* 4.3:
[Validator] fix access to uninitialized property when getting value
[HttpClient] Fix regex bearer
[HttpKernel] Fix stale-if-error behavior, add tests
Improved error message when no supported user provider is found
Properly handle phpunit arguments for configuration file
* 3.4:
[Validator] fix access to uninitialized property when getting value
[HttpKernel] Fix stale-if-error behavior, add tests
Improved error message when no supported user provider is found
This PR was squashed before being merged into the 3.4 branch (closes#35305).
Discussion
----------
[HttpKernel] Fix stale-if-error behavior, add tests
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | #24248
| License | MIT
| Doc PR |
This PR adds the first tests for `stale-if-error` logic in `HttpCache`.
It also fixes an observation from #24248: For responses that have been cached as `public` with an `ETag` but without a lifetime, in case of an error the stale response will be served forever (= as long as the error persists), even beyond the configured `stale-if-error` grace period.
Furthermore, it tries to improve compliance with RFC 7234: Stale responses must not be sent (under no condition) if one of
* `no-cache`
* `must-revalidate`
* `proxy-revalidate` or
* `s-maxage` (sic) is present.
This can be found in the corresponding chapters of Section 5.2.2 for these directives, but is also summarized in [Section 4.2.4](https://tools.ietf.org/html/rfc7234#section-4.2.4) as
> A cache MUST NOT generate a stale response if it is prohibited by an explicit in-protocol directive (e.g., by a "no-store" or "no-cache" cache directive, a "must-revalidate" cache-response-directive, or an applicable "s-maxage" or "proxy-revalidate" cache-response-directive; see Section 5.2.2).
Because disabling of `stale-if-error` for `s-maxage` responses probably has a big impact on the usefulness of that feature in practice, it has to be enabled explicitly with a new config setting `strict_smaxage` (defaulting to `false`).
Commits
-------
ad5f427bed [HttpKernel] Fix stale-if-error behavior, add tests
This PR was merged into the 4.4 branch.
Discussion
----------
[Mailer] add tests for http transports
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets | none
| License | MIT
Commits
-------
df30a176ac [Mailer] add tests for http transports
This PR was merged into the 4.4 branch.
Discussion
----------
[Mailer] Fix STARTTLS support for Postmark and Mandrill
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | Fix#34846 <!-- prefix each issue number with "Fix #", if any -->
| License | MIT
| Doc PR | n/a
Commits
-------
44b27c6816 [Mailer] Fix STARTTLS support for Postmark and Mandrill
This PR was merged into the 4.3 branch.
Discussion
----------
[Lock] Don't allow mysqli to be used as it doesn't work
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets |
| License | MIT
| Doc PR |
Mysqli doesn't support named parameters, so if you pass a doctrine connection using `mysqli` then you get the following error:
`You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ':id, :token, UNIX_TIMESTAMP() + 300)'`
This PR ensures a clear error is provided and suggests to use `pdo_mysql` instead
Commits
-------
ef3bcda5e3 Mysqli doesn't support the named parameters used by PdoStore
This PR was merged into the 4.4 branch.
Discussion
----------
[DI] CheckTypeDeclarationsPass now checks if value is type of parameter type
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | #35420
| License | MIT
Commits
-------
0d4c0a6492 [DI] CheckTypeDeclarationsPass now checks if value is type of parameter type
This PR was merged into the 4.4 branch.
Discussion
----------
[ErrorHandler] Add debug argument to decide whether debug page is shown or not
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#35448
| License | MIT
| Doc PR | -
This ensures that the debug page (with stack trace) won't be (by default) displayed in non-CLI context when an early error occurs (after FB::boot()) in non-debug mode (prod). And `Debug::enable()` will enable it explicitly.
Commits
-------
cf80224589 Added debug argument to decide if debug page should be shown or not
This PR was merged into the 4.4 branch.
Discussion
----------
[Security] suggest a non-deprecated function replacement
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#35437
| License | MIT
| Doc PR |
Commits
-------
731730fe2f suggest a non-deprecated function replacement
* 4.3:
[DoctrineBridge] [DX] Improve condition for exception text in ManagerRegistry to avoid confusion
Fix testing with mongodb
Minor Travis cosmetic patch
[Cache] fix checking for igbinary availability
bumped Symfony version to 4.3.11
updated VERSION for 4.3.10
updated CHANGELOG for 4.3.10
bumped Symfony version to 3.4.38
updated VERSION for 3.4.37
update CONTRIBUTORS for 3.4.37
updated CHANGELOG for 3.4.37
This PR was merged into the 3.4 branch.
