Commit Graph

54676 Commits

Author SHA1 Message Date
Fabien Potencier
7f49a3d8cd Update CHANGELOG for 5.3.0-BETA4 2021-05-12 15:44:34 +02:00
Nicolas Grekas
8fb0ed752e Merge branch '5.2' into 5.x
* 5.2:
  [CI][Psalm] Install stable/released PHPUnit
  [Security] Add missing Finnish translations
  [Security][Guard] Prevent user enumeration via response content
2021-05-12 15:40:11 +02:00
Nicolas Grekas
293919ff65 Merge branch '4.4' into 5.2
* 4.4:
  [CI][Psalm] Install stable/released PHPUnit
  [Security] Add missing Finnish translations
  [Security][Guard] Prevent user enumeration via response content
2021-05-12 15:14:35 +02:00
Nicolas Grekas
d5c0fbac85 Merge branch '3.4' into 4.4
* 3.4:
  [Security][Guard] Prevent user enumeration via response content
2021-05-12 14:42:28 +02:00
Nicolas Grekas
2a581d22cc security #cve-2021-21424 [Security][Guard] Prevent user enumeration (chalasr)
This PR was merged into the 3.4 branch.
2021-05-12 14:32:10 +02:00
Nicolas Grekas
2ac23c6a33 minor #41190 [FrameworkBundle] improve AbstractController::renderForm() (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[FrameworkBundle] improve AbstractController::renderForm()

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Even better than #41178, this requires a simple change on apps, and is compatible with multiple forms.

Usage:
```diff
-        return $this->render('thing/new.html.twig', [
+        return $this->renderForm('thing/new.html.twig', [
             'thing' => $thing,
-            'form' => $form->createView(),
+            'form' => $form,
         ]);
```

In 5.4, we could even deprecate passing a FormView to render() so that we can always set the 422.

Commits
-------

e244d31fb0 [FrameworkBundle] improve AbstractController::renderForm()
2021-05-12 14:10:04 +02:00
Nicolas Grekas
e244d31fb0 [FrameworkBundle] improve AbstractController::renderForm() 2021-05-12 13:31:16 +02:00
Nicolas Grekas
af77943d4b minor #41187 [Translation] Fix Crowdin Translation Provider DSN example (andrii-bodnar)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[Translation] Fix Crowdin Translation Provider DSN example

| Q             | A
| ------------- | ---
| Branch?       | 5.x <!-- see below -->
| Bug fix?      | no
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets       |  <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
| License       | MIT
| Doc PR        | <!-- required for new features -->

Crowdin DSN structure was changed in #41146. This PR updates the README for Crowdin Translation Provider.

Commits
-------

8465e885ba [Translation] Fix Crowdin Translation Provider DSN example
2021-05-12 13:20:50 +02:00
Andrii Bodnar
8465e885ba [Translation] Fix Crowdin Translation Provider DSN example 2021-05-12 12:33:38 +03:00
Fabien Potencier
854226bbd3 feature #41178 [FrameworkBundle] Introduce AbstractController::renderForm() instead of handleForm() (lyrixx)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[FrameworkBundle] Introduce `AbstractController::renderForm()` instead of `handleForm()`

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | yes
| Tickets       |
| License       | MIT
| Doc PR        | -

I'm know I'm a bit late on this once, but I don't really like the `handleForm()` method:

1. It uses callable and PHP does not support type hint on callable so it's error prone. While trying the feature I forgot to return a response and I got a fatal error "cannot call getStatusCode() on null". Not really user friendly;
1. callables receive `mixed $data`: it's too generic. Static analysis could not work properly and so autocompletion does not work;
1. This is a new syntax to learn;
1. All documentation, blog post, etc should be updated, and it's not fixable with `sed` or similar tool;
1. This is not really flexible. We are going to lock people with this flow, and they will hesitate to use the "old" syntax when they need more flexibility;

That's why I propose this alternative, which is  more simple I guess and addresses issues I leveraged.

I read somewhere that calling `isValid()` trigger twice the validation logic: This is wrong. The validation occurs during form submitting via an event listener. calling `isValid()` only check if there is some errors attached to the form.

