Commit Graph

3088 Commits

Author SHA1 Message Date
Nicolas Grekas
dd68ae3962 Merge branch '3.4' into 4.2
* 3.4:
  fix accessing session bags
2019-06-26 11:24:49 +02:00
Christian Flothmann
7a4570dcac fix accessing session bags 2019-06-22 22:10:25 +02:00
Christian Flothmann
6821850183 Merge branch '3.4' into 4.2
* 3.4:
  fix translation domain
  tag the FileType service as a form type
  [Validator] Fix GroupSequenceProvider annotation
  Update ajax security cheat sheet link
  Fix AuthenticationException::getToken typehint
2019-06-21 11:59:02 +02:00
Fabien Potencier
df210194e0 minor #32100 Update ajax security cheat sheet link (steef)
This PR was merged into the 3.4 branch.

Discussion
----------

Update ajax security cheat sheet link

| Q             | A
| ------------- | ---
| Branch?       | 3.4 <!-- see below -->
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

# Description
After looking in the `JsonResponse` class I found an old OWASP [link](https://www.owasp.org/index.php/AJAX_Security_Cheat_Sheet#Always_return_JSON_with_an_Object_on_the_outside). As the cheat sheet series project is moved to GitHub the link can be updated to the [following](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/AJAX_Security_Cheat_Sheet.md).

## Screenshot
<img width="552" alt="Screenshot 2019-06-19 at 16 52 19" src="https://user-images.githubusercontent.com/34915382/59776184-a7e2bf80-92b2-11e9-8d23-802acfddfb1d.png">

Commits
-------

32d02d6141 Update ajax security cheat sheet link
2019-06-19 17:25:42 +02:00
Stefano Degenkamp
32d02d6141
Update ajax security cheat sheet link
As the cheat sheet series project has been moved to github.
2019-06-19 17:21:12 +02:00
Nicolas Grekas
06c17cdaa9 Merge branch '3.4' into 4.2
* 3.4:
  Fix expired lock not cleaned
  [HttpFoundation] Fix SA/phpdoc JsonResponse
  SimpleCacheAdapter fails to cache any item if a namespace is used
  validate composite constraints in all groups
  [Serializer] Handle true and false appropriately in CSV encoder
  Fix binary operation `+`, `-` or `*` on string
  [VarDumper] fix dumping objects that implement __debugInfo()
  [Routing] fix absolute url generation when scheme is not known
2019-06-17 19:15:38 +02:00
Roland Franssen
270f10cc81 [HttpFoundation] Fix SA/phpdoc JsonResponse 2019-06-16 13:18:06 +02:00
Stefano Degenkamp
d445465ef4 Fix binary operation +, - or * on string
By type casting to integer.
2019-06-13 17:39:17 +02:00
Fabien Potencier
0f958aabfa Merge branch '3.4' into 4.2
* 3.4:
  fixed CS
  [HttpKernel] Remove TestEventDispatcher.
2019-06-13 12:50:42 +02:00
Fabien Potencier
106b348d3d fixed CS 2019-06-13 12:34:15 +02:00
Nicolas Grekas
05eb388c26 Merge branch '3.4' into 4.2
* 3.4:
  Add a missing quote in getValue() DocBlock
  [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor.
  minor: ChoiceType callable deprecation after/before seems wrong
2019-06-06 12:03:46 +02:00
Fabien Potencier
11f04abcd4 bug #31863 [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor (Ivo)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor

…r in RedirectResponse constructor.

| Q             | A
| ------------- | ---
| Branch?       |  3.4
| Bug fix?      | yes
| New feature?  |no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #31862  <!-- #-prefixed issue number(s), if any -->
| License       | MIT

Perform a case-insensitive check on `$headers` in \Symfony\Component\HttpFoundation\RedirectResponse::__construct()

