Commit Graph

17765 Commits

Author SHA1 Message Date
Fabien Potencier 4e44295288 updated CHANGELOG for 2.3.35 2015-11-23 11:43:52 +01:00
Fabien Potencier f95078c409 security #16631 n/a (xabbuh)
This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

f88e600 migrate session after remember me authentication
2015-11-23 11:22:15 +01:00
Fabien Potencier c51977293a security #16630 n/a (xabbuh)
This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

819aa54 prevent timing attacks in digest auth listener
557ea17 mitigate CSRF timing attack vulnerability
f1fd768 fix potential timing attack issue
2015-11-23 11:21:11 +01:00
Christian Flothmann f88e600833 migrate session after remember me authentication 2015-11-23 11:04:06 +01:00
Christian Flothmann 819aa54fe4 prevent timing attacks in digest auth listener 2015-11-23 11:02:49 +01:00
Christian Flothmann 557ea17eeb mitigate CSRF timing attack vulnerability 2015-11-23 11:02:49 +01:00
Christian Flothmann f1fd7686c5 fix potential timing attack issue 2015-11-23 11:02:49 +01:00
Fabien Potencier 3dc2244187 bug #16588 Sent out a status text for unknown HTTP headers. (dawehner)
This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes #16588).

Discussion
----------

Sent out a status text for unknown HTTP headers.

* The HTTP RFC explains that header('HTTP/1.1 418 ') should be fine, see http://www.w3.org/Protocols/rfc2616/rfc2616-sec6.html#sec6.1
* Apache itself though is broken, see https://gist.github.com/anonymous/a863d7b493c4b09733ec

The fix is to sent out some status text, when we don't know a better text.

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Commits
-------

eec6fbc Sent out a status text for unknown HTTP headers.
2015-11-19 17:24:58 +01:00
Daniel Wehner eec6fbc768 Sent out a status text for unknown HTTP headers. 2015-11-19 17:24:57 +01:00
Fabien Potencier f11e2e9601 bug #16295 [DependencyInjection] Unescape parameters for all types of injection (Nicofuma)
This PR was merged into the 2.3 branch.

Discussion
----------

[DependencyInjection] Unescape parameters for all types of injection

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

The parameters must be escaped when injected in the container.
But they are only unescaped when the container is dumped and when these parameters are used in the service constructor.
We need to unescape them every time their are injected (constructor, setter and property injection)

Commits
-------

331a046 [DependencyInjection] Unescape parameters for all types of injection
2015-11-19 17:18:46 +01:00
Tristan Darricau 331a0469c1 [DependencyInjection] Unescape parameters for all types of injection 2015-11-19 15:08:33 +01:00
Nicolas Grekas 1728dcca82 minor #16599 [Process] Fix trailing space in PHP binary finder (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[Process] Fix trailing space in PHP binary finder

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #16598
| License       | MIT
| Doc PR        | -

Commits
-------

f15e6e0 [Process] Fix trailing space in PHP binary finder
2015-11-19 13:57:32 +01:00
Nicolas Grekas f15e6e0ba9 [Process] Fix trailing space in PHP binary finder 2015-11-19 13:49:26 +01:00
Nicolas Grekas 49aa6d4351 minor #16595 Remove tmp addition of zend-stdlib (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

Remove tmp addition of zend-stdlib

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Reverts #16553

Commits
-------

6e015e7 Remove tmp addition of zend-stdlib
2015-11-19 13:48:26 +01:00
Nicolas Grekas 6e015e7e0e Remove tmp addition of zend-stdlib 2015-11-19 13:33:53 +01:00
Nicolas Grekas a05e73fa47 bug #16574 [Process] Fix PhpProcess with phpdbg runtime (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[Process] Fix PhpProcess with phpdbg runtime

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

With this PR, I'm able to successfully run the test suite of the Process component using
`phpdbg -qrr ./phpunit src/Symfony/Component/Process/`