Discussion
----------
[Security] Use supportsClass in addition to UnsupportedUserException
| Q | A
| ------------- | ---
| Branch? | 3.4+
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#35045
| License | MIT
| Doc PR | ~
This PR fixes the issue where user providers rely on just the UnsupportedUserException from `refreshUser()`, causing a flow where users are wrongfully re-authenticated.
There's one issue where `refreshUser()` can do far more sophisticated checks on the user class, which it will never reach if the class is not supported. As far as I know it was never intended to support instances that are rejected by `supportsClass()`, though people could've implemented this (by accident). So the question is more if we should add a BC layer for this; for example:
```php
try {
$refreshedUser = $provider->refreshUser($user);
$newToken = clone $token;
$newToken->setUser($refreshedUser);
if (!$provider->supportsClass($userClass)) {
if ($this->shouldCheckSupportsClass) {
continue;
}
// have to think of a proper deprecation here for 6.0
@trigger_error('Provider %s does not support user class %s via supportsClass() while it does support it via refreshUser .. please set option X and fix %s::supportsUser() ', E_USER_DEPRECATED);
}
```
This would prevent behavior from breaking but also means we can't fix this on anything less than 5.1.
Commits
-------
d3942cbe17 Use supportsClass where possible
This PR was squashed before being merged into the 4.4 branch.
Discussion
----------
Revert #34797 "Fixed translations file dumper behavior" and fix#34713
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#35264
| License | MIT
| Doc PR | -
Revert https://github.com/symfony/symfony/pull/34797
See also https://github.com/symfony/symfony/issues/35328
It's very likely that the new way will be completely different from this one that is being reverted. That's why I'm reverting rather than fixing it.
Commits
-------
9ca872054bFixed#34713 Move new messages to intl domain when possible
56e79fefa1 Revert "Fixed translations file dumper behavior"
* 4.3:
chown and chgrp should also accept int as owner and group
Fix RememberMe with null password
[Validator] Fix plurals for sr_Latn (Serbian language written in latin script) validation messages
[PhpUnitBridge][SymfonyTestsListenerTrait] Remove some unneeded code
fix PHP const mapping keys using the inline notation
Fix that no-cache requires positive validation with the origin, even for fresh responses
* 3.4:
chown and chgrp should also accept int as owner and group
Fix RememberMe with null password
[Validator] Fix plurals for sr_Latn (Serbian language written in latin script) validation messages
[PhpUnitBridge][SymfonyTestsListenerTrait] Remove some unneeded code
fix PHP const mapping keys using the inline notation
Fix that no-cache requires positive validation with the origin, even for fresh responses
* 4.3:
[FrameworkBundle] remove messenger cache if not enabled
[HttpClient] Fix strict parsing of response status codes
[DI] Suggest typed argument when binding fails with untyped argument
This PR was merged into the 3.4 branch.
Discussion
----------
[Filesystem] chown and chgrp should also accept int as owner and group (3.4)
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets |
| License | MIT
| Doc PR |
Reference: https://github.com/symfony/symfony/pull/35356#issuecomment-575526299
Commits
-------
6b811e6b4c chown and chgrp should also accept int as owner and group
This PR was merged into the 3.4 branch.
Discussion
----------
[Validator] Fix plurals for sr_Latn validation messages
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#35276
| License | MIT
validators.sr_Latn.xlf (Serbian, written with latin script) has wrong plurals for all validation message translations that require them (only two where there should be three). This commit fixes that by adding the missing third plural-translation.
Commits
-------
207cdafd54 [Validator] Fix plurals for sr_Latn (Serbian language written in latin script) validation messages
This PR was merged into the 4.3 branch.
