This PR was squashed before being merged into the 4.4 branch (closes#33584).
Discussion
----------
[Security] Deprecate isGranted()/decide() on more than one attribute
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no
| Deprecations? | yes
| Tickets | -
| License | MIT
| Doc PR | tbd
While I expect it not be used much, it is currently possible to call `isGranted()` on more than one attribute:
```php
if ($this->authorizationChecker->isGranted(['ROLE_USER', 'ROLE_ADMIN'])) {
// ...
}
```
Supporting this includes a couple of problems/questions:
- It is not clear whether this is `OR` or `AND`;
- In fact, this is left over to the voter to decide upon. So it can vary for each voter and writers of new voters need to consider this (otherwise, you get issues like https://github.com/LeaseWeb/LswSecureControllerBundle/issues/4 );
- It promotes to vote over roles instead of actions.
I think we can do better. In the past, we've created all tooling for this to be self-explaining and easier:
```php
// ExpressionLanguage component (also includes other functions, like `is_granted('EDIT')`)
if ($this->authorizationChecker->isGranted("has_role('ROLE_USER') or has_role('ROLE_ADMIN')")) {
// ...
}
// calling it multiple times in PHP (may reduce performance)
if ($this->authorizationChecker->isGranted('ROLE_USER')
|| $this->authorizationChecker->isGranted('ROLE_ADMIN')
) {
// ...
}
// or by using Role Hierarchy, if a user really wants to vote on roles
```
This PR deprecates passing more than one attribute to `isGranted()` and `decide()` to remove this confusing bit in Security usage.
Backwards compatiblity help
---
I need some help in how to approach changing the `VoterInterface::vote(TokenInterface $token, $subject, array $attributes)` method in a backwards compatible way. Removing `array` breaks all Voters, so does changing it to `string` and removed the parameter all together.
Commits
-------
c64b0beffb [Security] Deprecate isGranted()/decide() on more than one attribute
* 4.3:
[Twig] Remove dead code
Add gitignore file for Symfony 4.3
Add gitignore file for Symfony 3.4
[Inflector] Add .gitignore file
[Messenger] Fix exception message of failed message is dropped on retry
Add default value for Accept header
[HttpClient] Add .gitignore file
[Finder] Adjust regex to correctly match comments in gitignore contents
[Security] Removed unused argument in Test
[Console] Get dimensions from stty on windows if possible
[Inflector] add support 'see' to 'ee' for singularize 'fees' to 'fee'
* 3.4:
[Twig] Remove dead code
Add gitignore file for Symfony 3.4
[Inflector] Add .gitignore file
[Security] Removed unused argument in Test
[Console] Get dimensions from stty on windows if possible
[Inflector] add support 'see' to 'ee' for singularize 'fees' to 'fee'
After #32998 there was a minor left over, the `testHandleAuthenticationClearsToken`
`$tokenClass` argument is no longer used and can be safely removed.
This PR was merged into the 4.4 branch.
Discussion
----------
fix tests mocking final events
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR |
Fix tests in 4.4 extracted from #33297
Commits
-------
637461fd51 fix tests mocking final events
* 4.3:
Fix more bad tests
Fix test fixtures with deprecated method signatures.
Fix 4.3 tests forward compat
[Messenger] fix empty amqp body returned as false
Fix routing cache broken when using generator_class
This PR was merged into the 4.4 branch.
Discussion
----------
Mark all dispatched event classes as final
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets |
| License | MIT
| Doc PR |
I think we should mark all our Event classes as final. There is no point in people extending them as the libraries that use the event, will only dispatch this event. So extending events in user-land achieves nothing as the subclasses won't be dispatched.
I'm not talking about the base events that are meant to be extended like KernelEvent, but the leaf events like ExceptionEvent, ResponseEvent etc.
Then we can also make them real final in 5.0 as the events are value objects that should not be mocked.
Commits
-------
4bb38eec89 Mark all dispatched event classes as final
* 4.3:
Do not extend the new SF 4.3 ControllerEvent so we can make it final
Backported return type violation bugfixes.
[FrameworkBundle] Fix BrowserKit assertions to make them compatible with Panther
This PR was merged into the 3.4 branch.
Discussion
----------
[Security/Core] UserInterface::getPassword() can return null
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Our very own `User` class can return null already.
Commits
-------
00d7f8cde7 [Security/Core] UserInterface::getPassword() can return null
* 4.3:
[Routing] Add a param annotation for $annot.
[DI] fix docblock
[Console] fix docblock
Add missing translations for Armenian locale
[Process] Added missing return type.
