This PR was squashed before being merged into the 2.8 branch (closes#23826).
Discussion
----------
[2.8] Modify 2.8 upgrade doc - key option is deprecated.
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | no, but this is only a documentation change - I don't think it's my change that has broken them.
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
The 2.8.0 section of the [CHANGELOG for the Security bundle](https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/SecurityBundle/CHANGELOG.md#280) has two items in it
> * deprecated the `key` setting of `anonymous`, `remember_me` and `http_digest` in favor of the `secret` setting.
> * deprecated the `intention` firewall listener setting in favor of the `csrf_token_id`.
The first of these isn't also in the Symfony upgrade guide, but the second is.
This PR adds the missing item (deprecated `key` setting) into the Symfony upgrade guide.
Commits
-------
2309fd91d8 [2.8] Modify 2.8 upgrade doc - key option is deprecated.
This PR was merged into the 2.7 branch.
Discussion
----------
[DebugBundle] Reword an outdated comment about var dumper wiring
| Q | A
| ------------- | ---
| Branch? | 2.7 <!-- see comment below -->
| Bug fix? | no
| New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | no
| Fixed tickets | N/A <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | N/A
This comment is outdated since #19647, as the default config is now the one used all the way through in HTTP mode, while it's overridden in CLI mode by the `DumpListener` on `console.command` event.
Commits
-------
f876fd9 [DebugBundle] Reword an outdated comment about var dumper wiring
This PR was merged into the 2.7 branch.
Discussion
----------
Ignore memcached missing key error on session destroy
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #18574
| License | MIT
| Doc PR | NA
Since PHP 7 session_regenerate_id triggers a warning when the session is not started.
This PR, changes the behaviours of session_destroy in the `MemcachedSessionHandler` by returning true when the user try to delete a non-existing session.
Other handler:
- LegacyPdoSessionHandler => don't check if key exists
- MongoDbSessionHandler => don't check if key exists
- NullSessionHandler => always true
- PdoSessionHandler => don't check if key exists
Commits
-------
29538b621c Ignore memcached missing key error on dession destroy
This PR was merged into the 2.7 branch.
Discussion
----------
Github template: Remove EOM 3.2 from branch suggestion
| Q | A
| ------------- | ---
| Branch? | 2.7 <!-- see comment below -->
| Bug fix? | no
| New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | yes
| Fixed tickets | N/A <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | N/A
As 3.2 is EOM since the 31 July (appart for security fixes of course)
Commits
-------
30eed99 Github template: Remove EOM 3.2 from branch suggestion
This PR was merged into the 2.7 branch.
Discussion
----------
[Security] Fix security.interactive_login event const doc block
| Q | A
| ------------- | ---
| Branch? | 2.7 <!-- see comment below -->
| Bug fix? | no
| New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | yes
| Fixed tickets | N/A <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | N/A
I'd suggest to reuse the explanation we give about this event [on the docs](http://symfony.com/doc/2.7/components/security/authentication.html#security-events) because the current one in the code is misleading: this event is not triggered for http basic/digest authentication for instance.
Commits
-------
f6c83cf [Security] Fix security.interactive_login event const doc block
This PR was merged into the 2.7 branch.
Discussion
----------
[HttpFoundation] Generate safe fallback filename for wrongly encoded filename
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
This handles the case where the encoding of a random string cannot be detected. Until now this causes a PHP Warning `mb_strlen(): Unknown encoding ""`.
Commits
-------
8fd5569 [HttpFoundation] Generate safe fallback filename for wrongly encoded filename
This PR was merged into the 2.7 branch.
Discussion
----------
Avoid infinite loops when profiler data is malformed
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #22963
| License | MIT
| Doc PR | -
Thanks to the bug reproducer provided by @Kyoushu, I could reproduce this error:
```
PHP 7.1.4 Development Server started at Thu Aug 3 22:13:26 2017
Listening on http://127.0.0.1:8000
Document root is projects/symfony-fileprofilerstorage-bug/web
Press Ctrl-C to quit.
[Thu Aug 3 22:13:26 2017] PHP Fatal error:
Allowed memory size of 2147483648 bytes exhausted (tried to allocate 282624 bytes) in
projects/symfony-fileprofilerstorage-bug/vendor/symfony/symfony/src/Symfony/Component/
HttpKernel/Profiler/FileProfilerStorage.php on line 124
```
After the changes proposed in this PR, the browser no longer exhausts the memory and you can see the exception page explaining the error. The web debug toolbar doesn't load, but it doesn't crash anything:
![error-profiler](https://user-images.githubusercontent.com/73419/28941732-3c7eb29c-7899-11e7-88e8-a16517d5bcf7.png)
Commits
-------
e5ef9fb Avoid infinite loops when profiler data is malformed
* 2.7:
[Bridge\ProxyManager] Dont call __destruct() on non-instantiated services
bumped Symfony version to 2.7.34
updated VERSION for 2.7.33
update CONTRIBUTORS for 2.7.33
updated CHANGELOG for 2.7.33
This PR was merged into the 2.7 branch.
