested.

---------------------------------------------------------------------------

by asm89 at 2012-07-15T19:33:15Z

@fabpot Did you reschedule this for 2.2? Why? It was originally a 2.1 ticket. I think it is an important one because at the moment there is no reliable way to show users the cause of an `AuthenticationException` without the threat of exposing sensitive information. This issue has been around for a while, see the original issue this PR refers to, or for example [this TODO comment in FOSUB](https://github.com/FriendsOfSymfony/FOSUserBundle/blob/master/Controller/SecurityController.php#L37).

The PR itself is ready to merge now. My only question that remains is about whether the actual translations should be functional tested?

---------------------------------------------------------------------------

by fabpot at 2012-07-15T19:43:19Z

We need to stop at some point. If not, we never release anything. beta3 was scheduled for today and I don't plan any other one before the first RC and I won't have time to review this PR next week. So, if you, @schmittjoh, @vicb, @stof, and a few other core devs "validate" this PR, I might consider merging it before 2.1.

---------------------------------------------------------------------------

by asm89 at 2012-07-15T19:46:09Z

@fabpot I totally agree with your point of view. I just have been trying to pickup some security issues that were still open. :)

---------------------------------------------------------------------------

by stof at 2012-07-15T19:50:29Z

This looks good to me

---------------------------------------------------------------------------

by asm89 at 2012-08-12T09:06:24Z

Since the beta period is over I assume the window was missed to get this security related PR in 2.1. If I have feedback from @fabpot I'll still try to make it mergeable asap though.

---------------------------------------------------------------------------

by fabpot at 2012-08-13T10:10:32Z

@asm89 This would indeed be considered for merging in 2.2.

---------------------------------------------------------------------------

by Antek88 at 2012-10-03T10:30:46Z

+1

---------------------------------------------------------------------------

by stof at 2012-10-04T21:27:15Z

@asm89 could you rebase this PR ? It conflicts with master

---------------------------------------------------------------------------

by fabpot at 2012-10-05T17:16:44Z

What's the status of this PR? @asm89 Have you taken all the feedback into account?

---------------------------------------------------------------------------

by stof at 2012-10-13T17:48:48Z

@asm89 ping

---------------------------------------------------------------------------

by fabpot at 2012-10-29T09:48:40Z

@asm89 If you don't have time, I can finish the work on this PR, but can you just tell me what's left?

---------------------------------------------------------------------------

by asm89 at 2012-10-29T10:02:22Z

I can pick this up, but I have two outstanding questions:
- One about adding `::create()`? https://github.com/symfony/symfony/pull/4935#discussion_r1358297
- And what is the final verdict on the messages? https://github.com/symfony/symfony/pull/4935#discussion_r1165701 The initial idea was that the exception itself have an exception message which is plain english and informative for the developer. If you want to display the 'safe' user messages you have the optional dependency on the translator. There is a comparison made with the Validator component, but in my opinion that's a different case because the violations always contain the message directed at the user and have no plain english message for the developer. Apart from that the Validator component contains it's own code for replacing `{{ }}` variables in messages (duplication? not as flexible as the translator). Concluding I'd opt for: optional dependency on translator component if you want to show 'safe' user messages + message keys.

@schmittjoh Any things to add?

---------------------------------------------------------------------------

by schmittjoh at 2012-10-29T10:14:09Z

Message keys sound good to me. I wouldn't add the ``create`` method for now.

On Mon, Oct 29, 2012 at 11:02 AM, Alexander <notifications@github.com>wrote:

