Commit Graph

28166 Commits

Author SHA1 Message Date
Nicolas Grekas 4623fe74ca [travis] disable symfony/flex during phpunit install 2018-08-27 21:11:57 +02:00
Fabien Potencier a8b16054e7 bumped Symfony version to 2.8.46 2018-08-27 19:44:28 +02:00
Fabien Potencier 289dc238c5
Merge pull request #28286 from fabpot/release-2.8.45
released v2.8.45
2018-08-27 19:33:57 +02:00
Fabien Potencier 7e0a16cf2f updated VERSION for 2.8.45 2018-08-27 19:33:38 +02:00
Fabien Potencier 97e425cdcb update CONTRIBUTORS for 2.8.45 2018-08-27 19:33:31 +02:00
Fabien Potencier 0aee31fcd8 updated CHANGELOG for 2.8.45 2018-08-27 19:33:04 +02:00
Fabien Potencier b547855b23 bug #28278 [HttpFoundation] Fix unprepared BinaryFileResponse sends empty file (wackymole)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpFoundation] Fix unprepared BinaryFileResponse sends empty file

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes, with the exception of preexisting, unrelated failures
| Fixed tickets | #28237
| License       | MIT
| Doc PR        |

When you call `BinaryFileResponse#sendContent()` without first calling `prepare()` the response is sent but the contents are empty. `prepare()` properly initializes the `$maxlen` and `$offset` properties. However, `sendContent()` doesn't do any sanity checking, and so, uses the uninitialized properties. This causes `stream_copy_to_stream()` to copy empty contents and the file that is sent, to contain nothing.

This change initializes the properties at definition instead of in `prepare()`.

> Additionally:
> - Bug fixes must be submitted against the lowest branch where they apply

~I'm not sure how early this bug exists, or how far back to go. I'll check to see if 2.7 and 2.8 are affected and report back.~

Commits
-------

dba8687a5d Instantiate $offset and $maxlen at definition
2018-08-27 17:52:41 +02:00
Justin dba8687a5d Instantiate $offset and $maxlen at definition 2018-08-27 09:50:38 -04:00
Nicolas Grekas 2554ad0698 bug #28241 [HttpKernel] fix forwarding trusted headers as server parameters (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpKernel] fix forwarding trusted headers as server parameters

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28233, #28226, #28225, #28240
| License       | MIT
| Doc PR        | -

Commits
-------

92953485a5 [HttpKernel] fix forwarding trusted headers as server parameters
2018-08-24 16:33:48 +02:00
Nicolas Grekas 77cd8b694a minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[travis] fix composer.lock invalidation for deps=low

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

41ffba1916 [travis] fix composer.lock invalidation for deps=low
2018-08-24 14:40:49 +02:00
Nicolas Grekas 41ffba1916 [travis] fix composer.lock invalidation for deps=low 2018-08-24 14:37:56 +02:00
Nicolas Grekas e18bf6eee0 bug #28220 [PropertyAccess] fix type error handling when writing values (xabbuh)
This PR was merged into the 2.8 branch.

Discussion
----------

[PropertyAccess] fix type error handling when writing values

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Commits
-------

45754515a5 fix type error handling when writing values
2018-08-24 11:57:25 +02:00
Nicolas Grekas 92953485a5 [HttpKernel] fix forwarding trusted headers as server parameters 2018-08-22 17:45:23 +02:00
Fabien Potencier 0332f861c6 minor #28230 [Form] fix data mapper return type in docblock (xabbuh)
This PR was merged into the 2.8 branch.

Discussion
----------

[Form] fix data mapper return type in docblock

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Commits
-------

5bdc755d73 fix data mapper return type in docblock
2018-08-20 13:41:49 +02:00
Christian Flothmann 5bdc755d73 fix data mapper return type in docblock 2018-08-19 18:51:04 +02:00
Nicolas Grekas 48c531c09a [travis] fix composer.lock invalidation for PRs patching several components 2018-08-19 14:57:42 +02:00
Nicolas Grekas 13a5101502 minor fix for travis 2018-08-19 10:49:05 +02:00
Nicolas Grekas 68c00ad69d minor #28227 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[travis] fix composer.lock invalidation for deps=low

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Currently, tests for master on Travis fail for deps=low because an old commit is installed for the `symfony/security-http` depenceny of `SecurityBundle`. The reason is that composer.lock files are cached, but the invalidation logic misses checking the latest valid git commit.
This fixes it.