Discussion
----------
[Bridge\ProxyManager] Dont call __destruct() on non-instantiated services
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
While working on making #23678 green, I discovered that if a lazy service implements `__destruct`, then that service is not lazy anymore: it is created at destruct time.
That behavior is documented at https://github.com/Ocramius/ProxyManager/issues/258 (+related issues).
While I may understand why this behavior is the default for ProxyManager, it does not fit our "lazy-services" use case to me. Typically, nobody wants a database connection to be created to destruct the uninitialized lazy-proxy.
Blocks #23678
Commits
-------
2d79ffa0ca [Bridge\ProxyManager] Dont call __destruct() on non-instantiated services
This PR was merged into the 2.8 branch.
Discussion
----------
[2.8][Security][Guard] Docblock improvement
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Added this small detail which might prevent [exception](https://github.com/symfony/symfony/blob/2.8/src/Symfony/Component/Security/Guard/Firewall/GuardAuthenticationListener.php#L193) when developing
Commits
-------
ce86449 Docblock improvement
This PR was merged into the 2.7 branch.
Discussion
----------
[Console] Fix passing options with defaultCommand
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Seems like overwriting input for the default command is not needed (anymore?). I don't know where the removed comment comes from originally.
Use case: i want to call default command and use options at the same time:
app/console --abc=true
Commits
-------
761de99552 Fix passing options with defaultCommand
This PR was merged into the 2.7 branch.
Discussion
----------
Remove unused constant
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | N/A
| License | MIT
| Doc PR | N/A
Just a micro clean-up PR, to assimilate the Symfony PR process.
Hope the next one will be more useful 🤔
Commits
-------
7168d89 Remove unused constant
* 2.7:
[DI] Remove unused props from the PhpDumper
[ProxyManager] Cleanup fixtures
[Debug] HTML-escape array key
Add some phpdocs for IDE autocompletion and better SCA
This PR was merged into the 2.8 branch.
Discussion
----------
Fixed typo in docblock in AuthenticationExpiredException
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | ~
| License | MIT
| Doc PR | ~
Found a small typo, applied it in the lowest branch possible.
Commits
-------
432d2de Fixed typo in docblock
This PR was submitted for the 2.8 branch but it was merged into the 2.7 branch instead (closes#23613).
Discussion
----------
[DI] Remove unused props from the PhpDumper
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | no
| New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks? | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Commits
-------
f1aa45c [DI] Remove unused props from the PhpDumper
This PR was merged into the 2.7 branch.
Discussion
----------
[ProxyManager] Cleanup fixtures
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Just noticed that these fixture files are not maintainable. And we don't need them at all in fact, let's drop them.
Commits
-------
31843d6f98 [ProxyManager] Cleanup fixtures
This PR was merged into the 2.7 branch.
Discussion
----------
[Form] Add some phpdocs for IDE autocompletion and better SCA
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
@ogizanagi I've tryed add single phpdoc `@method FormInterface[] getIterator()` to `FormInterface` but it not works correctly in PHPStorm. Have you any ideas?
<!--
- Bug fixes must be submitted against the lowest branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too).
- Features and deprecations must be submitted against the 3.4,
legacy code removals go to the master branch.
- Please fill in this template according to the PR you're about to submit.
- Replace this comment by a description of what your PR is solving.
-->
Commits
-------
d30c751781 Add some phpdocs for IDE autocompletion and better SCA
This PR was merged into the 2.7 branch.
Discussion
----------
[Debug] Missing escape in debug output
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
When pretty-printing an exception, the debug handler does not properly escape array keys.
The problem only occurs when debug output is enabled, so this is not considered a [security issue](http://symfony.com/doc/current/contributing/code/security.html) (according to @fabpot), because the debug tools [should not be used in production](https://symfony.com/doc/current/components/debug.html#usage).
A test for this is included in my patch for #18722.
Commits
-------
636777d [Debug] HTML-escape array key
This PR was merged into the 2.7 branch.
Discussion
----------
[DI] Make dumped docblocks less verbose
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
When I open a dumped container, I always find there are too much noise in docblocs.
As a bonus side effect, this will reduce the memory requirement in dev :)
Commits
-------
1ade5d8658 [DI] Make dumped docblocks less verbose
* 2.7:
[DI] use assertStringEqualsFile when possible
[VarDumper] Adapt to php 7.2 changes
[Form][TwigBridge] Don't render _method in form_rest() for a child form
[Validator] Fix IbanValidator for ukrainian IBANs