> I can pick this up, but I have two outstanding questions:
>
>    - One about adding ::create()? symfony/symfony#4935<https://github.com/symfony/symfony/issues/4935#discussion_r1358297>
>    - And what is the final verdict on the messages? symfony/symfony#4935<https://github.com/symfony/symfony/issues/4935#discussion_r1165701>The initial idea was that the exception itself have an exception message
>    which is plain english and informative for the developer. If you want to
>    display the 'safe' user messages you have the optional dependency on the
>    translator. There is a comparison made with the Validator component, but in
>    my opinion that's a different case because the violations always contain
>    the message directed at the user and have no plain english message for the
>    developer. Apart from that the Validator component contains it's own code
>    for replacing {{ }} variables in messages (duplication? not as
>    flexible as the translator). Concluding I'd opt for: optional dependency on
>    translator component if you want to show 'safe' user messages + message
>    keys.
>
> @schmittjoh <https://github.com/schmittjoh> Any things to add?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/symfony/symfony/pull/4935#issuecomment-9861016>.
>
>

---------------------------------------------------------------------------

by fabpot at 2012-10-29T10:27:37Z

As I said in the discussion about the translations, I'm -1 for the message keys to be consistent with how we manage translations everywhere else in the framework.

---------------------------------------------------------------------------

by stof at 2012-10-29T10:30:50Z

@fabpot When we changed the English translation for the validation errors in 2.1, we had to tag the commit as a BC rbeak as it was changing the source for all other translations. And if you look at the state of the files now, you will see that we are *not* using the English as source anymore in some places as some validation errors have a pluralized translation but the source has not been changed.
So I think using a key is more future-proof.

---------------------------------------------------------------------------

by asm89 at 2012-10-30T19:44:49Z

Any final decision on this? On one hand I have @stof and @schmittjoh +1 on message keys, on the other @fabpot -1. I guess it's your call @fabpot.

Edit: also @vicb seemed to be +1 on message keys earlier on.

---------------------------------------------------------------------------

by drak at 2012-11-01T20:19:00Z

I am also -1, I agree with @fabpot

---------------------------------------------------------------------------

by asm89 at 2012-11-12T09:38:51Z

@fabpot Can you please give a definite answer on this? I personally think @stof and @vicb have good points to do message keys, but with all these different people +1 and -1'ing the PR I'm lost on what it should actually do.

---------------------------------------------------------------------------

by asm89 at 2012-11-14T09:59:06Z

ping @fabpot

---------------------------------------------------------------------------

by asm89 at 2012-11-26T10:01:27Z

ping @fabpot We talked about this in Berlin. Any final thoughts on the PR? :) One idea was to do message keys + opt depend on the translator component if you want to use them, or use your own implementation.

---------------------------------------------------------------------------

by fabpot at 2012-11-26T14:01:37Z

The conclusion is: keep using plain English.

On Mon, Nov 26, 2012 at 11:01 AM, Alexander <notifications@github.com>wrote:

> ping @fabpot <https://github.com/fabpot> We talked about this in Berlin.
> Any final thoughts on the PR? :) One idea was to do message keys + opt
> depend on the translator component if you want to use them, or use your own
> implementation.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/symfony/symfony/pull/4935#issuecomment-10709997>.
>
>

---------------------------------------------------------------------------

by Inori at 2012-11-26T15:00:22Z

is this final? if not, then +1 for message keys

---------------------------------------------------------------------------

by vicb at 2012-11-27T22:33:47Z

@fabpot I can't understand why we keep discussing this for months as this implementation use *both* keys and plain Englis, ie using  keys  is optional ( if it was not it would not be an issue according to #6129)

---------------------------------------------------------------------------

by asm89 at 2013-01-02T21:43:46Z

@fabpot @vicb I'll rebase this PR, fix the comments and refactor the message keys to use plain English + {{ }} syntax for the placeholders.

---------------------------------------------------------------------------

by asm89 at 2013-01-07T15:00:58Z

@fabpot If I fix this tonight, will it make the beta?

---------------------------------------------------------------------------

by fabpot at 2013-01-07T15:53:00Z

yes, definitely.

---------------------------------------------------------------------------

by asm89 at 2013-01-07T20:13:38Z

@fabpot I switched the implementation to English messages instead of message keys and fixed the final comments + rebased. Anything you want me to do after this?

Still happy with `getMessageKey()`?
2013-01-10 14:38:06 +01:00
Fabien Potencier
3a4869dd14 merged branch Tobion/relative-path (PR #3958)
This PR was merged into the master branch.

