Commit Graph

27961 Commits

Author SHA1 Message Date
Javier Eguiluz
40e59a6415 Add code of Conduct links in our README 2018-05-25 16:34:01 +02:00
Nicolas Grekas
586b1231f8 minor #27370 Default testsuite to latest PHPUnit 6.* (ostrolucky)
This PR was submitted for the 2.7 branch but it was merged into the 2.8 branch instead (closes #27370).

Discussion
----------

Default testsuite to latest PHPUnit 6.*

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Necessary to fix each() function deprecation calls introduced in PHP 7.2

![obrazok](https://user-images.githubusercontent.com/496233/40514525-b6099d64-5fa9-11e8-906b-ccd8c358b5a5.png)

Commits
-------

37e543329a Default testsuite to latest PHPUnit 6.*
2018-05-25 15:04:14 +02:00
Gabriel Ostrolucký
37e543329a Default testsuite to latest PHPUnit 6.*
Necessary to fix each() function deprecation calls introduced in PHP 7.2
2018-05-25 15:04:04 +02:00
Nicolas Grekas
2fd6ab9b02 minor #27376 [Github] Update the pull-request template (sroze)
This PR was squashed before being merged into the 2.8 branch (closes #27376).

Discussion
----------

[Github] Update the pull-request template

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | ø
| License       | MIT
| Doc PR        | ø

2.7 is end of life.

Commits
-------

99327a6153 [Github] Update the pull-request template
2018-05-25 15:02:56 +02:00
Samuel ROZE
99327a6153 [Github] Update the pull-request template 2018-05-25 15:02:46 +02:00
Fabien Potencier
37846d453a bumped Symfony version to 2.8.42 2018-05-25 14:30:40 +02:00
Fabien Potencier
24fc640d54
Merge pull request #27375 from fabpot/release-2.8.41
released v2.8.41
2018-05-25 14:03:11 +02:00
Fabien Potencier
786970f17d updated VERSION for 2.8.41 2018-05-25 14:02:50 +02:00
Fabien Potencier
ef0b5004f8 updated CHANGELOG for 2.8.41 2018-05-25 14:02:41 +02:00
Fabien Potencier
ca6cc78c7e Merge branch '2.7' into 2.8
* 2.7:
  [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization
2018-05-25 13:00:14 +02:00
Fabien Potencier
ab32125187 bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas)
This PR was merged into the 2.7 branch.

Discussion
----------

[HttpFoundation] Fix perf issue during MimeTypeGuesser intialization

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #27307
| License       | MIT
| Doc PR        | -

introduced in #26886

![image](https://user-images.githubusercontent.com/243674/40451947-918f5358-5ee0-11e8-9f1a-cf707bf3cefa.png)