Commits
-------

02e3ec0539 [travis] fix composer.lock invalidation for deps=low
2018-08-19 10:15:42 +02:00
Nicolas Grekas 02e3ec0539 [travis] fix composer.lock invalidation for deps=low 2018-08-19 10:12:54 +02:00
Fabien Potencier 1d76f98e28 minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[travis][appveyor] use symfony/flex to accelerate builds

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Playing with https://github.com/symfony/flex/pull/409

The optimization is required because appveyor is transiently failing with OOM errors, see e.g.
https://ci.appveyor.com/project/fabpot/symfony/build/1.0.39377

Commits
-------

940ec8f2d5 [travis][appveyor] use symfony/flex to accelerate builds
2018-08-18 18:26:55 +02:00
Nicolas Grekas 940ec8f2d5 [travis][appveyor] use symfony/flex to accelerate builds 2018-08-18 18:09:18 +02:00
Christian Flothmann 45754515a5 fix type error handling when writing values 2018-08-17 19:56:06 +02:00
Robin Chalas ea0b508c8e bug #28100 [Security] Call AccessListener after LogoutListener (chalasr)
This PR was merged into the 2.8 branch.

Discussion
----------

[Security] Call AccessListener after LogoutListener

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28058
| License       | MIT
| Doc PR        | n/a

Commits
-------

44dbea6 [Security] Call AccessListener after LogoutListener
2018-08-11 13:15:56 +02:00
Nicolas Grekas 30b24d200b minor #28019 [Filesystem] Add test to prevent regression when using array|resource with dumpFile (thePanz)
This PR was merged into the 2.8 branch.

Discussion
----------

[Filesystem] Add test to prevent regression when using array|resource with dumpFile

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | none
| License       | MIT

Commits
-------

db1c21c8ae [Filesystem] Add test to prevent regression when using array|resource with dumpFile
2018-08-10 08:52:30 +02:00
Nicolas Grekas 74a4ceaad6 bug #28144 [HttpFoundation] fix false-positive ConflictingHeadersException (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpFoundation] fix false-positive ConflictingHeadersException

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28153
| License       | MIT
| Doc PR        | -

Fixes https://jira.ez.no/browse/EZP-29492 & https://jira.ez.no/browse/EZP-29497
Ping @andrerom

Commits
-------

6089290543 [HttpFoundation] fix false-positive ConflictingHeadersException
2018-08-08 10:05:06 +02:00
Nicolas Grekas a540aee35c [travis] ignore ordering when validating composer.lock files for deps=low 2018-08-07 17:19:50 +02:00
Nicolas Grekas fc7fb5cb4a minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[travis] cache composer.lock files for deps=low

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

I just realized that the resolved package versions for lowest deps depends only on the root composer.json, and not on transitive deps.
This means we can cache the lock files and save ~10 minutes required to resolve the lowest deps of the SecurityBundle.

Commits
-------

caaa74cd9b [travis] cache composer.lock files for deps=low
2018-08-07 11:32:16 +02:00
Ema Panz db1c21c8ae [Filesystem] Add test to prevent regression when using array|resource with dumpFile 2018-08-07 11:12:42 +02:00
Nicolas Grekas caaa74cd9b [travis] cache composer.lock files for deps=low 2018-08-07 09:58:32 +02:00
Nicolas Grekas 6089290543 [HttpFoundation] fix false-positive ConflictingHeadersException 2018-08-06 21:19:50 +02:00
Fabien Potencier a81d7d980d minor #28135 Update validators.nl.xlf (sstok)
This PR was merged into the 2.8 branch.