---

Usage:
```diff
     #[Route('/new', name: 'thing_new', methods: ['GET', 'POST'])]
     public function new(Request $request): Response
     {
         $thing = new Thing();
         $form = $this->createForm(ThingType::class, $thing);

         $form->handleRequest($request);
         if ($form->isSubmitted() && $form->isValid()) {
             $entityManager = $this->getDoctrine()->getManager();
             $entityManager->persist($thing);
             $entityManager->flush();

             return $this->redirectToRoute('thing_index');
         }

-        return $this->render('thing/new.html.twig', [
+        return $this->renderForm('thing/new.html.twig', $form, [
             'thing' => $thing,
             'form' => $form->createView(),
         ]);
     }
```

Commits
-------

27f8f50386 [FrameworkBundle] Introduce AbstractController::renderForm()
2021-05-12 11:09:45 +02:00
Grégoire Pineau
27f8f50386 [FrameworkBundle] Introduce AbstractController::renderForm() 2021-05-12 10:25:46 +02:00
Nicolas Grekas
fef109932f minor #41186 [FrameworkBundle] fix AbstractController::handleForm() (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[FrameworkBundle] fix AbstractController::handleForm()

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no (fixing a fix)
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

777c3c25b2 [FrameworkBundle] fix AbstractController::handleForm()
2021-05-12 09:49:16 +02:00
Nicolas Grekas
777c3c25b2 [FrameworkBundle] fix AbstractController::handleForm() 2021-05-12 09:43:11 +02:00
Nicolas Grekas
b14d76921f feature #41182 [DependencyInjection] allow PHP-DSL files to be env-conditional (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[DependencyInjection] allow PHP-DSL files to be env-conditional

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

This PR makes config builders compatible with conditional configuration based on the $env.

See fixture for an example:
```php
use Symfony\Component\DependencyInjection\Tests\Fixtures\AcmeConfig;

if ('prod' !== $env) {
    return;
}

return static function (AcmeConfig $config) {
    $config->color('blue');
};
```

On PHP8, the PR to allow using `#[When(env: prod')]`:
```php
use Symfony\Component\DependencyInjection\Attribute\When;
use Symfony\Component\DependencyInjection\Tests\Fixtures\AcmeConfig;

return #[When(env: 'prod')] function (AcmeConfig $config) {
    $config->color('blue');
};
```

Without this patch, such a config file cannot be used if AcmeBundle is not loaded in the current $env.

This is a follow up of https://symfony.com/blog/new-in-symfony-5-3-configure-multiple-environments-in-a-single-file#comment-24521 by `@a`-menshchikov

Commits
-------

29173a91d1 [DependencyInjection] inject $env in the scope of PHP-DSL files
2021-05-12 08:47:53 +02:00
Nyholm
a0f8fc5c08
minor #41180 [Security] Add missing Finnish translations (mikkoaf)
This PR was merged into the 4.4 branch.

Discussion
----------

[Security] Add missing Finnish translations

| Q             | A
| ------------- | ---
| Branch?       |  4.4
| Bug fix?      | no
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets       | Fix #41043
| License       | MIT
| Doc PR        |

Added some missing Finnish translations.

Commits
-------

c1cefc088d [Security] Add missing Finnish translations
2021-05-12 08:47:11 +02:00
Nicolas Grekas
1921c78c7f minor #41181 [FrameworkBundle] improve AbstractController::handleForm() (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[FrameworkBundle] improve AbstractController::handleForm()

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | (
| License       | MIT
| Doc PR        | -

Related to #41178

Commits
-------

7c69682775 [FrameworkBundle] improve AbstractController::handleForm()
2021-05-12 08:36:51 +02:00
Nyholm
d36f5e31ee
[CI][Psalm] Install stable/released PHPUnit 2021-05-12 08:32:34 +02:00
Nicolas Grekas
29173a91d1 [DependencyInjection] inject $env in the scope of PHP-DSL files 2021-05-12 08:29:16 +02:00
Nicolas Grekas
7c69682775 [FrameworkBundle] improve AbstractController::handleForm() 2021-05-12 08:11:53 +02:00
Mikko Ala-Fossi
c1cefc088d [Security] Add missing Finnish translations 2021-05-12 07:44:21 +03:00
Nicolas Grekas
31bd00e6d7 minor #41166 [PhpUnitBridge] fix test on appveyor (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[PhpUnitBridge] fix test on appveyor