[Process] Doc block backport.
Added doc block for Registry::supports().
[Cache] Fix predis test
Don't duplicate addresses in Sendgrid Transport
Remove unnecessary statement
Fix some docblocks.
[Messenger] make delay exchange and queues durable like the normal ones by default
Cancel delayed message if handler fails
Added tests for #32370
* 3.4:
[Routing] Add a param annotation for $annot.
[DI] fix docblock
Add missing translations for Armenian locale
[Process] Doc block backport.
Fix some docblocks.
* 4.3:
cs fix
Fix return statements
[TwigBridge] add missing dep
Add false type to ChoiceListFactoryInterface::createView $label argument
Update UPGRADE guide of 4.3 for EventDispatcher
[SecurityBundle] display the correct class name on the deprecated notice
* 4.3:
cleanups
Disable PHPUnit result cache on the CI
[Security] Cleanup "Digest nonce has expired." translation
[Translation] Highlight invalid translation status
Added translations in validator for Serbian Cyrillic
Added translations in validator for Serbian Latin
[EventDispatcher] wrong Request class
[DependencyInjection] improved exception message
This PR was merged into the 4.4 branch.
Discussion
----------
remove some more useless phpdocs
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
Fix some leftovers from #32974 and #32786
Commits
-------
9be4d171e0 remove some more useless phpdocs
* 4.3:
Fix inconsistent return points.
pass translation parameters to the trans filter
[Mime] fixed wrong mimetype
[ProxyManagerBridge] Polyfill for unmaintained version
[HttpClient] Declare `$active` first to prevent weird issue
Remove deprecated assertContains
[HttpClient] fix tests
SCA: dropped unused mocks, duplicate import and a function alias usage
Added correct plural for box -> boxes
[Config] fix test
Fix remaining tests
Improve fa (persian) translation
* 3.4:
[ProxyManagerBridge] Polyfill for unmaintained version
SCA: dropped unused mocks, duplicate import and a function alias usage
[Config] fix test
Improve fa (persian) translation
This PR was merged into the 3.4 branch.
Discussion
----------
[Security] Improve fa (persian) translation
| Q | A
| ------------- | ---
| Branch? | >= 3.4 <!-- see below -->
| Bug fix? | no
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | N/A <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | N/A <!-- required for new features -->
<!--
Replace this notice by a short README for your feature/bugfix. This will help people
understand your PR and can be used as a start for the documentation.
Additionally (see https://symfony.com/roadmap):
- Bug fixes must be submitted against the lowest maintained branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too).
- Features and deprecations must be submitted against branch 4.4.
- Legacy code removals go to the master branch.
-->
Commits
-------
4afdfd765d Improve fa (persian) translation
* 4.3:
bump phpunit-bridge cache-id
Use assertStringContainsString when needed
Use assert assertContainsEquals when needed
Use assertEqualsWithDelta when required
* 3.4:
bump phpunit-bridge cache-id
Use assertStringContainsString when needed
Use assert assertContainsEquals when needed
Use assertEqualsWithDelta when required
This PR was merged into the 4.4 branch.
Discussion
----------
[Ldap] Add security LdapUser and provider
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Moves `LdapUserProvider` from `Security\Core` to the Ldap component, the provider now deals with a new `LdapUser` aware of its ldap `Entry` (should help in #31843).
Commits
-------
6736cdfec3 [Ldap] Add security LdapUser and provider
This PR was merged into the 4.3 branch.
Discussion
----------
Sync "not implementing the method" deprecations messages
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Suggested in https://github.com/symfony/symfony/pull/32747#discussion_r309307289
Useful for consistency and for future reference for similar messages.
Commits
-------
f6fae1c361 Sync "not implementing the method" deprecations messages
* 4.3:
Fix assertInternalType deprecation in phpunit 9
Ensure signatures for setUp|tearDown|setUpAfterClass|tearDownAfterClass methods in tests are compatible with phpunit 8.2
This PR was merged into the 4.4 branch.
Discussion
----------
add parameter type declarations to private methods
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Commits
-------
1b2aaa4a06 add parameter type declarations to private methods
This PR was squashed before being merged into the 4.4 branch (closes#32831).
Discussion
----------
[Security] Revise UserPasswordEncoderInterface::needsRehash()
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
This reuses the encoded password from the user for the `UserPasswordEncoderInterface`, similar we dont pass the encoded string to `isPasswordValid()`.
This differs from the non-user aware `PasswordEncoderInterface`
cc @nicolas-grekas did i miss something?