Commits
-------

9669238 [Process] Fix PhpProcess with phpdbg runtime
2015-11-18 17:26:24 +01:00
Nicolas Grekas 9669238af6 [Process] Fix PhpProcess with phpdbg runtime 2015-11-18 16:41:59 +01:00
Fabien Potencier 6f72d6346e minor #16580 Add missing exclusions from phpunit.xml.dist (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

Add missing exclusions from phpunit.xml.dist

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

d4880c4 Add missing exclusions from phpunit.xml.dist
2015-11-18 11:16:24 +01:00
Fabien Potencier a4ea881109 minor #16566 [HttpFoundation] Fix undefined array $server (belka-ew)
This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes #16566).

Discussion
----------

[HttpFoundation] Fix undefined array $server

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

$server variable isn't defined in the test /src/Symfony/Component/HttpFoundation/Tests/RequestTest.php:RequestTest

Commits
-------

75aa6f6 Fix undefined array $server
2015-11-18 11:13:04 +01:00
Eugene Wissner 75aa6f68f8 Fix undefined array $server 2015-11-18 11:13:04 +01:00
Nicolas Grekas 040b4095fa minor #16553 [ProxyManager] Tmp fix composer reqs issue in ZF (nicolas-grekas)
This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes #16553).

Discussion
----------

[ProxyManager] Tmp fix composer reqs issue in ZF

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

See https://github.com/Ocramius/ProxyManager/issues/260#issuecomment-156962918

Commits
-------

0125145 [ProxyManager] Tmp fix composer reqs issue in ZF
2015-11-18 10:04:25 +01:00
Nicolas Grekas 01251455c0 [ProxyManager] Tmp fix composer reqs issue in ZF 2015-11-18 10:04:13 +01:00
Nicolas Grekas d4880c4785 Add missing exclusions from phpunit.xml.dist 2015-11-18 09:19:46 +01:00
Fabien Potencier c0f7463c3e bug #16352 Fix the server variables in the router_*.php files (leofeyer)
This PR was squashed before being merged into the 2.3 branch (closes #16352).

Discussion
----------

Fix the server variables in the router_*.php files

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | none
| License       | MIT

The built-in web server automatically rewrites everything to the `app_dev.php` script, but it does not adjust the server variables accordingly.

Here is the output of `print_r($_SERVER)` on Apache with mod_rewrite enabled (relevant lines only):

```
Array
(
    [REQUEST_URI] => /text-elements.html
    [SCRIPT_NAME] => /app_dev.php
    [PHP_SELF] => /app_dev.php
)
```

And here is the output of the exact same script on the built-in server:

```
Array
(
    [REQUEST_URI] => /text-elements.html
    [SCRIPT_NAME] => /text-elements.html
    [PHP_SELF] => /text-elements.html
)
```

And here is the return value of Symfony's `Request::getScriptName()` method:

```php
// Apache: http://localhost/text-elements.html
echo $this->container->get('request_stack')->getCurrentRequest()->getScriptName(); // /app_dev.php

// Built-in web server: http://127.0.0.1:8000/text-elements.html
echo $this->container->get('request_stack')->getCurrentRequest()->getScriptName(); // /text-elements.html
```

This PR fixes the two server variables in the `router_dev.php` script.

Commits
-------

4923411 Fix the server variables in the router_*.php files
2015-11-13 09:09:50 +01:00
Leo Feyer 4923411062 Fix the server variables in the router_*.php files 2015-11-13 09:09:48 +01:00
Fabien Potencier f2e87224e0 bug #16537 [Validator] Allow an empty path with a non empty fragment or a query (jakzal)
This PR was merged into the 2.3 branch.

Discussion
----------

[Validator] Allow an empty path with a non empty fragment or a query

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #16536
| License       | MIT
| Doc PR        | -

#16259 didn't fully fix the issue.