Commits
-------

6703fb5 added changelog entries
1997e2e fix phpdoc of UrlGeneratorInterface that missed some exceptions and improve language of exception message
f0415ed [Routing] made reference type fully BC and improved phpdoc considerably
7db07d9 [Routing] added tests for generating relative paths and network paths
75f59eb [Routing] add support for path-relative and scheme-relative URL generation

Discussion
----------

[2.2] [Routing] add support for path-relative URL generation

Tests pass: yes
Feature addition: yes
BC break: <del>tiny (see below)</del> NO
deprecations: NO

At the moment the Routing component only supports absolute and domain-relative URLs, e.g.
`http://example.org/user-slug/article-slug/comments` and
`/user-slug/article-slug/comments`.

But there are two link types missing: schema-relative URLs and path-relative URLs.
schema-relative: e.g. `//example.org/user-slug/article-slug/comments`
path-relative: e.g. `comments`.

Both of them would now be possible with this PR. I think it closes a huge gap in the Routing component.
Use cases are pretty common. Schema-relative URLs are for example used when you want to include assets (scripts, images etc) in a secured website with HTTPS. Path-relative URLs are the only option when you want to generate static files (e.g. documentation) that can be downloaded as an HTML archive. Such use-cases are currently not possible with symfony.

The calculation of the relative path based on the request path and target path is hightly unit tested. So it is really equivalent. I found several implemenations on the internet but none of them worked in all cases. Mine is pretty short and works.

I also added an optional parameter to the twig `path` function, so this feature can also be used in twig templates.

Ref: This implements path-relative URLs as suggested in #3908.

<del>[BC BREAK] The signature of UrlGeneratorInterface::generate changed to support scheme-relative and path-relative URLs. The core UrlGenerator is BC and does not break anything, but users who implemented their own UrlGenerator need to be aware of this change. See UrlGenerator::convertReferenceType.</del>

---------------------------------------------------------------------------

by jalliot at 2012-04-16T09:56:56Z

@Tobion For completeness, you should add the option to the `url` and `asset` twig functions/template helpers.

---------------------------------------------------------------------------

by stof at 2012-04-16T10:46:06Z

@jalliot adding the option to ``url`` does not make any sense. The difference between ``path`` and ``url`` is that ``path`` generates a path and ``url`` generates an absolute url (thus including the scheme and the hostname)

---------------------------------------------------------------------------

by Tobion at 2012-04-16T12:27:49Z

@stof I guess jalliot meant we could then generate scheme-relative URLs with `url`. Otherwise this would have no equivalent in twig.

---------------------------------------------------------------------------

by jalliot at 2012-04-16T12:34:08Z

@stof Yep I meant what @Tobion said :)

---------------------------------------------------------------------------

by Tobion at 2012-04-18T11:57:04Z

The $relative parameter I added besides the existing $absolute parameter of the `->generate` method was not clear enough. So I merged those into a different parameter `referenceType`. I adjusted all parts of symfony to use the new signature. And also made the default `UrlGenerator` implementation BC with the old style. So almost nobody will recognize a change. The only BC break would be for somebody who implemented his own `UrlGenerator` and did not call the parent default generator.
Using `referenceType` instead of a simple Boolean is much more flexible. It will for example allow a custom generator to support a new reference type like http://en.wikipedia.org/wiki/CURIE

---------------------------------------------------------------------------

by Tobion at 2012-04-18T13:34:58Z

ping @schmittjoh considering your https://github.com/schmittjoh/JMSI18nRoutingBundle/blob/master/Router/I18nRouter.php would need a tiny change

---------------------------------------------------------------------------

by schmittjoh at 2012-04-18T13:37:39Z

Can you elaborate the necessary change?

---------------------------------------------------------------------------

by Tobion at 2012-04-18T13:51:10Z

This PR changes the signature of `generate` to be able to generate path-relative and scheme-relative URLs. So it needs to be
`public function generate($name, $parameters = array(), $referenceType = self::ABSOLUTE_PATH)` and your implementation would need to change `if ($absolute && $this->hostMap) {` to `if (self::ABSOLUTE_URL === $referenceType && $this->hostMap) {`
I can do a PR if this gets merged.