Commits
-------
c5a283d417 [Security] Revise UserPasswordEncoderInterface::needsRehash()
* 4.3:
Fix travis script
minor fix for wrong case
[HttpFoundation] Fix `getMaxFilesize`
[Cache] fix warning on PHP 7.4
[Console] fix warning on PHP 7.4
Don't add value of (default/static) objects to the signature
fix(yml): fix comment in milti line value
Make sure trace_level is always defined
Fix bindings and tagged_locator
Recompile container when translations directory changes
* 3.4:
Fix travis script
minor fix for wrong case
[HttpFoundation] Fix `getMaxFilesize`
[Cache] fix warning on PHP 7.4
[Console] fix warning on PHP 7.4
Don't add value of (default/static) objects to the signature
fix(yml): fix comment in milti line value
* 4.3:
[Security/Core] align defaults for sodium with PHP 7.4
fix inline handling when dumping tagged values
[HttpClient] fix canceling responses in a streaming loop
[Messenger] Flatten collection of stamps collected by the traceable middleware
[PropertyAccess] Fix PropertyAccessorCollectionTest
[HttpClient] rewind stream when using Psr18Client
Typo in web profiler
[4.3] Remove dead test fixtures
[Routing] Fix CHANGELOG
relax some date parser patterns
Avoid getting right to left style
* 4.3:
[FrameworkBundle] [SecurityBundle] Rename internal WebTestCase to avoid confusion
ignore not existing translator service
[FrameworkBundle] [SecurityBundle] Rename internal WebTestCase to avoid confusion
revert private properties handling
[HttpFoundation] Fix URLs
[VarDumper] finish PHP 7.4 support and add tests
[VarDumper] Use \ReflectionReference for determining if a key is a reference (php >= 7.4)
Ignore missing translation dependency in FrameworkBundle
[Security/Http] Don't mark AbstractAuthenticationListener as internal
Remove dead tests fixtures
Remove more dead tests fixtures
[Mime] Add missing changelog entry for BC-break
[Messenger] fix transport_name option not passing validation
Remove dead tests fixtures
[Debug][ExceptionHandler] Add tests for custom handlers
* 4.2:
[FrameworkBundle] [SecurityBundle] Rename internal WebTestCase to avoid confusion
ignore not existing translator service
[FrameworkBundle] [SecurityBundle] Rename internal WebTestCase to avoid confusion
revert private properties handling
[HttpFoundation] Fix URLs
[VarDumper] finish PHP 7.4 support and add tests
[VarDumper] Use \ReflectionReference for determining if a key is a reference (php >= 7.4)
Ignore missing translation dependency in FrameworkBundle
Remove dead tests fixtures
Remove more dead tests fixtures
Remove dead tests fixtures
[Debug][ExceptionHandler] Add tests for custom handlers
* 4.3: (26 commits)
Fix Twig 1.x compatibility
[Translator] Improve farsi(persian) translations for Form
Improve fa translations
Spell "triggering" properly
Added tests to cover the possibility of having scalars as services.
fixed tests on old PHP versions
[FrameworkBundle] Inform the user when save_path will be ignored
fixed CS
[SecurityBundle] Fix profiler dump for non-invokable security listeners
fixed CS
[Messenger] Doctrine Transport: Support setting auto_setup from DSN
[Translator] Load plurals from po files properly
[Serializer]: AbstractObjectNormalizer ignores the property types of discriminated classes
[EventDispatcher] Add tag kernel.rest on 'debug.event_dispatcher' service
[Console] Update to inherit and add licence
Add missing test for workflow dump description
[Intl] Remove --dev from intl compile autoloader
[Messenger] fix publishing headers set on AmqpStamp
Remove call to deprecated method
[Intl] Init compile tmp volume
...
This PR was merged into the 4.4 branch.
Discussion
----------
[SECURITY] AbstractAuthenticationListener.php error instead info. Rebase of #28462
| Q | A
| ------------- | ---
| Branch? | 4.4
| -- | --
| Bug fix? | yes
| New feature? | no
| BC breaks? | no I think
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | ...
| License | MIT
Rebase of #28462. Origin description:
> ```
> [2018-09-13 20:43:38] security.INFO: Authentication request failed. {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\AuthenticationServiceException(code: 0): An exception occurred while executing
> ...
> Doctrine\\DBAL\\Driver\\PDOException(code: 42S22): SQLSTATE[42S22]: Column not found: 1054 Unknown column 't0.phone' in 'field list' at
> ```
>
> Definitely I think this is NOT info, but error.