Discussion
----------
[DI] Suggest typed argument when binding fails with untyped argument
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | #33470
| License | MIT
I've added a condition that looks for arguments and if the typehint doesn’t match, throws an `InvalidArgumentException`
Commits
-------
0e92399daa [DI] Suggest typed argument when binding fails with untyped argument
* 4.3:
Avoid stale-if-error if kernel.debug = true, because it hides errors
[Console] Fix SymfonyQuestionHelper tests sometimes failing on AppVeyor
[Workflow] Fix configuration node reference for "initial_marking"
expand listener in place
[DI] deferred exceptions in ResolveParameterPlaceHoldersPass
* 3.4:
Avoid stale-if-error if kernel.debug = true, because it hides errors
[Console] Fix SymfonyQuestionHelper tests sometimes failing on AppVeyor
[DI] deferred exceptions in ResolveParameterPlaceHoldersPass
This PR was merged into the 3.4 branch.
Discussion
----------
[DI] deferred exceptions in ResolveParameterPlaceHoldersPass
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#30428
| License | MIT
| Doc PR | n/a
fixes case #30428
implemented as in AutowiringPass
Commits
-------
b3a2173c8e [DI] deferred exceptions in ResolveParameterPlaceHoldersPass
This PR was merged into the 4.4 branch.
Discussion
----------
[HttpKernel][FileLocator] Fix deprecation message
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
Ref https://github.com/symfony/symfony/pull/34886
`$deprecatedPath` is the foreach value so it only works if the last element triggers the deprecation, otherwise the value is wrong.
Commits
-------
18ce8399d2 [HttpKernel][FileLocator] Fix deprecation message
* 4.3:
[Process] - update @throws phpdoc
[PHPUnitBridge] file_get_contents() expects parameter 3 to be resource
[PHPUnit-Bridge] Fail-fast in simple-phpunit if one of the passthru() commands fails
* 4.3:
[Debug] fix ClassNotFoundFatalErrorHandler
[Routing] Fix using a custom matcher & generator dumper class
[Dotenv] Fixed infinite loop with missing quote followed by quoted value
[HttpClient] Added missing sprintf
[TwigBridge] button_widget now has its title attr translated even if its label = null or false
[PhpUnitBridge] When using phpenv + phpenv-composer plugin, composer executable is wrapped into a bash script
[Messenger] Added check if json_encode succeeded
[Security] Prevent canceled remember-me cookie from being accepted
[FrameworkBundle][TranslationUpdateCommand] Do not output positive feedback on stderr
[Security\Guard] Fix missing typehints
This PR was merged into the 4.3 branch.
Discussion
----------
[Routing] Fix using a custom matcher & generator dumper class
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
This PR fixes a BC break I encountered while upgrading an existing project from 4.2 to 4.4. In this project I use a custom `generator_dumper_class` that is not a `CompiledUrlGeneratorDumper` (it didn't exist yet). I faced 2 problems:
- The generator is considered "compiled" while it is not. This is because we don't check if the `generator_dumper_class` is effectively a `CompiledUrlGeneratorDumper` to compute the `$compiled` variable. That result in a `\TypeError: Return value of Symfony\Component\Routing\Router::getCompiledRoutes() must be of the type array, int returned`
- My custom dumper is not used at all. This is because of https://github.com/symfony/symfony/pull/31964. I altered the condition to fall back only in one way and not the other. The original issue is still fixed (if one uses a classic `UrlGenerator` + a `CompiledUrlGeneratorDumper`, it fall backs on `PhpGeneratorDumper`). However, if one uses a `CompiledUrlGenerator` + a classic `PhpGeneratorDumper` (my case), the classic dumper is still returned. Since `$compiled` is now correctly computed, this case works fine. The Router won't try to get the compiled routes and will use the "old" way.
Commits
-------
3a840a9796 [Routing] Fix using a custom matcher & generator dumper class
* 3.4:
[Debug] fix ClassNotFoundFatalErrorHandler
[Dotenv] Fixed infinite loop with missing quote followed by quoted value
[TwigBridge] button_widget now has its title attr translated even if its label = null or false
[PhpUnitBridge] When using phpenv + phpenv-composer plugin, composer executable is wrapped into a bash script
[Security] Prevent canceled remember-me cookie from being accepted
[FrameworkBundle][TranslationUpdateCommand] Do not output positive feedback on stderr
This PR was merged into the 3.4 branch.
Discussion
----------
[Dotenv] Fixed infinite loop with missing quote followed by quoted value
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#34642
| License | MIT
| Doc PR |
If there's a quote missing to end a value and in the next line there's again a quoted value Dotenv will run into an infinite loop. An .env file with the following content will result in this error:
```
FOO="foo
BAR="bar"
```
See #34642 for more details.