Commits
-------

b5e6c99a3b [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor.
2019-06-05 15:24:38 +02:00
Nicolas Grekas
eb41911d88 Merge branch '3.4' into 4.2
* 3.4:
  Fix json-encoding when JSON_THROW_ON_ERROR is used
  [HttpFoundation] work around PHP 7.3 bug related to json_encode()
  [Security] added support for updated \"distinguished name\" format in x509 authentication
2019-06-05 15:22:46 +02:00
Nicolas Grekas
d18f42c409 Fix json-encoding when JSON_THROW_ON_ERROR is used 2019-06-05 13:33:52 +02:00
Ivo
b5e6c99a3b [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor. 2019-06-05 10:24:41 +02:00
Nicolas Grekas
e6e63017f0 [HttpFoundation] work around PHP 7.3 bug related to json_encode() 2019-06-04 20:52:06 +02:00
Nicolas Grekas
06c655251c Merge branch '3.4' into 4.2
* 3.4:
  Use willReturn() instead of will(returnValue()).
2019-05-30 18:06:08 +02:00
Alexander M. Turek
4fb67df612 Use willReturn() instead of will(returnValue()). 2019-05-30 17:47:52 +02:00
Nicolas Grekas
31f51ca9a5 Merge branch '3.4' into 4.2
* 3.4:
  [HttpFoundation] Do not set X-Accel-Redirect for paths outside of X-Accel-Mapping
  Use AsserEquals for floating-point values
2019-05-29 20:10:06 +02:00
Vilius Grigaliūnas
a662f61e08 [HttpFoundation] Do not set X-Accel-Redirect for paths outside of X-Accel-Mapping
Currently BinaryFileResponse, when configured with X-Accel-Redirect sendfile type,
will only substitute file paths specified in X-Accel-Mapping. But if the provided
file path does not have a defined prefix, then the resulting header will include
the absolute path. Nginx expects a valid URI, therefore this will result in an
issue that is very hard to detect and debug as it will not show up in error logs
and instead the request would just hang for some time and then be re-served
without query parameters(?).
2019-05-28 15:48:21 +03:00
mmokhi
0cef5f3ec9 Use AsserEquals for floating-point values
Use AssertEquals for these two specific case will do a better job,
since it'll convert both '0.1' and result of `getContent()` into PHP's
internal representation of floating-point and compares them and it should be fine.
Using `AssertSame` for this tests brings floating-point serialization
into consideration which of course will be php.ini specific.

In order not missing the type assertion point that `AssertSame` does,
we also perform `assertInternalType('string'...`

Sponsored-by: Platform.sh
2019-05-28 12:41:01 +02:00
Fabien Potencier
2314f81891 Merge branch '3.4' into 4.2
* 3.4:
  Fixes a small doc blocks syntax error
  Small grammar mistake in documentation
  [Workflow] Do not trigger extra guard
2019-05-27 07:57:45 +02:00
Michael Käfer
34d4fa66e7 Fixes a small doc blocks syntax error 2019-05-27 07:50:24 +02:00
Nicolas Grekas
48258fc12e Merge branch '3.4' into 4.2
* 3.4:
  minor: add some test in the ldap component
  [Bridge\ProxyManager] isProxyCandidate() does not take into account interfaces
  [Routing][AnnotationClassLoader] fix utf-8 encoding in default route name
  fixed a phpdoc
  [Debug] Wrap call to require_once in a try/catch
  [PropertyInfo] Add missing documentation link in Readme
  Use the current working dir as default first arg in 'link' binary
  Respect parent class contract in ContainerAwareDoctrineEventManager
  [Validator] Add the missing translations for the Danish ("da") locale
  [Serializer] Fix denormalization of object with variadic constructor typed argument
  Allow set 'None' on samesite cookie flag
2019-05-20 18:15:26 +02:00
Fabien Potencier
c866efa615 fixed a phpdoc 2019-05-18 18:33:51 +02:00
Christian Flothmann
d836c63b91 prevent deprecation when filesize matches error code 2019-05-17 13:55:16 +02:00
Marcos Gómez Vilches
8bac3d6fa3
Allow set 'None' on samesite cookie flag
Allow set samesite cookie flag to 'None' value
2019-05-10 21:58:31 +02:00
Fabien Potencier
ecdfa80bf4 Merge branch '3.4' into 4.2
* 3.4:
  Revert "bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)"
  [Workflow] Fixed dumping when many transition with same name exist
  fix ConsoleFormatter - call to a member function format() on string
2019-05-01 10:36:31 +02:00
Nicolas Grekas
4177331915 Revert "bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)"
This reverts commit 029fb2e7e3, reversing
changes made to 9dad29d61c.
2019-05-01 10:04:33 +02:00
Nicolas Grekas
3b05c07029 Merge branch '3.4' into 4.2
* 3.4:
  [HttpFoundation] fix tests
  bumped Symfony version to 3.4.27
  updated VERSION for 3.4.26
  updated CHANGELOG for 3.4.26
2019-04-19 16:26:30 +02:00
Nicolas Grekas
8e93ef3d01 [HttpFoundation] fix tests 2019-04-19 15:43:39 +02:00
Nicolas Grekas
6aec217e2b Merge branch '3.4' into 4.2
* 3.4:
  Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
  [FrameworkBundle] minor: remove a typo from changelog
  [VarDumper][Ldap] relax some locally failing tests
  [Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
  Make MimeTypeExtensionGuesser case insensitive
2019-04-17 16:56:00 +02:00
Nicolas Grekas
13113245bf bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Make MimeTypeExtensionGuesser case insensitive