> And since it's info, it's not logged in production because of `fingers_crossed` with `action_level: error` - so to actually see the real error behind `Authentication request could not be processed due to a system problem.` I had to debug on production. Very bad practice IMHO.
Commits
-------
867eb78cfe [SECURITY] AbstractAuthenticationListener.php error instead info. Rebase of #28462
* 4.3:
[Mailer] fixed tests on Windows
[PhpUnitBridge] fix tests
[Mailer] fixed error message when connecting to a stream raises an error before connect()
[Mailer] fixed timeout type hint
improve error messages in the event dispatcher
[Security/Core] work around sodium_compat issue
bumped Symfony version to 4.3.3
updated VERSION for 4.3.2
updated CHANGELOG for 4.3.2
bumped Symfony version to 4.2.11
updated VERSION for 4.2.10
updated CHANGELOG for 4.2.10
bumped Symfony version to 3.4.30
updated VERSION for 3.4.29
update CONTRIBUTORS for 3.4.29
updated CHANGELOG for 3.4.29
Fixed type annotation.
* 4.2:
[Security/Core] work around sodium_compat issue
bumped Symfony version to 4.2.11
updated VERSION for 4.2.10
updated CHANGELOG for 4.2.10
bumped Symfony version to 3.4.30
updated VERSION for 3.4.29
update CONTRIBUTORS for 3.4.29
updated CHANGELOG for 3.4.29
* 3.4:
[Security/Core] work around sodium_compat issue
bumped Symfony version to 3.4.30
updated VERSION for 3.4.29
update CONTRIBUTORS for 3.4.29
updated CHANGELOG for 3.4.29
* 4.3: (34 commits)
[PhpunitBridge] Read environment variable from superglobals
[Bridge/PhpUnit] Fix PHP5.5 compat
[PhpUnitBridge] More accurate grouping
fixed CS
Extract unrecoverable exception to interface
[FrameworkBundle] Fix calling Client::getProfile() before sending a request
Fix type error
[Security/Core] require libsodium >= 1.0.14
[Workflow] re-add workflow.definition tag to workflow services
[Security/Core] Don't use ParagonIE_Sodium_Compat
revert #30525 due to performance penalty
collect called listeners information only once
[Lock] fix missing inherit docs in RedisStore
[Messenger] fix retrying handlers using DoctrineTransactionMiddleware
[Mailgun Mailer] fixed issue when using html body
[HttpClient] fix timing measurements with NativeHttpClient
[HttpClient] fix dealing with 1xx informational responses
add test to avoid regressions
fix mirroring directory into parent directory
fix typos
...
* 4.2:
[FrameworkBundle] Fix calling Client::getProfile() before sending a request
Fix type error
[Security/Core] Don't use ParagonIE_Sodium_Compat
collect called listeners information only once
add test to avoid regressions
fix typos
Turkish translation added to Form Component
* 3.4:
[FrameworkBundle] Fix calling Client::getProfile() before sending a request
Fix type error
[Security/Core] Don't use ParagonIE_Sodium_Compat
collect called listeners information only once
add test to avoid regressions
fix typos
Turkish translation added to Form Component
This PR was merged into the 4.4 branch.
Discussion
----------
[Ldap] Add users extraFields in ldap component
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes <!-- please update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | yes <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #28873, #19329 <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | todo when validated, before merge <!-- required for new features -->
As I'm using ldap too in some personal project, It seems that this feature is a really good nice to have IMHO.
Adding the wanted field in the `user_metadata` array transform them as field -> value in the `metadata` field of the user.
Commits
-------
bcfff04797 [Ldap] Add users extra_fields in ldap component
* 4.3:
fix translation domain
tag the FileType service as a form type
don't validate IP addresses from env var placeholders
[Validator] Fix GroupSequenceProvider annotation
[Messenger] fix delay exchange recreation after disconnect
Update ajax security cheat sheet link
Fix AuthenticationException::getToken typehint
* 4.2:
fix translation domain
tag the FileType service as a form type
[Validator] Fix GroupSequenceProvider annotation
Update ajax security cheat sheet link
Fix AuthenticationException::getToken typehint
* 3.4:
fix translation domain
tag the FileType service as a form type
[Validator] Fix GroupSequenceProvider annotation
Update ajax security cheat sheet link
Fix AuthenticationException::getToken typehint
This PR was merged into the 3.4 branch.