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Hopefully :)

Commits
-------

89033a5781 [PhpUnitBridge] fix test on appveyor
2021-05-11 23:31:43 +02:00
Nicolas Grekas
89033a5781 [PhpUnitBridge] fix test on appveyor 2021-05-11 23:21:52 +02:00
Nicolas Grekas
094b507a05 bug #41177 [DependencyInjection] fix empty instanceof-conditionals created by AttributeAutoconfigurationPass (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[DependencyInjection] fix empty instanceof-conditionals created by AttributeAutoconfigurationPass

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #40868
| License       | MIT
| Doc PR        | -

Commits
-------

5c3ee39cfd [DependencyInjection] fix empty instanceof-conditionals created by AttributeAutoconfigurationPass
2021-05-11 19:00:41 +02:00
Nicolas Grekas
5c3ee39cfd [DependencyInjection] fix empty instanceof-conditionals created by AttributeAutoconfigurationPass 2021-05-11 18:40:34 +02:00
Nicolas Grekas
444b40c0b0 Merge branch '5.2' into 5.x
* 5.2:
  [DependencyInjection] fix dumping service-closure-arguments
  [Console] Fix Windows code page support
2021-05-11 18:08:00 +02:00
Nicolas Grekas
ee75b0c54e Merge branch '4.4' into 5.2
* 4.4:
  [DependencyInjection] fix dumping service-closure-arguments
2021-05-11 18:07:35 +02:00
Nicolas Grekas
9a53e6acc1 bug #41176 [DependencyInjection] fix dumping service-closure-arguments (nicolas-grekas)
This PR was merged into the 4.4 branch.

Discussion
----------

[DependencyInjection] fix dumping service-closure-arguments

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #39259
| License       | MIT
| Doc PR        | -

5.3 uses service closures a bit more, so that this is required to make the `lint:container` command work.

Commits
-------

1aa9a249fc [DependencyInjection] fix dumping service-closure-arguments
2021-05-11 17:59:00 +02:00
Nicolas Grekas
1aa9a249fc [DependencyInjection] fix dumping service-closure-arguments 2021-05-11 17:55:42 +02:00
Nicolas Grekas
2289c32bb4 bug #41174 [Console] Fix Windows code page support (orkan)
This PR was submitted for the 5.x branch but it was merged into the 5.2 branch instead.

Discussion
----------

[Console] Fix Windows code page support

My previous PR #41113 was corrected by `@nicolas`-grekas on 3bac7fe. He introduced logical changes in the code which resulted in incorrect behaviour.
The basic idea was to restore the I/O codepage as soon as you get console input. And you have to do this even if `fgets()` returns **false**, because otherwise you'll leave the changed codepage for the rest of the script execution - and that's bad!

Commits
-------

044b585f69 [Console] Fix Windows code page support
2021-05-11 17:45:39 +02:00
Marek Zajac
044b585f69 [Console] Fix Windows code page support 2021-05-11 17:45:21 +02:00
Alexander M. Turek
69b2063bba Merge branch '5.2' into 5.x
* 5.2:
  [Security] Make Login Rate Limiter also case insensitive for non-ascii user identifiers
  only load Sfjs if it is not present
2021-05-11 16:37:54 +02:00
Alexander M. Turek
f3f8027688 Merge branch '4.4' into 5.2
* 4.4:
  only load Sfjs if it is not present
2021-05-11 16:36:09 +02:00
Alexander M. Turek
3348c63eeb bug #41173 [Security] Make Login Rate Limiter also case insensitive for non-ascii user identifiers (Seldaek)
This PR was merged into the 5.2 branch.