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #...   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

Some mime types have a camelCase word in them.
The Apache HTTPD project list items are all lower case.
So I suggest making the $mimeType string lowercase while checking the array key.
That way, we can keep the list in sync.

Example: xlsm file mime type is `application/vnd.ms-excel.sheet.macroEnabled.12`
The key that matches the xlsm extension in the `$defaultExtensions` array is `application/vnd.ms-excel.sheet.macroenabled.12`

Example xlsm file:
https://github.com/vermeirentony/xlsm-example

Commits
-------

e294ee6b9a Make MimeTypeExtensionGuesser case insensitive
2019-04-17 16:51:18 +02:00
Nicolas Grekas
a5039c81c9 Merge branch '3.4' into 4.2
* 3.4:
  [HttpFoundation] reject invalid method override
2019-04-16 10:49:01 +02:00
Nicolas Grekas
944e60f083 [HttpFoundation] reject invalid method override 2019-04-16 07:40:48 +01:00
Tony Vermeiren
e294ee6b9a Make MimeTypeExtensionGuesser case insensitive 2019-04-16 08:01:19 +02:00
Fabien Potencier
2fb2508cee Merge branch '3.4' into 4.2
* 3.4:
  [Serializer] Added check of constuctor modifiers to AbstractNormalizer
  [Intl] Simplify the compile binary
  [Routing] Fix routes annotation loading with glob pattern
  Fix hardcoded hotPathTagName
  [Validator] Improve constraint default option check
  [Validator] Fix annotation default for @Count and @Length
  Update composer.json
  Fix getSetMethodNormalizer to correctly ignore the attributes specified in "ignored_attributes"
  Add missing "vi" translations
  add missing German translations
  [Intl] Fix test
  added missing translation
  use behavior instead of behaviour
  [Validator] Translate JSON message to Hungarian
  [Validator] fix sr_Latn translations
  [FrameworkBundle][HttpFoundation] make session service resettable
2019-03-30 16:58:42 +01:00
Oskar Stark
8b5c5ed587 use behavior instead of behaviour 2019-03-25 08:48:46 +01:00
David Maicher
e46ef76cb9 [FrameworkBundle][HttpFoundation] make session service resettable 2019-03-22 16:39:02 +01:00
Fabien Potencier
7e5dfcff7b Merge branch '3.4' into 4.2
* 3.4:
  [Phpunit] fixed support for PHP 5.3
  Response prepare method update
  [Workflow] Added missing license header
  Check if Client exists when test.client does not exist, to provide clearer exception message
  [Form] Preventing validation of children if parent with Valid constraint has no validation groups
  [Tests] fixed compatbility of assertEquals(): void
  [Intl] Fix test
  [Validator] Add the missing translations for the Arabic (ar) locale
  [Intl] Add compile binary
  [Form] Fixed some phpdocs
2019-03-22 09:16:34 +01:00
ScoobyDam
e89c9213e2
Response prepare method update
Response prepare updated for more coherence.
2019-03-21 19:51:37 +01:00
Nicolas Grekas
8907650424 Merge branch '3.4' into 4.2
* 3.4:
  Make translations consistent with other translations.
  Correct language code for ukrainian language in security translations.
  Fix return type of Request::getRequestFormat
  [Cache] Fix perf when using RedisCluster by reducing roundtrips to the servers