Commits
-------

f8e7a18d1b [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization
2018-05-25 12:53:06 +02:00
Fabien Potencier
2ed0cedb19 fixed constraints 2018-05-25 09:32:23 +02:00
Fabien Potencier
43a0affb8f Merge branch '2.7' into 2.8
* 2.7:
  fixed constraints
  bumped dep
  bumped dep
2018-05-25 08:52:49 +02:00
Fabien Potencier
2f34263a1a fixed constraints 2018-05-25 08:35:17 +02:00
Fabien Potencier
1151ab28c0 bumped dep 2018-05-25 08:20:37 +02:00
Fabien Potencier
87153549f6 bumped dep 2018-05-25 07:45:02 +02:00
Christian Flothmann
32c73a71a7 fixtures config fix 2018-05-24 20:59:44 +02:00
Fabien Potencier
6d455f224b Merge branch '2.7' into 2.8
* 2.7:
  [SecurityBundle] Fail if security.http_utils cannot be configured
2018-05-24 15:22:57 +02:00
Fabien Potencier
b20e83562e security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured
* cve-2018-11408-2.7:
  [SecurityBundle] Fail if security.http_utils cannot be configured
2018-05-24 15:22:46 +02:00
Nicolas Grekas
c003b7a247 [SecurityBundle] Fail if security.http_utils cannot be configured 2018-05-24 15:22:37 +02:00
Fabien Potencier
2111742676 Merge branch '2.7' into 2.8
* 2.7:
  clear CSRF tokens when the user is logged out
2018-05-24 14:58:29 +02:00
Fabien Potencier
319e1bdd43 security #cve-2018-11406 clear CSRF tokens when the user is logged out
* cve-2018-11406-2.7:
  clear CSRF tokens when the user is logged out
2018-05-24 14:39:56 +02:00
Christian Flothmann
4b91c171af clear CSRF tokens when the user is logged out 2018-05-24 14:39:52 +02:00
Nicolas Grekas
f8e7a18d1b [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization 2018-05-23 23:23:26 +02:00
Fabien Potencier
fad1e1f2ea security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation
* cve-2018-11385-2.8:
  Adding session authentication strategy to Guard to avoid session fixation
2018-05-23 15:51:54 +02:00
Ryan Weaver
f2e83ba44d Adding session authentication strategy to Guard to avoid session
fixation
2018-05-23 15:51:48 +02:00
Fabien Potencier
a1a5fa8b2f Merge branch '2.7' into 2.8
* 2.7:
  Adding session strategy to ALL listeners to avoid *any* possible fixation
2018-05-23 15:51:01 +02:00
Fabien Potencier
fa5bf4b17d security #cve-2018-11385 Adding session strategy to ALL listeners to avoid *any* possible fixation
* cve-2018-11385-2.7:
  Adding session strategy to ALL listeners to avoid *any* possible fixation
2018-05-23 15:50:13 +02:00
Ryan Weaver
a5855e8c97 Adding session strategy to ALL listeners to avoid *any* possible
fixation
2018-05-23 15:49:30 +02:00
Fabien Potencier
abc802390b Merge branch '2.7' into 2.8
* 2.7:
  [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
2018-05-23 15:29:24 +02:00
Fabien Potencier
a75781cc29 Merge branch '2.7' into 2.8
* 2.7:
  bumped Symfony version to 2.7.48
  updated VERSION for 2.7.47
  update CONTRIBUTORS for 2.7.47
  updated CHANGELOG for 2.7.47
2018-05-23 15:24:13 +02:00
Fabien Potencier
47e72683c6 security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
* cve-2018-11386:
  [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
2018-05-23 15:15:59 +02:00
Nicolas Grekas
0cf874e23e [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode 2018-05-23 14:36:15 +02:00
Fabien Potencier
6d4de55666 bumped Symfony version to 2.8.41 2018-05-21 15:43:22 +02:00
Fabien Potencier
901a4fb385
Merge pull request #27328 from fabpot/release-2.8.40
released v2.8.40
2018-05-21 15:17:42 +02:00
Fabien Potencier
ca80b59dc1 updated VERSION for 2.8.40 2018-05-21 15:17:29 +02:00
Fabien Potencier
b9ff0b0124 updated CHANGELOG for 2.8.40 2018-05-21 15:17:24 +02:00
Fabien Potencier
84bba75ad1 bumped Symfony version to 2.7.48 2018-05-21 13:56:57 +02:00
Fabien Potencier
f629de3af2
Merge pull request #27327 from fabpot/release-2.7.47
released v2.7.47
2018-05-21 13:48:51 +02:00
Fabien Potencier
e55c38be00 updated VERSION for 2.7.47 2018-05-21 13:48:33 +02:00
Fabien Potencier
fb1aea810e update CONTRIBUTORS for 2.7.47 2018-05-21 13:48:28 +02:00
Fabien Potencier
e559215fcf updated CHANGELOG for 2.7.47 2018-05-21 13:47:41 +02:00
Fabien Potencier
e336711cd9 Merge branch '2.7' into 2.8
* 2.7:
  do not mock the session in token storage tests
  Add Occitan plural rule
  Disallow illegal characters like "." in session.name
  fix rounding from string
2018-05-21 11:59:10 +02:00
Robin Chalas
1c520a920f minor #27310 [Security] do not mock the session in token storage tests (xabbuh)
This PR was merged into the 2.7 branch.

Discussion
----------

[Security] do not mock the session in token storage tests

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Commits
-------

919f93d do not mock the session in token storage tests
2018-05-19 06:09:13 +02:00
Christian Flothmann
919f93d91c do not mock the session in token storage tests 2018-05-18 20:00:42 +02:00
Fabien Potencier
05d69bb739 bug #26781 [Form] Fix precision of MoneyToLocalizedStringTransformer's divisions on transform() (syastrebov)
This PR was merged into the 2.7 branch.

Discussion
----------

[Form] Fix precision of MoneyToLocalizedStringTransformer's divisions on transform()

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | no
| License       | MIT
| Doc PR        |

Related issue https://github.com/symfony/symfony/issues/21026.
Previous PR https://github.com/symfony/symfony/pull/24036.
Similar fix for `transform()` method.

Commits
-------

f94b7aadd3 fix rounding from string
2018-05-17 12:49:33 +02:00
Fabien Potencier
4c08893861 minor #27295 Fix security/* cross-dependencies (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

Fix security/* cross-dependencies

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Let's allow installing security-fixed versions of the security/* components.

Commits
-------

44cef5a69d Fix security/* cross-dependencies
2018-05-17 12:46:26 +02:00
Fabien Potencier
e1f553d741 bug #27286 [Translation] Add Occitan plural rule (kylekatarnls)
This PR was submitted for the master branch but it was merged into the 2.7 branch instead (closes #27286).

Discussion
----------

[Translation] Add Occitan plural rule

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Enable correct plural on Occitan translations. Could be safely merged in versions branches.

Commits
-------

0de3a61cfc Add Occitan plural rule
2018-05-17 12:34:13 +02:00
Kyle
0de3a61cfc Add Occitan plural rule 2018-05-17 12:34:06 +02:00
Fabien Potencier
e98ce72e26 bug #27246 Disallow invalid characters in session.name (ostrolucky)
This PR was merged into the 2.7 branch.

Discussion
----------

Disallow invalid characters in session.name

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #27023
| License       | MIT
| Doc PR        |

PHP saves cookie with correct name, but upon deserialization to
`$_COOKIE`, it replaces "." characters with "_".

This is probably also reason why \SessionHandler is not able to find
a session.

https://harrybailey.com/2009/04/dots-arent-allowed-in-php-cookie-names/
https://bugs.php.net/bug.php?id=75883

Commits
-------

16ebb43bd4 Disallow illegal characters like "." in session.name
2018-05-17 12:20:37 +02:00