Discussion
----------

Update validators.nl.xlf

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

The original translation does not match intended communication.
`Deze waarde is geen geldige UUID waarde.` reads as `This value is not a valid UUID value`.

Commits
-------

7f895abbdd Update validators.nl.xlf
2018-08-06 17:01:40 +02:00
Fabien Potencier 20a818fb13 minor #28136 [Security] Remove wrong sentence about ACL (chalasr)
This PR was merged into the 2.8 branch.

Discussion
----------

[Security] Remove wrong sentence about ACL

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

The security-acl component has been extracted from the core in 2.8.

Commits
-------

67f3e3ff4e [Security] Remove wrong sentence about ACL
2018-08-06 16:59:52 +02:00
Robin Chalas 67f3e3ff4e [Security] Remove wrong sentence about ACL 2018-08-05 19:43:29 +02:00
Sebastiaan Stok 7f895abbdd
Update validators.nl.xlf 2018-08-05 16:25:16 +02:00
Nicolas Grekas 6cb792c9d6 fix ci 2018-08-03 15:16:31 +02:00
Nicolas Grekas f50ee9b3dc [travis] fix requiring mongodb/mongodb before composer up 2018-08-03 14:53:54 +02:00
Nicolas Grekas 0a450d72c5 [travis] fix CI for sigchild+Process 2018-08-03 13:10:36 +02:00
Nicolas Grekas 4879d89b54 minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[travis] merge "same Symfony version" jobs in one

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  |
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Allowing to consume fewer jobs and save the 1 to 2 minutes bootstrap time of workers.

Commits
-------

9857ca07aa [travis] merge "same Symfony version" jobs in one
2018-08-03 12:00:22 +02:00
Nicolas Grekas 9857ca07aa [travis] merge "same Symfony version" jobs in one 2018-08-03 11:45:57 +02:00
Fabien Potencier 470ac26674 bug #28055 [PropertyInfo] Allow nested collections (jderusse)
This PR was merged into the 2.8 branch.

Discussion
----------

[PropertyInfo] Allow nested collections

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Duplicate of #28012 for the 2.8 branche (as both code and test have been refactored between 2.8 and 3.x

Commits
-------

6331687f65 Allow multidimensional collection in property info
2018-08-02 11:24:17 +02:00
Fabien Potencier 5d8bf1618a bug #28083 Remove the Expires header when calling Response::expire() (javiereguiluz)
This PR was merged into the 2.8 branch.

Discussion
----------

Remove the Expires header when calling Response::expire()

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #13341   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | -

Commits
-------

ac0cd15402 Remove the Expires header when calling Response::expire()
2018-08-02 11:19:39 +02:00
Robin Chalas 44dbea6330 [Security] Call AccessListener after LogoutListener 2018-08-01 20:49:49 +02:00
Fabien Potencier 3ff6e333dd bumped Symfony version to 2.8.45 2018-08-01 16:46:30 +02:00
Fabien Potencier 789dc7eb57
Merge pull request #28101 from fabpot/release-2.8.44
released v2.8.44
2018-08-01 16:12:49 +02:00
Fabien Potencier 4abd3a8eb0 updated VERSION for 2.8.44 2018-08-01 16:12:31 +02:00
Fabien Potencier 282e062226 update CONTRIBUTORS for 2.8.44 2018-08-01 16:12:26 +02:00
Fabien Potencier 15835bc7df updated CHANGELOG for 2.8.44 2018-08-01 16:12:10 +02:00
Nicolas Grekas 0f7667d643 security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (nicolas-grekas)
* commit '725dee4cd8':
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
2018-08-01 15:48:20 +02:00
Nicolas Grekas 725dee4cd8 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer 2018-08-01 15:47:49 +02:00
Nicolas Grekas 6604978f83 security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpFoundation] Remove support for legacy and risky HTTP headers

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

e447e8b921 [HttpFoundation] Remove support for legacy and risky HTTP headers
2018-08-01 10:34:59 +02:00