Discussion
----------
[Security] Fix AuthenticationException::getToken typehint
| Q | A
| ------------- | ---
| Branch? | 3.4 <!-- see below -->
| Bug fix? | no
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
The token may be not set when throwing AuthenticationException.
<!--
Replace this notice by a short README for your feature/bugfix. This will help people
understand your PR and can be used as a start for the documentation.
Additionally (see https://symfony.com/roadmap):
- Bug fixes must be submitted against the lowest maintained branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too).
- Features and deprecations must be submitted against branch 4.4.
- Legacy code removals go to the master branch.
-->
Commits
-------
a9705a0143 Fix AuthenticationException::getToken typehint
* 4.3:
fixed CS
fixed CS
fixed CS
Do not log or call the proxy function when the locale is the same
Added missing required dependencies on psr/cache and psr/container in symfony/cache-contracts and symfony/service-contracts respectively.
[HttpClient] fix closing debug stream prematurely
[Mailer] made code more robust
Restore compatibility with php 5.5
fixed sender/recipients in SMTP Envelope
collect called listeners information only once
[HttpKernel] Remove TestEventDispatcher.
* 4.3:
[Cache] Fixed undefined variable in ArrayTrait
[HttpClient] revert bad logic around JSON_THROW_ON_ERROR
[HttpKernel] Fix handling non-catchable fatal errors
Fix json-encoding when JSON_THROW_ON_ERROR is used
[HttpFoundation] work around PHP 7.3 bug related to json_encode()
[HttpClient] add $response->cancel()
[Security] added support for updated \"distinguished name\" format in x509 authentication
* 4.2:
[HttpKernel] Fix handling non-catchable fatal errors
Fix json-encoding when JSON_THROW_ON_ERROR is used
[HttpFoundation] work around PHP 7.3 bug related to json_encode()
[Security] added support for updated \"distinguished name\" format in x509 authentication
* 3.4:
Fix json-encoding when JSON_THROW_ON_ERROR is used
[HttpFoundation] work around PHP 7.3 bug related to json_encode()
[Security] added support for updated \"distinguished name\" format in x509 authentication
* 4.3:
[Translation] Fixed case sensitivity of lint:xliff command
fix type hint for salt in PasswordEncoderInterface
Simplify code - catch \Throwable capture all exceptions
Collect locale details earlier in the process in TranslationDataCollector
fix typo in PR #31802
update italian validator translation
Add missing translations
[TwigBridge] suggest Translation Component when TranslationExtension is used
* 4.2:
[Translation] Fixed case sensitivity of lint:xliff command
fix type hint for salt in PasswordEncoderInterface
Simplify code - catch \Throwable capture all exceptions
fix typo in PR #31802
update italian validator translation
Add missing translations
* 4.3:
[Security\Core] Make SodiumPasswordEncoder validate BCrypt-ed passwords
[Validator] Fix TimezoneValidator default option
[Messenger] Inject RoutableMessageBus instead of bus locator
[DomCrawler] Fix type error with null Form::$currentUri
[Contracts] Fixed typos
do not enable validator auto mapping by default
[HttpClient] remove unused argument
* 4.3:
[github] Implement the new security policy.
[Finder] fix wrong method call casing
Make tempfile path unique
minor: fix phpdocs in the ldap component
[Process] Fix infinite waiting for stopped process
Use absolute URL for when the profiler's domain differs from the controller's domain which initialises the profiler.
fix phpdoc
[DI] fix using bindings with locators of service subscribers
* 4.2:
[github] Implement the new security policy.
[Finder] fix wrong method call casing
Make tempfile path unique
minor: fix phpdocs in the ldap component
[Process] Fix infinite waiting for stopped process
Use absolute URL for when the profiler's domain differs from the controller's domain which initialises the profiler.
fix phpdoc
[DI] fix using bindings with locators of service subscribers
* 3.4:
[github] Implement the new security policy.
[Finder] fix wrong method call casing
Make tempfile path unique
minor: fix phpdocs in the ldap component
[Process] Fix infinite waiting for stopped process
Use absolute URL for when the profiler's domain differs from the controller's domain which initialises the profiler.
fix phpdoc
[DI] fix using bindings with locators of service subscribers
* 4.3: (22 commits)
[Messenger] Fix incorrect error when symfony/serializer is missing
Allow WrappedListener to describe uncallable listeners.