---------------------------------------------------------------------------

by schmittjoh at 2012-04-18T13:52:14Z

If I understand correctly, the old parameter still works, no?

edit: Ah, ok I see what you mean now.

---------------------------------------------------------------------------

by Tobion at 2012-04-18T13:56:33Z

Yeah the old parameter still works but $absolute would also evaluate to true (a string) in your case for non-absolute URLs, i.e. paths.

---------------------------------------------------------------------------

by Tobion at 2012-04-19T21:09:46Z

ping @fabpot

---------------------------------------------------------------------------

by fabpot at 2012-04-20T04:30:18Z

Let's discuss that feature for 2.2.

---------------------------------------------------------------------------

by Tobion at 2012-04-20T10:40:59Z

What are your objections against it? It's already implemented, it works and it adds support for things that are part of a web standard. The BC break is tiny at the moment (almost nobody is affected) because the core UrlGenerator works as before. But if we waited for 2.2 it will be much harder to make the transition because 2.1 is LTS. So I think is makes sense to add it now. Furthermore it makes it much more future-proof as custom generators can more easiliy add support for other link types like CURIE. At the moment a Boolean for absolute URLs is simply too limited and also somehow inconsistent because $absolute = false stands for an absolute path. You see the awkwardness in this naming.

Btw, I added a note in the changelog. And I will add documentation of this feature in symfony-docs once this is merged.

---------------------------------------------------------------------------

by fabpot at 2012-04-20T12:14:32Z

nobody has ever said that 2.1 would be LTS. Actually, I think we are going to wait for 2.3 for LTS.

---------------------------------------------------------------------------

by Tobion at 2012-04-20T12:27:18Z

Well what I meant is, the longer we wait with this, the harder to apply it.
In 04ac1fdba2 you modified `generate` signature for better extensibility that is not even made use of. I think changing `$abolute` param goes in the same direction and has direct use.

I'd like to know your reason to wait for 2.2. Not enough time to review it, or afraid of breaking something, or marketing for 2.2?

---------------------------------------------------------------------------

by stof at 2012-04-20T16:28:27Z

@Tobion the issue is that merging new features forces to postpone the release so that it is tested by enough devs first to be sure there is no blocking bug in it. Big changes cannot be merged when we are hunting the remaining bugs to be able to release.

---------------------------------------------------------------------------

by schmittjoh at 2012-04-20T16:42:11Z

Considering the changes that have been made to the Form component, and are still being made, I think this is in comparison to that a fairly minor change.

Maybe a clearer guideline on the release process, or the direction would help, and avoid confusion, or wrong expectations on contributors' part.

---------------------------------------------------------------------------

by Tobion at 2012-10-05T13:52:11Z

@fabpot this is ready. So if you agree with it, I would create a documentation PR.

---------------------------------------------------------------------------

by stof at 2012-10-13T16:09:47Z

@fabpot what do you think about this PR ?

---------------------------------------------------------------------------

by Crell at 2012-11-01T16:05:01Z

This feels like it's overloading the generate() method to do double duty: One, make a URl based on a route.  Two, make a  URI based on a URI snippet.  Those are two separate operations.  Why not just add a second method that does the second operation and avoid the conditionals?  (We're likely to do that in Drupal for our own generator as well.)

---------------------------------------------------------------------------

by Tobion at 2012-11-01T16:38:39Z

@crell: No, you must have misunderstood something. The generate method still only generates a URI based on a route. The returned URI reference can now also be a relative path and a network path. Thats all.

---------------------------------------------------------------------------

by Tobion at 2012-12-13T18:30:28Z

@fabpot this is ready. It is fully BC! I also improved phpdoc considerably.

---------------------------------------------------------------------------

by Tobion at 2012-12-14T20:51:38Z

@fabpot Do you want me to write documentation for it? I would also be interested to write about the new features of the routing component in general. I wanted to do that anyway and it would probably be a good fit for your "new in symfony" articles.

