Commit Graph

2796 Commits

Author SHA1 Message Date
Jérémy Derussé
4c8442462a
Fix assertInternalType deprecation in phpunit 9 2019-08-01 09:40:28 +02:00
Nicolas Grekas
81af97f398 Make tests support phpunit 8 2019-07-31 23:55:24 +02:00
Benny Born
54107bac33 [HttpFoundation] Fix getMaxFilesize 2019-07-30 19:35:39 +02:00
Arman Hosseini
be53c593dc [HttpFoundation] Fix URLs 2019-07-23 08:27:47 +02:00
Thomas Calvet
f7e24c2c80 Remove dead tests fixtures 2019-07-19 13:52:08 +02:00
Fabien Potencier
bd498f2503 fixed CS 2019-07-08 13:57:06 +02:00
Fabien Potencier
931965a448 bug #32096 Don't assume port 0 for X-Forwarded-Port (alexbowers, xabbuh)
This PR was merged into the 3.4 branch.

Discussion
----------

Don't assume port 0 for X-Forwarded-Port

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | none added
| Fixed tickets |
| License       | MIT
| Doc PR        | -

If you use X-Forwarded-Host but don't provide X-Forwarded-Port, it will default to `0.0.0.0:` which then assumes port `0` instead of following its default assumption based on the scheme.

Commits
-------

adcdd938a4 PHP 5 compat
6c49a0c758 Add test case
c266d6c737 Update Request.php
23db9be884 Don't assume port 0 for X-Forwarded-Port
2019-07-08 13:55:51 +02:00
Christian Flothmann
adcdd938a4 PHP 5 compat 2019-07-04 23:04:55 +02:00
Alex Bowers
6c49a0c758 Add test case 2019-06-30 23:48:04 +01:00
Nicolas Grekas
b6e8b17dc4 minor #32215 [HttpFoundation] Throw exception when the "session" extension is not loaded (vudaltsov)
This PR was squashed before being merged into the 3.4 branch (closes #32215).

Discussion
----------

[HttpFoundation] Throw exception when the "session" extension is not loaded

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #31305
| License       | MIT

Should I target `3.4` or `master` instead? This change does not alter behavior, but makes the failure more clear.

Commits
-------

b0c663071b [HttpFoundation] Throw exception when the \"session\" extension is not loaded
2019-06-28 14:47:57 +02:00
Valentin Udaltsov
b0c663071b [HttpFoundation] Throw exception when the \"session\" extension is not loaded 2019-06-28 14:47:50 +02:00
Christian Flothmann
7a4570dcac fix accessing session bags 2019-06-22 22:10:25 +02:00
Alex Bowers
c266d6c737
Update Request.php 2019-06-19 17:03:11 +01:00
Fabien Potencier
df210194e0 minor #32100 Update ajax security cheat sheet link (steef)
This PR was merged into the 3.4 branch.

Discussion
----------

Update ajax security cheat sheet link

| Q             | A
| ------------- | ---
| Branch?       | 3.4 <!-- see below -->
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

# Description
After looking in the `JsonResponse` class I found an old OWASP [link](https://www.owasp.org/index.php/AJAX_Security_Cheat_Sheet#Always_return_JSON_with_an_Object_on_the_outside). As the cheat sheet series project is moved to GitHub the link can be updated to the [following](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/AJAX_Security_Cheat_Sheet.md).

## Screenshot
<img width="552" alt="Screenshot 2019-06-19 at 16 52 19" src="https://user-images.githubusercontent.com/34915382/59776184-a7e2bf80-92b2-11e9-8d23-802acfddfb1d.png">

Commits
-------

32d02d6141 Update ajax security cheat sheet link
2019-06-19 17:25:42 +02:00
Stefano Degenkamp
32d02d6141
Update ajax security cheat sheet link
As the cheat sheet series project has been moved to github.
2019-06-19 17:21:12 +02:00
Alex Bowers
23db9be884
Don't assume port 0 for X-Forwarded-Port 2019-06-19 12:46:55 +01:00
Roland Franssen
270f10cc81 [HttpFoundation] Fix SA/phpdoc JsonResponse 2019-06-16 13:18:06 +02:00
Stefano Degenkamp
d445465ef4 Fix binary operation +, - or * on string
By type casting to integer.
2019-06-13 17:39:17 +02:00
Fabien Potencier
106b348d3d fixed CS 2019-06-13 12:34:15 +02:00
Fabien Potencier
11f04abcd4 bug #31863 [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor (Ivo)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor

…r in RedirectResponse constructor.

| Q             | A
| ------------- | ---
| Branch?       |  3.4
| Bug fix?      | yes
| New feature?  |no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #31862  <!-- #-prefixed issue number(s), if any -->
| License       | MIT

Perform a case-insensitive check on `$headers` in \Symfony\Component\HttpFoundation\RedirectResponse::__construct()

Commits
-------

b5e6c99a3b [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor.
2019-06-05 15:24:38 +02:00
Nicolas Grekas
d18f42c409 Fix json-encoding when JSON_THROW_ON_ERROR is used 2019-06-05 13:33:52 +02:00
Ivo
b5e6c99a3b [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor. 2019-06-05 10:24:41 +02:00
Nicolas Grekas
e6e63017f0 [HttpFoundation] work around PHP 7.3 bug related to json_encode() 2019-06-04 20:52:06 +02:00
Alexander M. Turek
4fb67df612 Use willReturn() instead of will(returnValue()). 2019-05-30 17:47:52 +02:00
Vilius Grigaliūnas
a662f61e08 [HttpFoundation] Do not set X-Accel-Redirect for paths outside of X-Accel-Mapping
Currently BinaryFileResponse, when configured with X-Accel-Redirect sendfile type,
will only substitute file paths specified in X-Accel-Mapping. But if the provided
file path does not have a defined prefix, then the resulting header will include
the absolute path. Nginx expects a valid URI, therefore this will result in an
issue that is very hard to detect and debug as it will not show up in error logs
and instead the request would just hang for some time and then be re-served
without query parameters(?).
2019-05-28 15:48:21 +03:00
mmokhi
0cef5f3ec9 Use AsserEquals for floating-point values
Use AssertEquals for these two specific case will do a better job,
since it'll convert both '0.1' and result of `getContent()` into PHP's
internal representation of floating-point and compares them and it should be fine.
Using `AssertSame` for this tests brings floating-point serialization
into consideration which of course will be php.ini specific.