Commits
-------

2d0af8e [Validator] Allow an empty path with a non empty fragment or a query
2015-11-13 09:06:49 +01:00
Jakub Zalas 2d0af8e719 [Validator] Allow an empty path with a non empty fragment or a query 2015-11-13 07:29:58 +00:00
Fabien Potencier ec39f9da5d bug #16528 [Translation] Add support for Armenian pluralization. (marcosdsanchez)
This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes #16528).

Discussion
----------

[Translation] Add support for Armenian pluralization.

According to http://www.unicode.org/cldr/charts/27/supplemental/language_plural_rules.html#hy
Armenian has 2 forms of pluralization for cardinal numbers.

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | N/A
| License       | MIT
| Doc PR        | N/A

Commits
-------

5f1980b The following change adds support for Armenian pluralization.
2015-11-12 10:09:49 +01:00
Marcos Sánchez 5f1980ba5c The following change adds support for Armenian pluralization.
According to http://www.unicode.org/cldr/charts/27/supplemental/language_plural_rules.html#hy
Armenian has 2 forms of pluralization.
2015-11-12 10:09:48 +01:00
Nicolas Grekas ab3c8f891a bug #16510 [2.3][Process] fix Proccess run with pts enabled (ewgRa)
This PR was squashed before being merged into the 2.3 branch (closes #16510).

Discussion
----------

[2.3][Process] fix Proccess run with pts enabled

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #12643
| License       | MIT
| Doc PR        |

Commits
-------

9cf90fb [2.3][Process] fix Proccess run with pts enabled
2015-11-10 11:50:50 +01:00
Evgeniy Sokolov 9cf90fbcbf [2.3][Process] fix Proccess run with pts enabled 2015-11-10 11:49:25 +01:00
Nicolas Grekas f107a0a98e minor #16507 [ci] Tmp force phpunit/phpunit-mock-objects <= 3.0.0 (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[ci] Tmp force phpunit/phpunit-mock-objects <= 3.0.0

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

To make tests green again until https://github.com/sebastianbergmann/phpunit-mock-objects/pull/272 or https://github.com/sebastianbergmann/phpunit-mock-objects/pull/268 is merged+tagged.

Commits
-------

1b428df [ci] Tmp force phpunit/phpunit-mock-objects <= 3.0.0
2015-11-09 17:22:04 +01:00
Nicolas Grekas 1b428df90f [ci] Tmp force phpunit/phpunit-mock-objects <= 3.0.0 2015-11-09 17:10:51 +01:00
Nicolas Grekas 3d41d9368a minor #16503 [ci] Add version tag in phpunit wrapper to trigger cache-reset on demand (nicolas-grekas, emil-nasso)
This PR was merged into the 2.3 branch.

Discussion
----------

[ci] Add version tag in phpunit wrapper to trigger cache-reset on demand

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #16488, #16501
| License       | MIT
| Doc PR        | -

Commits
-------

f93e0c2 [ci] Phpunit tests wont run if composer is installed in a wrapper
481bf66 [ci] Add version tag in phpunit wrapper to trigger cache-reset on demand
2015-11-09 13:32:25 +01:00
Emil Andersson f93e0c23d1 [ci] Phpunit tests wont run if composer is installed in a wrapper 2015-11-09 13:13:34 +01:00
Nicolas Grekas 481bf6603d [ci] Add version tag in phpunit wrapper to trigger cache-reset on demand 2015-11-09 13:13:33 +01:00
Fabien Potencier 6d46a186a6 bug #16292 fix race condition at mkdir (#16258) (ewgRa)
This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes #16292).

Discussion
----------

fix race condition at mkdir (#16258)

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #16258
| License       | MIT
| Doc PR        |

Commits
-------

2c2836c fix race condition at mkdir (#16258)
2015-11-07 09:38:45 +01:00
Evgeniy Sokolov 2c2836c599 fix race condition at mkdir (#16258) 2015-11-07 09:38:45 +01:00
Fabien Potencier 4f7fd74257 bug #16462 [PropertyAccess] Fix dynamic property accessing. (dunglas)
This PR was merged into the 2.3 branch.