---------------------------------------------------------------------------

by fabpot at 2012-12-14T20:58:16Z

Im' going to review this PR in the next coming days. And to answer your second question, more documentation or better documentation is always a good thing, so go for it.

---------------------------------------------------------------------------

by Tobion at 2013-01-02T21:50:20Z

@fabpot ping. I added changelog entries.
2013-01-09 10:27:51 +01:00
Fabien Potencier
aba96c7cae Merge branch '2.1'
* 2.1:
  [Console] Fix style escaping parsing
  [Console] Make style formatter matching less greedy to avoid having to escape when not needed
  [Bundle] [FrameworkBundle] fixed indentation in esi.xml services file.
  [Component] [Security] fixed PSR-2 coding violation in ClassUtilsTest class.
  [Form] Fixed EntityChoiceList when loading objects with negative integer IDs
  [TwigBundle] There is no CSS visibility of display, should be visible instead
  [Form] corrected source node for a Danish translation
  [DependencyInjection] fixed a bug where the strict flag on references were lost (closes #6607)
  [HttpFoundation] Check if required shell functions for `FileBinaryMimeTypeGuesser` are not disabled
  [CssSelector] added css selector with empty string
  [HttpFoundation] Docblock for Request::isXmlHttpRequest() now points to Wikipedia
  [DependencyInjection] refactored code to avoid logic duplication
  [Form] Deleted references in FormBuilder::getFormConfig() to improve performance
  [HttpFoundation] Update docblock for non-working method

Conflicts:
	src/Symfony/Bundle/TwigBundle/Resources/views/Exception/trace.html.twig
	src/Symfony/Bundle/TwigBundle/Resources/views/Exception/traces.html.twig
2013-01-08 19:17:41 +01:00
Hugo Hamon
2155719398 [Component] [Security] fixed PSR-2 coding violation in ClassUtilsTest class. 2013-01-08 15:45:08 +01:00
Alexander
73db84fd5e [Security] Move translations file to 'security' domain 2013-01-07 21:11:25 +01:00
Alexander
324703a9ff [Security] Switch to English messages as message keys 2013-01-07 21:11:24 +01:00
Alexander
aa7476967a [Security] Fix CS + unreachable code 2013-01-07 21:11:19 +01:00
Alexander
2d7a7ba139 [Security] Fix AuthenticationException serialization 2013-01-07 20:58:58 +01:00
Alexander
50d5724c23 [Security] Introduced UsernameNotFoundException#get/setUsername 2013-01-07 20:58:58 +01:00
Alexander
39da27a06d [Security] Removed get/setExtraInformation, added get/set(Token|User) 2013-01-07 20:58:58 +01:00
Alexander
837ae15102 [Security] Add note about changed constructor to changelog 2013-01-07 20:58:58 +01:00
Alexander
d7129b9a7e [Security] Fix exception constructors called in UserChecker 2013-01-07 20:58:58 +01:00
Alexander
0038fbb8b6 [Security] Add initial translations for AccountStatusException childs 2013-01-07 20:58:58 +01:00
Alexander
50e2cfc1f5 [Security] Add custom getMessageKey AccountStatusException childs 2013-01-07 20:58:58 +01:00
Alexander
1147977212 [Security] Fix InsufficientAuthenticationException constructor calls 2013-01-07 20:58:58 +01:00
Alexander
79430b8238 [Security] Fix AuthenticationServiceException constructor calls 2013-01-07 20:58:58 +01:00
Alexander
42cced4c97 [Security] Fix AuthenticationException constructor calls 2013-01-07 20:58:57 +01:00
Alexander
963a1d7b81 [Security] Add initial translations for the exceptions 2013-01-07 20:58:57 +01:00
Alexander
ed6eed4c36 [Security] Add getMessageKey and getMessageData to auth exceptions 2013-01-07 20:58:57 +01:00
Alexander
694c47ce96 [Security] Change signature of AuthenticationException to match \Exception 2013-01-07 20:58:57 +01:00
Joseph Bielawski
d570dbe545 [Security][Acl] CS fix for commit: 3c3a90b9e5 2013-01-07 10:00:39 +01:00
Ilya Biryukov
3c3a90b9e5 [Security][Acl] Reduce query size when Select ACL entries for many instances of the same Type at once 2013-01-07 09:54:34 +01:00
Fabien Potencier
47b3f8636f merged branch bschussek/exceptionfix (PR #6582)
This PR was merged into the master branch.