Discussion
----------

[Security] Make Login Rate Limiter also case insensitive for non-ascii user identifiers

| Q             | A
| ------------- | ---
| Branch?       | 5.2
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

As per discussion in https://github.com/symfony/symfony/pull/41156

Commits
-------

3b7e7fbc7f [Security] Make Login Rate Limiter also case insensitive for non-ascii user identifiers
2021-05-11 16:34:49 +02:00
Jordi Boggiano
3b7e7fbc7f
[Security] Make Login Rate Limiter also case insensitive for non-ascii user identifiers 2021-05-11 15:46:52 +02:00
Alexander M. Turek
1bf384a31c bug #41170 [DependencyInjection] Don't try to load YamlFileLoader if it's not actually needed (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[DependencyInjection] Don't try to load YamlFileLoader if it's not actually needed

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #41169
| License       | MIT
| Doc PR        | -

This PR enables using DI without Config when autoconfiguration is not used.
(When autoconfiguration is used, the dependency on Config is still there.)

Commits
-------

7eb46bd779 [DI] Don't try to load YamlFileLoader if it's not actually needed
2021-05-11 14:40:06 +02:00
Nicolas Grekas
7eb46bd779 [DI] Don't try to load YamlFileLoader if it's not actually needed 2021-05-11 14:23:24 +02:00
Fabien Potencier
89c1be89f0 bug #41168 WDT: Only load "Sfjs" if it is not present already (weaverryan)
This PR was merged into the 4.4 branch.

Discussion
----------

WDT: Only load "Sfjs" if it is not present already

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | none
| License       | MIT
| Doc PR        | not needed

Hi!

Playing with Turbo, I noticed two small issues with the WDT:

1) When you click a link (which Turbo loads via AJAX), the new toolbar would correctly load, but its "AJAX tab" would be missing/empty. At first, that seems.. at least... "correct enough". After all, we *did* just load a new web debug toolbar. However, this can be avoided by simply *not* redefining the `Sfjs` variable: if it already exists, just use it. And this is the intention of that object, I believe: for it to be loaded *once*, and then reused over and over again via its `loadToolbar()` method.

2) Additionally, I was experimenting with some crazy prefetch + Turbo functionality. It works, but caused one minor issue with the web debug toolbar. The flow is this:

A) A prefetch request is made to pre-cache a URL in Turbo.
B) When that links is actually clicked, the cached version from (A) is used as the "Preview". It's HTML calls `Sfjs.loadToolbar()`.
C) At the same moment as (B), another AJAX request is made to the same URL from (A) to get the full, fresh page (in case it's out of date).
D) When (C) finishes, it will have its own `Sfjs.loadToolbar()` call.

The problem is that the AJAX request for the first web debug toolbar (from B) sometimes finishes *after* the AJAX call made by Turbo for (C). The result is that the first web debug toolbar tries to activate itself... but it's already gone from the page.

I realize this is a... kind of crazy scenario, but I think the fix is legit: if, for any reason, the web debug toolbar element is not on the page, we should not try to initialize it. It results in:

<img width="431" alt="Screen Shot 2021-05-10 at 3 49 06 PM" src="https://user-images.githubusercontent.com/121003/117716165-429a5f00-b1a7-11eb-9b99-bf08591d2ff4.png">

## To Test

JUST to be on the safe side, I prepared a symfony-demo app with Turbo installed, and using these changes. You can try it here - https://github.com/weaverryan/symfony-demo/tree/turbo - the README is updated to quickly get it running (no need to even run yarn, the JavaScript files are committed).

Thanks!

Commits
-------

47ef65f336 only load Sfjs if it is not present
2021-05-11 08:55:30 +02:00
Nyholm
649d115f0a
feature #36864 [Messenger] Ability to distinguish retry and delay actions (theravel)
This PR was squashed before being merged into the 5.3-dev branch.

Discussion
----------

[Messenger] Ability to distinguish retry and delay actions

Added ability to distinguish retry and delay actions so that different "x-dead-letter-exchange" exchange name will be used in different scenarios.