In order not missing the type assertion point that `AssertSame` does,
we also perform `assertInternalType('string'...`

Sponsored-by: Platform.sh
2019-05-28 12:41:01 +02:00
Michael Käfer
34d4fa66e7 Fixes a small doc blocks syntax error 2019-05-27 07:50:24 +02:00
Fabien Potencier
c866efa615 fixed a phpdoc 2019-05-18 18:33:51 +02:00
Marcos Gómez Vilches
8bac3d6fa3
Allow set 'None' on samesite cookie flag
Allow set samesite cookie flag to 'None' value
2019-05-10 21:58:31 +02:00
Nicolas Grekas
4177331915 Revert "bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)"
This reverts commit 029fb2e7e3, reversing
changes made to 9dad29d61c.
2019-05-01 10:04:33 +02:00
Nicolas Grekas
8e93ef3d01 [HttpFoundation] fix tests 2019-04-19 15:43:39 +02:00
Nicolas Grekas
13113245bf bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Make MimeTypeExtensionGuesser case insensitive

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #...   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

Some mime types have a camelCase word in them.
The Apache HTTPD project list items are all lower case.
So I suggest making the $mimeType string lowercase while checking the array key.
That way, we can keep the list in sync.

Example: xlsm file mime type is `application/vnd.ms-excel.sheet.macroEnabled.12`
The key that matches the xlsm extension in the `$defaultExtensions` array is `application/vnd.ms-excel.sheet.macroenabled.12`

Example xlsm file:
https://github.com/vermeirentony/xlsm-example

Commits
-------

e294ee6b9a Make MimeTypeExtensionGuesser case insensitive
2019-04-17 16:51:18 +02:00
Nicolas Grekas
944e60f083 [HttpFoundation] reject invalid method override 2019-04-16 07:40:48 +01:00
Tony Vermeiren
e294ee6b9a Make MimeTypeExtensionGuesser case insensitive 2019-04-16 08:01:19 +02:00
Oskar Stark
8b5c5ed587 use behavior instead of behaviour 2019-03-25 08:48:46 +01:00
David Maicher
e46ef76cb9 [FrameworkBundle][HttpFoundation] make session service resettable 2019-03-22 16:39:02 +01:00
ScoobyDam
e89c9213e2
Response prepare method update
Response prepare updated for more coherence.
2019-03-21 19:51:37 +01:00
Teoh Han Hui
bd92349a3e
Fix return type of Request::getRequestFormat 2019-03-12 15:29:13 +01:00
Nicolas Grekas
b0a3208588 Apply php-cs-fixer rule for array_key_exists() 2019-02-23 16:06:07 +01:00
Raphaëll Roussel
bc6e0f80ff Remove gendered pronouns 2019-01-27 10:04:14 +01:00
adam-mospan
1954187fac [HttpFoundation] Check file exists before unlink 2019-01-25 12:01:01 +01:00
Nicolas Grekas
a1a3ffc1b9 bug #29783 [HttpFoundation] MemcachedSessionHandler::close() must close connection (grachevko)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] MemcachedSessionHandler::close() must close connection

| Q             | A
| ------------- | ---
| Branch?       | 3.4 <!-- see below -->
| Bug fix?      | yes
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| License       | MIT

Intoduced here https://github.com/symfony/symfony/pull/3333

Commits
-------

38a9d8b6a3 [Bugfix] MemcachedSessionHandler::close() must close connection
2019-01-25 11:55:39 +01:00
Tom Van Looy
335036cf09 Enable PHP 7.3 on Travis 2019-01-24 22:57:19 +01:00
Fabien Potencier
37ab4cd056 fixed CS 2019-01-16 14:43:35 +01:00
Fabien Potencier
1429267f9c fixed short array CS in comments 2019-01-16 14:27:11 +01:00
Fabien Potencier
ec7dcb2784 fixed CS in generated files 2019-01-16 13:48:01 +01:00
Fabien Potencier
33a001e460 switched array() to [] 2019-01-16 10:39:14 +01:00
Fabien Potencier
5183049b73 updated MimeType extensions 2019-01-14 18:38:02 +01:00
Konstantin Grachev
38a9d8b6a3
[Bugfix] MemcachedSessionHandler::close() must close connection 2019-01-06 22:40:17 +03:00
Fabien Potencier
e38b5d2990 bug #29494 [HttpFoundation] Fix request uri when it starts with double slashes (alquerci)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Fix request uri when it starts with double slashes

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #29478
| License       | MIT
| Doc PR        | ~

When the `REQUEST_URI` starts with a slash no need to `parse_url()`. However to keep the same behaviour regarding the fragment we need to add a logic to remove it. While `parse_url()` handle all cases itself.

Commits
-------

cf850c1a15 [HttpFoundation] Fix request uri when it starts with double slashes
2019-01-05 09:05:37 +01:00