Commits
-------

184c8e5 Fixed @expectedException definitions to reference absolute exception paths

Discussion
----------

Added leading slashes to @expectedException definitions

Bug fix: no
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: -
Todo: -
License of the code: MIT
Documentation PR: -

This PR adds leading backslashes `\` to `@expectedException` declarations.

The current version is inconsistent with other class references in doc blocks, which default to *relative* class names unless class name has a leading backslash.

```php
/**
 * @param RelativeNs\Class $param1
 * @param \AbsoluteNs\Class $param2
 */

but

/**
 * @expectedException AbsoluteNs\Class
 */
```

Consequently, PHPStorm does not understand the current statements and marks them as erroneous (and correctly so IMO, even though PHPUnit's interpretation is more relaxed).
2013-01-05 19:24:35 +01:00
Bernhard Schussek
184c8e586f Fixed @expectedException definitions to reference absolute exception paths 2013-01-05 18:52:40 +01:00
Fabien Potencier
6250476eaa Merge branch '2.1'
* 2.1:
  Restrict Monolog version to be in version <1.3
  [Console] Make getTerminalWith & getTerminalHeight public
  [DependencyInjection] fixed PhpDumper optimizations when an inlined service depends on the current one indirectly
  [DependencyInjection] fixed PhpDumper when an inlined service definition has some properties
  [DependencyInjection] added some tests for PhpDumper when the container is compiled
  [DependencyInjection] fixed CS
  [Process] Do not reset stdout/stderr pipes on Interrupted system call
  [Locale] Adjust `StubIntlDateFormatter` to have new methods added in PHP 5.5
  use the right RequestMatcherInterface
  [Locale] Fix failing `StubIntlDateFormatter` tests in PHP 5.5
  [Locale] Fix failing `StubIntlDateFormatter` in PHP 5.5
  [Form] Fix failing `MonthChoiceList` in PHP 5.5
  Update .travis.yml

Conflicts:
	src/Symfony/Bridge/Monolog/composer.json
	src/Symfony/Component/DependencyInjection/Tests/Fixtures/php/services9.php
2013-01-05 16:33:05 +01:00
Fabien Potencier
ea09a538f2 merged branch dbu/2.1-requestmatcher-httputils (PR #6553)
This PR was merged into the 2.1 branch.

Commits
-------

d601b13 use the right RequestMatcherInterface

Discussion
----------

use the right RequestMatcherInterface

this fixes #6470 by using the right interface
2013-01-04 18:17:24 +01:00
Fabien Potencier
31ff3db517 Merge branch '2.1'
* 2.1: (24 commits)
  updated license year
  Update src/Symfony/Component/HttpFoundation/Response.php
  [Form] Fixed inheritance of "error_bubbling" in RepeatedType
  [Form] Fixed DateType when used with the intl extension disabled.
  [HttpFoundation] fix return types and handling of zero in Response
  [HttpFoundation] better fix for non-parseable Expires header date
  Fixed missing plural message in portuguese validator
  Fix Expires when the header is -1
  [DoctrineBridge] Allowing memcache port to be 0 to support memcache unix domain sockets.
  [Console] fixed unitialized properties (closes #5935)
  [Process] Prevented test from failing when pcntl extension is not enabled.
  Revert "[DoctrineBridge] Improved performance of the EntityType when used with the "query_builder" option"
  [Form] Fixed failing tests for DateTimeToStringTransformer.
  [Locale] Fixed the StubLocaleTest for ICU versions lower than 4.8.
  [Bundle] [FrameworkBundle] fixed typo in phpdoc of the SessionListener.
  [Form] Fixed test regression introduced in #6440
  [Tests] Fix namespaces
  Fixed php doc of GenericEvent::__construct
  HttpUtils must handle RequestMatcher too
  use preferred_choices in favor of preferred_query
  ...

