This PR was merged into the 4.4 branch.
Discussion
----------
[ErrorHandler] don't throw deprecations for return-types by default
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets | Fix#33235
| License | MIT
| Doc PR | -
As discussed a few times already, in 4.4, `DebugClassLoader` shouldn't trigger deprecations when return types are missing. We'll enable them back in 5.1.
Commits
-------
2cb419edf4 [ErrorHandler] don't throw deprecations for return-types by default
This PR was merged into the 4.4 branch.
Discussion
----------
[HttpKernel] compress files generated by the profiler
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| Deprecations? | no
| Tickets | #33006
| License | MIT
| Doc PR | -
I've recently seen several reports of fastly growing profiler storages. Let's compress them when possible.
Locally for the skeleton homepage, a single profile goes from 150k to 15k. Level 3 is producing significant compression ratio while being measurably faster than level 6 (the default), that's why I'm using it.
Commits
-------
08f9470556 [HttpKernel] compress files generated by the profiler
This PR was squashed before being merged into the 4.4 branch (closes#33317).
Discussion
----------
[Messenger] Added support for `from_transport` attribute on `messenger.message_handler` tag
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #33306
| License | MIT
| Doc PR | https://github.com/symfony/symfony-docs/pull/12231
Right now, it's only possible to have dynamic `from_transport` when using `MessageSubscriberInterface`. Things like `priority` and `bus` can already be added as attributes on the messenger.message_handler` tag.
With this PR it now also supports `from_transport`.
Commits
-------
c965e4e844 [Messenger] Added support for `from_transport` attribute on `messenger.message_handler` tag
This PR was merged into the 4.3 branch.
Discussion
----------
Add missing row_attr option to FormType
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix: #33682 - related issue #33573
| License | MIT
The #33573 modified Symfony's form themes. But the [FormType](https://github.com/symfony/form/blob/master/Extension/Core/Type/FormType.php) don't allow the option `row_attr` so the OptionResolver throw an exception that the option is unknown.
This PR basically add the option and give it to the form view (like `label_attr` do)
Commits
-------
d711ea2b54 Add missing row_attr option to FormType
This PR was merged into the 4.3 branch.
Discussion
----------
[Security] use LegacyEventDispatcherProxy
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
I ran into an issue on one of my apps that has its own event dispatcher class using the old dispatch method signature
```php
public function dispatch($eventName, Event $event = null)
```
This leads to
```
TypeError: Argument 2 passed to X\Tests\Base\TestEventDispatcher::dispatch() must be an instance of Symfony\Component\EventDispatcher\Event or null, string given, called in /var/www/x/symfony/vendor/symfony/security/Http/Firewall/ContextListener.php on line 230
/var/www/x/symfony/tests/Base/TestEventDispatcher.php:20
/var/www/x/symfony/vendor/symfony/security/Http/Firewall/ContextListener.php:230
/var/www/x/symfony/vendor/symfony/security/Http/Firewall/ContextListener.php:111
```
since the event here is dispatched using the new signature:
https://github.com/symfony/symfony/blob/4.4/src/Symfony/Component/Security/Http/Firewall/ContextListener.php#L259
Commits
-------
7067e48165 [Security] use LegacyEventDispatcherProxy
* 4.3:
[Security/Http] fix typo in deprecation message
Various tweaks 3.4
Various tweaks 4.3
[PhpUnit] Fix usleep mock return value
[Lock] use Predis\ClientInterface instead of Predis\Client
Fix version typo in deprecation notice
Make legacy "wrong" RFC2047 encoding apply only to one header
This PR was merged into the 4.3 branch.
Discussion
----------
[Security/Http] fix typo in deprecation message
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
spotted by @stof in #33676
Commits
-------
e70057aed4 [Security/Http] fix typo in deprecation message
This PR was squashed before being merged into the 4.4 branch (closes#33584).
Discussion
----------
[Security] Deprecate isGranted()/decide() on more than one attribute
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | no
| Deprecations? | yes
| Tickets | -
| License | MIT
| Doc PR | tbd
While I expect it not be used much, it is currently possible to call `isGranted()` on more than one attribute:
```php
if ($this->authorizationChecker->isGranted(['ROLE_USER', 'ROLE_ADMIN'])) {
// ...
}
```
Supporting this includes a couple of problems/questions:
- It is not clear whether this is `OR` or `AND`;
- In fact, this is left over to the voter to decide upon. So it can vary for each voter and writers of new voters need to consider this (otherwise, you get issues like https://github.com/LeaseWeb/LswSecureControllerBundle/issues/4 );
- It promotes to vote over roles instead of actions.
I think we can do better. In the past, we've created all tooling for this to be self-explaining and easier:
```php
// ExpressionLanguage component (also includes other functions, like `is_granted('EDIT')`)
if ($this->authorizationChecker->isGranted("has_role('ROLE_USER') or has_role('ROLE_ADMIN')")) {
// ...
}
// calling it multiple times in PHP (may reduce performance)
if ($this->authorizationChecker->isGranted('ROLE_USER')
|| $this->authorizationChecker->isGranted('ROLE_ADMIN')
) {
// ...
}
// or by using Role Hierarchy, if a user really wants to vote on roles
```
This PR deprecates passing more than one attribute to `isGranted()` and `decide()` to remove this confusing bit in Security usage.