Commits
-------
eb69e135b2 [Dotenv] Fixed infinite loop with missing quote followed by quoted value
This PR was merged into the 3.4 branch.
Discussion
----------
[Security\Http] Prevent canceled remember-me cookie from being accepted
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#35198
| License | MIT
| Doc PR | -
`RememberMeServices::autoLogin()` only checks that the cookie exists in `$request->cookies` while `loginFail()` only alter `$request->attributes` (which allows child implementations to read the canceled cookie for e.g. removing a persistent one).
This makes `autoLogin()` checks for `request->attributes` first, which fixes the linked issue.
Failure expected on deps=high build.
Commits
-------
9b711b87fe [Security] Prevent canceled remember-me cookie from being accepted
`isset` is used to test existence of values that is
`null` by default, which result to always bypass the cache
and force to do the calculate all the time.
This is a critical perf improvement in prod mode for an api.
Ref #35085
If there's a quote missing to end a value and in the next line there's again a quoted value Dotenv will run into an infinite loop. An .env file with the following content will result in this error:
```
FOO="foo
BAR="bar"
```
See #34642 for more details.
This PR was squashed before being merged into the 4.3 branch (closes#35150).
Discussion
----------
[Messenger] Added check if json_encode succeeded
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets |
| License | MIT
| Doc PR |
Similar PR as https://github.com/symfony/symfony/pull/35137 but for branch 4.3.
When trying to add a message to redis transport which can not be encoded with `json_encode` there is now a `TransportException` containing the `json_last_error_msg` as the message.
I had an issue where I tried to send an email through messenger by symfony mailer which contains a pdf attachment. Instead of an error while sending i got an error `Encoded envelope should have at least a "body"` which happened because the encoded message was `false`.
This is not exactly a bugfix, but IMO also not a feature worth being mentioned in the changelog so I am not sure I've filled out the Q/A correctly.
Commits
-------
c2bdc4c4d3 [Messenger] Added check if json_encode succeeded
This PR was merged into the 4.4 branch.
Discussion
----------
[HttpClient] fix exception in case of PSR17 discovery failure
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
On symfony.com, we need to use HTTPlug for 3rd party libs. When `nyholm/psr7` is not installed, we currently see an exception saying `No HTTPlug clients found.` from `HttpClientDiscovery`.
This fixes the message by correctly suggesting `nyholm/psr7` instead, since there *is* an HTTPlug client: `HttplugClient` from our HttpClient component.
It's quite unfortunate that `guzzle/psr7` provides no PSR17 factory yet, because that would have solved some part of this deps mess. /cc @Nyholm @sagikazarmark FYI
Note that https://packagist.org/providers/psr/http-factory-implementation lists `guzzle/psr7` but this is a wrong solution: no tagged release of it is PSR17-compatible, which means installing it doesn't solve the issue.
Commits
-------
96e70a4080 [HttpClient] fix exception in case of PSR17 discovery failure
This PR was merged into the 4.4 branch.
Discussion
----------
[DependencyInjection] Handle ServiceClosureArgument for callable in container linting
| Q | A
| ------------- | ---
| Branch? | 4.4 (+)
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | (none)
| License | MIT
Making use of `ServiceClosureArgument` instances in service definitions was not accounted for in container linting when a service type-hints for `callable` in an argument - adding this check ensures that `ServiceClosureArgument` instances are recognised correctly as callables (once they are resolved).
Commits
-------
e48829e9b6 [DependencyInjection] Handle ServiceClosureArgument for callable in container linting
* 4.3:
[HttpClient] Don't read from the network faster than the CPU can deal with
[DI] DecoratorServicePass should keep container.service_locator on the decorated definition
This PR was merged into the 4.3 branch.
Discussion
----------
[HttpClient] Don't read from the network faster than the CPU can deal with
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
Something I spotted while working on #35115: both the curl and native clients don't play well with heavily compressed HTTP streams: they decompress faster than userland can process chunks.
The attached patch moves the decompression logic to the chunk generator. This means internally we only deal with raw compressed chunks, and they are decompressed only when passing the value to userland.
Commits
-------
ac3d77a76a [HttpClient] Don't read from the network faster than the CPU can deal with