Conflicts:
	src/Symfony/Bridge/Propel1/Form/ChoiceList/ModelChoiceList.php
2013-01-04 18:02:19 +01:00
Fabien Potencier
8349816dc5 Merge branch '2.0' into 2.1
* 2.0:
  updated license year
  Update src/Symfony/Component/HttpFoundation/Response.php
  [Console] fixed unitialized properties (closes #5935)
  [Bundle] [FrameworkBundle] fixed typo in phpdoc of the SessionListener.
  bumped Symfony version to 2.0.21-DEV
  updated VERSION for 2.0.21
  updated CHANGELOG for 2.0.21

Conflicts:
	src/Symfony/Bundle/SwiftmailerBundle/LICENSE
	src/Symfony/Component/Filesystem/LICENSE
	src/Symfony/Component/HttpFoundation/Response.php
	src/Symfony/Component/HttpKernel/Kernel.php
2013-01-04 18:00:54 +01:00
Fabien Potencier
df5c171490 updated license year 2013-01-04 17:59:43 +01:00
Fabien Potencier
18856428b6 updated license year 2013-01-04 17:58:00 +01:00
David Buchmann
d601b1377c use the right RequestMatcherInterface 2013-01-04 15:29:54 +01:00
Fabien Potencier
13f0a807b1 merged branch dbu/2.1-requestmatcher-httputils (PR #6470)
This PR was merged into the 2.1 branch.

Commits
-------

bfccd28 HttpUtils must handle RequestMatcher too

Discussion
----------

HttpUtils must handle RequestMatcher too

2.1 introduced the RequestMatcher as alternative to UrlMatcher. but HttpUtils was not adjusted.

---------------------------------------------------------------------------

by lsmith77 at 2013-01-01T18:15:13Z

@fabpot could you have a look at this PR? would like to know if this will be addressed in core or if we need to find another solution inside the CMF routing.
2013-01-02 10:30:52 +01:00
Fabien Potencier
ecb22de040 fixed CS 2012-12-29 21:07:36 +01:00
Anthony Ferrara
c543116925 Improve timing safe comparison function
Improve the timing safe comparison function to better handle cases where input is of different length.

Note that it is now important to always pass any string that the user can directly control to the second parameter of the function. Otherwise, length information may be leaked.
2012-12-29 07:51:01 -05:00
Fran Moreno
a6704f34f4 [Tests] Fix namespaces 2012-12-27 22:06:37 +01:00
David Buchmann
bfccd28207 HttpUtils must handle RequestMatcher too 2012-12-23 11:45:18 +01:00
Fabien Potencier
d90e55cbb3 merged branch Tobion/fix-double-encoding (PR #6363)
This PR was merged into the 2.0 branch.