Backwards compatiblity help
---
I need some help in how to approach changing the `VoterInterface::vote(TokenInterface $token, $subject, array $attributes)` method in a backwards compatible way. Removing `array` breaks all Voters, so does changing it to `string` and removed the parameter all together.
Commits
-------
c64b0beffb [Security] Deprecate isGranted()/decide() on more than one attribute
This PR was merged into the 4.4 branch.
Discussion
----------
[Security] Make stateful firewalls turn responses private only when needed
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #26769 *et al.*
| License | MIT
| Doc PR | -
Replaces #28089
By taking over session usage tracking and replacing it with token usage tracking, we can prevent responses that don't actually use the token from turning responses private without changing anything to the lifecycle of security listeners. This makes the behavior much more seamless, allowing to still log the user with the monolog processor, and display it in the profiler toolbar.
This works by using two separate token storage services:
- `security.token_storage` now tracks access to the token and increments the session usage tracker when needed. This is the service that is injected in userland.
- `security.untracked_token_storage` is a raw token storage that just stores the token and is disconnected from the session. This service is injected in places where reading the session doesn't impact the generated output in any way (as e.g. in Monolog processors, etc.)
Commits
-------
20df3a125c [Security] Make stateful firewalls turn responses private only when needed
This PR was merged into the 4.4 branch.
Discussion
----------
Fixed a minor typo in the UPGRADE to 5.0 guide
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
I tried to fix this in the 4.3 branch too ... but the `UPGRADE-5.0.md` is quite different. Should these two files be exactly the same?
* https://github.com/symfony/symfony/blob/4.3/UPGRADE-5.0.md
* https://github.com/symfony/symfony/blob/4.4/UPGRADE-5.0.md
Commits
-------
8532d62 Fixed a minor typo in the UPGRADE to 5.0 guide
This PR was squashed before being merged into the 3.4 branch (closes#33677).
Discussion
----------
Various tweaks 3.4
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
<!--
Replace this notice by a short README for your feature/bugfix. This will help people
understand your PR and can be used as a start for the documentation.
Additionally (see https://symfony.com/roadmap):
- Always add tests and ensure they pass.
- Never break backward compatibility (see https://symfony.com/bc).
- Bug fixes must be submitted against the lowest maintained branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too.)
- Features and deprecations must be submitted against branch 4.4.
- Legacy code removals go to the master branch.
-->
Commits
-------
47cb83a6ec Various tweaks 3.4
This PR was squashed before being merged into the 4.3 branch (closes#33678).
Discussion
----------
Various tweaks 4.3
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets | n/a
| License | MIT
| Doc PR | n/a
<!--
Replace this notice by a short README for your feature/bugfix. This will help people
understand your PR and can be used as a start for the documentation.
Additionally (see https://symfony.com/roadmap):
- Always add tests and ensure they pass.
- Never break backward compatibility (see https://symfony.com/bc).
- Bug fixes must be submitted against the lowest maintained branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too.)
- Features and deprecations must be submitted against branch 4.4.
- Legacy code removals go to the master branch.
-->
Commits
-------
7596f99a12 Various tweaks 4.3
This PR was merged into the 4.4 branch.
Discussion
----------
[Form][SubmitType] Add "validate" option
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| Deprecations? | no
| Tickets | https://github.com/symfony/symfony/issues/8763
| License | MIT
| Doc PR | TODO
The second part of the ticket requires more work but is kind of unrelated.
Commits
-------
a2bc06d811 [Form][SubmitType] Add "validate" option
This PR was merged into the 4.3 branch.
Discussion
----------
Make legacy "wrong" RFC2047 encoding apply only to one header
| Q | A
| ------------- | ---
| Branch? | 4.3
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| License | MIT
It says in a comment in the code that "We have to go against RFC 2183/2231 in some areas for interoperability". But I would like that to be the exception and not the rule. As the code was, all parameterized headers except from "Content-Disposition" was not encoded according to RFC 2231.
This change is to make it so that the exception (to not follow the RFC) is for the header "Content-Type" only, and all other parameterized headers will follow the rule of RFC 2231.
The code kind of worked before, because in emails we generally only have two parameterized headers; "Content-Disposition" and "Content-Type". But I think it is a good thing that if another parameterized header would happen to be added, by default it should follow the rule of the RFC and not by default be an exception.
Commits
-------
3817a8b036 Make legacy "wrong" RFC2047 encoding apply only to one header
This PR was merged into the 4.4 branch.
Discussion
----------
[Yaml] hint to the --parse-tags when parsing tags fails
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no
| New feature? | yes
| Deprecations? | no
| Tickets | Fix https://github.com/symfony/symfony/issues/28465#issuecomment-533182079
| License | MIT
| Doc PR |
Commits
-------
012111524b hint to the --parse-tags when parsing tags fails
This PR was squashed before being merged into the 3.4 branch (closes#33666).
Discussion
----------
[Lock] use Predis\ClientInterface instead of Predis\Client
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| License | MIT
`\Predis\ClientInterface` can be used instead of `\Predis\Client` for RedisStore.
Commits
-------
5c01f0a7e5 [Lock] use Predis\ClientInterface instead of Predis\Client