2019-03-13 17:19:01 +01:00
Teoh Han Hui
bd92349a3e
Fix return type of Request::getRequestFormat 2019-03-12 15:29:13 +01:00
Soner Sayakci
d631bd96ac
Fix git diff marker 2019-02-26 09:03:39 +01:00
Nicolas Grekas
87f3c36d60 Merge branch '3.4' into 4.2
* 3.4: (24 commits)
  Apply php-cs-fixer rule for array_key_exists()
  [Security] Change FormAuthenticator if condition
  handles multi-byte characters in autocomplete
  speed up tests running them without debug flag
  [Translations] added missing Croatian validators
  Fix getItems() performance issue with RedisCluster (php-redis)
  [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning
  IntegerType: reject submitted non-integer numbers
  be keen to newcomers
  [HttpKernel] Fix possible infinite loop of exceptions
  fixed CS
  [Validator] Added missing translations for Afrikaans
  do not validate non-submitted form fields in PATCH requests
  Update usage example in ArrayInput doc block.
  [Console] Prevent ArgvInput::getFirstArgument() from returning an option value
  [Validator] Fixed duplicate UUID
  fixed CS
  [EventDispatcher] Fix unknown priority
  Avoid mutating the Finder when building the iterator
  [Validator] Add the missing translations for the Greek (el) locale
  ...
2019-02-23 16:17:42 +01:00
Nicolas Grekas
b0a3208588 Apply php-cs-fixer rule for array_key_exists() 2019-02-23 16:06:07 +01:00
Nicolas Grekas
adbdec838a Merge branch '4.1' into 4.2
* 4.1:
  [Routing] dont redirect routes with greedy trailing vars with no explicit slash
  skip native serialize among child and parent serializable objects
  [Routing] backport tests from 4.1
  [MonologBridge] Remove unused local variable
  Remove unreachable code
  Add PackageNameTest to ConfigurationTest also add in the changelog the corresponding entry to this PR
  Support use of hyphen in asset package name
  Remove gendered pronouns
  Replace gender by eye color in tests
  [Security] dont do nested calls to serialize()
2019-01-29 10:49:29 +01:00
Nicolas Grekas
78c23c7838 Merge branch '3.4' into 4.1
* 3.4:
  skip native serialize among child and parent serializable objects
  [Routing] backport tests from 4.1
  Add PackageNameTest to ConfigurationTest also add in the changelog the corresponding entry to this PR
  Support use of hyphen in asset package name
  Remove gendered pronouns
  Replace gender by eye color in tests
  [Security] dont do nested calls to serialize()
2019-01-29 10:21:38 +01:00
Raphaëll Roussel
bc6e0f80ff Remove gendered pronouns 2019-01-27 10:04:14 +01:00
Nicolas Grekas
62c595a649 Merge branch '4.1' into 4.2
* 4.1:
  [HttpFoundation] Check file exists before unlink
  [Console] Fixed #29835: ConfirmationQuestion with default true for answer '0'
  [Translation] Concatenated translation messages
  [Form] ensure compatibility with older PHPUnit mocks
  [Serializer] Docblock about throwing exceptions on serializer
  [Debug][ErrorHandler] Preserve our error handler when a logger set another one
  [Form] Changed UrlType input type to text when default_protocol is not null
  [Bugfix] MemcachedSessionHandler::close() must close connection
2019-01-25 15:35:16 +01:00