Discussion
----------

[PropertyAccess] Fix dynamic property accessing.

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Fix a bug regarding dynamic properties access introduced by #16294.

Commits
-------

916f9e0 [PropertyAccess] Test access to dynamic properties
352dfb9 [PropertyAccess] Fix dynamic property accessing.
2015-11-05 14:31:32 +01:00
Kévin Dunglas 916f9e0671 [PropertyAccess] Test access to dynamic properties 2015-11-04 20:02:36 +01:00
Nicolas Grekas 218200d8f3 minor #16468 [DI] Clean a phpdoc (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[DI] Clean a phpdoc

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Be carefull when merging into 2.7: the ContainerAwareTrait also needs the same fix

Commits
-------

2030f62 [DI] Clean a phpdoc
2015-11-04 19:47:31 +01:00
Nicolas Grekas 2030f62bb5 [DI] Clean a phpdoc 2015-11-04 19:12:53 +01:00
Kévin Dunglas 352dfb9890 [PropertyAccess] Fix dynamic property accessing. 2015-11-04 16:07:49 +01:00
Nicolas Grekas 5298940707 minor #16456 [HttpKernel] Clean clock-mock injection, replaced by #16455 (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[HttpKernel] Clean clock-mock injection, replaced by #16455

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

I really hope this PR is the last one on the clock-mocking topic!

Commits
-------

388534e [HttpKernel] Clean clock-mock injection, replaced by #16455
2015-11-04 10:23:27 +01:00
Nicolas Grekas 388534ecbf [HttpKernel] Clean clock-mock injection, replaced by #16455 2015-11-04 10:02:52 +01:00
Fabien Potencier 38a92c825f minor #16443 [travis] session.gc_probability=0 to fix transient tests on hhvm (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[travis] session.gc_probability=0 to fix transient tests on hhvm

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #15617
| License       | MIT
| Doc PR        | -

Should fix tests failing with:
`ps_files_cleanup_dir: opendir(/var/lib/hhvm/sessions) failed: Permission denied (13)`

Commits
-------

b4dd254 [travis] session.gc_probability=0 to fix transient tests on hhvm
2015-11-04 01:15:33 +01:00
Nicolas Grekas b4dd254774 [travis] session.gc_probability=0 to fix transient tests on hhvm 2015-11-03 16:54:52 +01:00
Nicolas Grekas 27f7be6322 minor #16439 [HttpKernel] Fix time-sensitive test case (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[HttpKernel] Fix time-sensitive test case

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Fixes these kind of failures:
```
1) Symfony\Component\HttpKernel\Tests\Fragment\FragmentHandlerTest::testRender
Expectation failed for method name is equal to <string:render> when invoked zero or more times

Parameter 1 for invocation Symfony\Component\HttpKernel\Fragment\FragmentRendererInterface::render('/', Symfony\Component\HttpFoundation\Request Object (...), Array (...)) does not match expected value.

Failed asserting that two objects are equal.
--- Expected
+++ Actual
@@ @@
             'SERVER_PROTOCOL' => 'HTTP/1.1'
-            'REQUEST_TIME' => 1446551470
+            'REQUEST_TIME' => 1446551469
             'PATH_INFO' => ''
             'REQUEST_METHOD' => 'GET'
```

Commits
-------

c188b35 [HttpKernel] Fix time-sensitive test case
2015-11-03 15:23:57 +01:00
Nicolas Grekas c188b35b18 [HttpKernel] Fix time-sensitive test case 2015-11-03 14:01:13 +01:00
Nicolas Grekas c4a31787a8 minor #16341 [travis] Fail early when an invalid composer.json is found (nicolas-grekas)
This PR was merged into the 2.3 branch.

Discussion
----------

[travis] Fail early when an invalid composer.json is found

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

It happens :)

Commits
-------

437e268 [travis] Fail early when an invalid composer.json is found
2015-11-03 09:49:28 +01:00