Commits
-------

8b2c17f fix double-decoding in the routing system

Discussion
----------

fix double-decoding in the routing system

@fabpot @vicb This should fix it. You know what ;) Don't want to leak more information.
And the good thing, it's no hack nor does it break BC.
2012-12-20 08:11:40 +01:00
Florin Patan
c2acc6c2cb Fixed most of the docblocks/unused namespaces 2012-12-19 08:09:49 +01:00
Tobias Schultze
8b2c17f803 fix double-decoding in the routing system 2012-12-14 23:08:21 +01:00
Tobias Schultze
75f59ebe01 [Routing] add support for path-relative and scheme-relative URL generation 2012-12-13 20:13:09 +01:00
Fabien Potencier
fdb11be242 fixed CS 2012-12-11 11:49:22 +01:00
Fabien Potencier
3c010db2cb Merge branch '2.1'
* 2.1:
  fixed CS
  fixed CS
  [Security] fixed path info encoding (closes #6040, closes #5695)
  [HttpFoundation] added some tests for the previous merge and removed dead code (closes #6037)
  Improved Cache-Control header when no-cache is sent
  removed unneeded comment
  Fix to allow null values in labels array
  fix date in changelog
  removed the Travis icon (as this is not stable enough -- many false positive, closes #6186)
  Revert "merged branch gajdaw/finder_splfileinfo_fpassthu (PR #4751)" (closes #6224)
  Fixed a typo
  Fixed: HeaderBag::parseCacheControl() not parsing quoted zero correctly
  [Form] Fix const inside an anonymous function
  [Config] Loader::import must return imported data
  [DoctrineBridge] Fixed caching in DoctrineType when "choices" or "preferred_choices" is passed
  [Form] Fixed the default value of "format" in DateType to DateType::DEFAULT_FORMAT if "widget" is not "single_text"
  [HttpFoundation] fixed a small regression

Conflicts:
	src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/MongoDbSessionHandlerTest.php
2012-12-11 11:41:51 +01:00
Fabien Potencier
7f3be5c49d fixed CS 2012-12-11 11:40:22 +01:00
Fabien Potencier
d2885adffe Merge branch '2.0' into 2.1
* 2.0:
  fixed CS
  removed the Travis icon (as this is not stable enough -- many false positive, closes #6186)
  [Config] Loader::import must return imported data
  [HttpFoundation] fixed a small regression

Conflicts:
	README.md
	src/Symfony/Bridge/Twig/Extension/FormExtension.php
	src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/attributes.html.php
	src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_widget.html.php
	src/Symfony/Bundle/FrameworkBundle/Templating/Helper/FormHelper.php
	src/Symfony/Component/Form/Form.php
	src/Symfony/Component/HttpFoundation/Request.php
	src/Symfony/Component/HttpFoundation/SessionStorage/PdoSessionStorage.php
	tests/Symfony/Tests/Bridge/Doctrine/Logger/DbalLoggerTest.php
2012-12-11 11:33:11 +01:00
Fabien Potencier
a7cd5f54ef fixed CS 2012-12-11 11:27:06 +01:00
Fabien Potencier
d6a402a283 [Security] fixed path info encoding (closes #6040, closes #5695) 2012-12-11 10:40:23 +01:00
Fabien Potencier
9072951fce merged branch leevigraham/failure_path (PR #5860)
This PR was squashed before being merged into the master branch (closes #5860).

Commits
-------

d0057d0 Added failure_path_parameter to mirror target_path_parameter

Discussion
----------

Added failure_path_parameter to mirror target_path_parameter

Bug fix: no
Feature addition: yes
Backwards compatibility break: no
Symfony2 tests pass: yes
License of the code: MIT

Enable login failure redirect path can be assigned in a form field just like target path.

---------------------------------------------------------------------------

by stof at 2012-10-29T09:40:17Z

Please also open a PR to the doc repo to document this new feature

---------------------------------------------------------------------------

by leevigraham at 2012-10-29T09:56:29Z

@stof @fabpot Done.
2012-12-06 14:11:06 +01:00
Leevi Graham
d0057d0e64 Added failure_path_parameter to mirror target_path_parameter 2012-12-06 14:11:05 +01:00
Martin Hasoň
10e5f3b3df Removed useless branch alias for dev-master in composer.json 2012-12-06 11:00:55 +01:00
Fabien Potencier
869be1df6d Merge branch '2.1'
* 2.1:
  [Locale] fixed tests
  [Config] Fixed tests on Windows
  [TwigBundle] Fixed tests
  [Security] Move DigestDataTest.php inside the Security component
  Fixed DefaultValue for session.auto_start in NodeDefinition
  Fix namespace of Validator and BrowserKit Tests

Conflicts:
	src/Symfony/Bundle/TwigBundle/Tests/DependencyInjection/TwigExtensionTest.php
	src/Symfony/Bundle/TwigBundle/Tests/TwigEngineTest.php
2012-12-06 08:52:34 +01:00