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        |

This is a bug which existed since v4.4. The following scenario is possible:

- There are two queues: `A` and `B`, both are bound to the same routing key via "topic" exchange (two different applications for example).
- A message is published to this routing key to "topic" exchange.
- Consumer of queue `A` handles it correctly and acknowledges the message.
- Consumer of queue `B` throws and exception and message goes to retry (for example to queue `delay_delays_key_5`).
- Once message expired in `delay_delays_key_5`, it is delivered again to both `A` and `B` (**again** consumed by consumer `A`).

Expected: behavior of consumer `B` should not cause message duplication to queue `A`.

It is required to make a change of name of temporary delay queue (otherwise "delay" and "retry" queues have incompatible declaration arguments). I left `queue_name_pattern` as is to keep settings of connection backward compatible, but changed internals of queue name construction.

Commits
-------

417aaab6ee [Messenger] Ability to distinguish retry and delay actions
2021-05-10 22:46:16 +02:00
theravel
417aaab6ee
[Messenger] Ability to distinguish retry and delay actions 2021-05-10 22:46:04 +02:00
Ryan Weaver
47ef65f336 only load Sfjs if it is not present
Plus, avoid loading the toolbar if it is no longer on the page
2021-05-10 15:50:57 -04:00
Nicolas Grekas
33bfb3d278 minor #40963 [Mailer][Notifier][Translation] Add tests for UnsupportedSchemeException (OskarStark)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[Mailer][Notifier][Translation] Add tests for UnsupportedSchemeException

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets       | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

This way we make sure a third party which is not known by `symfony/translation` can reuse this exception without being part of the `SCHEME_TO_PACKAGE_MAP`.

`@Nyholm` I agree that the exception should not know about the bridges, any ideas? The DX ist great to tell the user a package is missing and can be installed via composer 🤔

### Todos
* [x] add this test for `symfony/notifier`
* [x] add this test for `symfony/mailer`

cc `@welcoMattic`

Commits
-------

48553dac5d Add tests for UnsupportedSchemeException
2021-05-10 18:46:16 +02:00
Oskar Stark
48553dac5d Add tests for UnsupportedSchemeException 2021-05-10 18:43:01 +02:00
Nicolas Grekas
18997ab8d0 bug #41164 [FrameworkBundle] fix debug:event-dispatcher and debug:firewall (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[FrameworkBundle] fix debug:event-dispatcher and debug:firewall

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #40952
| License       | MIT
| Doc PR        | -

Commits
-------

83cd55269c [FrameworkBundle] fix debug:event-dispatcher and debug:firewall
2021-05-10 18:17:16 +02:00
Nicolas Grekas
83cd55269c [FrameworkBundle] fix debug:event-dispatcher and debug:firewall 2021-05-10 18:15:24 +02:00
Nicolas Grekas
8a794d1896 Invalidate phpunit cache on appveyor 2021-05-10 17:19:50 +02:00
Nicolas Grekas
c2ce15d424 minor #41159 [Translation] remove credentials from PoEditorProvider (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[Translation] remove credentials from PoEditorProvider

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

4373d7b945 [Translation] remove credentials from PoEditorProvider
2021-05-10 17:08:55 +02:00
Nicolas Grekas
af10fd9ba2 Merge branch '5.2' into 5.x
* 5.2:
  fix merge
2021-05-10 16:56:30 +02:00
Nicolas Grekas
ddb2d0158d fix merge 2021-05-10 16:56:10 +02:00
Nicolas Grekas
4373d7b945 [Translation] remove credentials from PoEditorProvider 2021-05-10 16:49:13 +02:00
Nicolas Grekas
8ef49cf3b3 feature #41161 [HttpClient] Add DecoratorTrait to ease writing simple decorators (nicolas-grekas)
This PR was merged into the 5.3-dev branch.

Discussion
----------

[HttpClient] Add `DecoratorTrait` to ease writing simple decorators

| Q             | A
| ------------- | ---
| Branch?       | 5.x
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

46821708b0 [HttpClient] Add `DecoratorTrait` to ease writing simple decorators
2021-05-10 16:44:53 +02:00