[HttpClient] fix handling exceptions thrown before first mock chunk
[Filesystem] fix wrong method call casing
[HttpClient] fix test
[Translation] Fixed issue with new vs old TranslatorInterface in TranslationDataCollector
Don't reference symfony/security
[HttpClient] display proper error message on TransportException when curl is used
[FrameworkBundle] fix named autowiring aliases for TagAwareCacheInterface
[Cache] improve logged messages
[FrameworkBundle] improve cs
[Mime][HttpFoundation] Added mime type audio/x-hx-aac-adts
bumped Symfony version to 4.3.0
updated VERSION for 4.3.0-BETA2
updated CHANGELOG for 4.3.0-BETA2
[HttpClient] Only use CURLMOPT_MAX_HOST_CONNECTIONS & CURL_VERSION_HTTP2 if defined
[Security] fixed a fatal error when upgrading from 4.2
[HttpClient] Allow arrays as query parameters
Throws UnrecoverableMessageHandlingException when passed invalid entity manager name for Doctrine middlewares
[Messenger] Make redis Connection::get() non blocking by default
...
* 4.2:
[Console] Fix auto-complete for ChoiceQuestion (multi-select answers)
Translated form, security, validators resources into Belarusian (be)
[WebProfilerBundle] Don't filter submitted IP values
[Intl] Cleanup
bumped Symfony version to 4.2.9
updated VERSION for 4.2.8
updated CHANGELOG for 4.2.8
bumped Symfony version to 3.4.28
updated VERSION for 3.4.27
update CONTRIBUTORS for 3.4.27
updated CHANGELOG for 3.4.27
* 3.4:
[Console] Fix auto-complete for ChoiceQuestion (multi-select answers)
Translated form, security, validators resources into Belarusian (be)
[WebProfilerBundle] Don't filter submitted IP values
bumped Symfony version to 3.4.28
updated VERSION for 3.4.27
update CONTRIBUTORS for 3.4.27
updated CHANGELOG for 3.4.27
This PR was merged into the 4.3-dev branch.
Discussion
----------
[Security] Dispatch an event when "logout user on change" steps in
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #26902 <!-- #-prefixed issue number(s), if any -->
| License | MIT
| Doc PR | https://github.com/symfony/symfony-docs/pull/11450 <!-- required for new features -->
<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
- Bug fixes must be submitted against the lowest branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too).
- Features and deprecations must be submitted against the master branch.
-->
This adds a new event when the user has been changed and has been log out from the apps, it allow someone to register to this event and do something with either to token or the refreshedUser.
Commits
-------
40e42183b8 [Security] Dispatch an event when "logout user on change" steps in
* 4.2:
[TwigBridge] Require twig ^1.40|^2.9
[Serializer] Fix tests
Use the apply tag instead of the filter tag
Updated some translation files
[Translator] Preserve default domain when extracting strings from php files
* 3.4:
[TwigBridge] Require twig ^1.40|^2.9
[Serializer] Fix tests
Use the apply tag instead of the filter tag
Updated some translation files
[Translator] Preserve default domain when extracting strings from php files
* 4.2:
Fix url matcher edge cases with trailing slash
[Form] Fix author tag + exception messages
[TwigBridge] Fix deprecation on twig 2.9
Fix left-associative ternary deprecation warnings for PHP 7.4
[Validator] Fixed imprecise translations
[Validator] Add Dutch translations
[Security] Cleanup "Digest nonce has expired." translation
Intercept redirections only for HTML format
[PhpUnitBridge] fix reading phpunit.xml on bootstrap
resolve class name parameters
Fix name and phpdoc of ContainerBuilder::removeBindings
[Intl] Update the ICU data to 64.2
This PR was merged into the 4.3-dev branch.
Discussion
----------
[Security] Add NativePasswordEncoder
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
This PR adds a new `NativePasswordEncoder` that defaults to the best available hashing algo to `password_hash()`. Best is determined by "us" or "php", the goal being that this will change in the future as new algos are published.
This provides a native encoder that we should recommend using by default.
Commits
-------
28f7961c55 [Security] Add NativePasswordEncoder
* 4.2:
Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
[FrameworkBundle] minor: remove a typo from changelog
[VarDumper] fix tests with ICU 64.1
[VarDumper][Ldap] relax some locally failing tests
[Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
Make MimeTypeExtensionGuesser case insensitive
Fix get session when the request stack is empty
[Routing] fix trailing slash redirection with non-greedy trailing vars
[FrameworkBundle] decorate the ValidatorBuilder's translator with LegacyTranslatorProxy
* 3.4:
Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
[FrameworkBundle] minor: remove a typo from changelog
[VarDumper][Ldap] relax some locally failing tests
[Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
Make MimeTypeExtensionGuesser case insensitive
