Commit Graph

703 Commits

Author SHA1 Message Date
Maxime STEINHAUSSER
880a392d37 [Security] Fix deprecated usage of DigestAuthenticationEntryPoint::getKey() in DigestAuthenticationListener 2016-07-08 11:55:21 +02:00
Fabien Potencier
bd1e3e3093 Merge branch '2.7' into 2.8
* 2.7:
  removed dots at the end of @param and @return
  fixed typo
2016-06-29 07:29:29 +02:00
Fabien Potencier
554303e339 removed dots at the end of @param and @return 2016-06-28 08:24:06 +02:00
Fabien Potencier
6d20ceee90 Merge branch '2.7' into 2.8
* 2.7:
  limited the maximum length of a submitted username
2016-05-09 14:24:00 -05:00
Fabien Potencier
60bf201eba Merge branch '2.3' into 2.7
* 2.3:
  limited the maximum length of a submitted username
2016-05-09 14:23:35 -05:00
Fabien Potencier
f8dc28ae53 limited the maximum length of a submitted username 2016-05-09 13:29:33 -05:00
Christian Flothmann
ed9c94c719 Merge branch '2.7' into 2.8
* 2.7:
  [Filesystem] Better error handling in remove()
  [DependencyInjection] Add coverage for invalid Expression in exportParameters
  [DependencyInjection] Add coverage for all invalid arguments in exportParameters
  anonymous services are always private
  [Console] Correct time formatting.
  [DependencyInjection] Resolve aliases before removing abstract services + add tests
  Fix Dom Crawler select option with empty value
  Remove unnecessary option assignment
  remove unused variable
  mock the proper method
  [PropertyAccess] Fix regression
2016-04-12 20:01:21 +02:00
Christian Flothmann
064aedf9e3 Merge branch '2.3' into 2.7
* 2.3:
  [DependencyInjection] Resolve aliases before removing abstract services + add tests
  Fix Dom Crawler select option with empty value
  Remove unnecessary option assignment
  remove unused variable
  [PropertyAccess] Fix regression
2016-04-09 12:56:56 +02:00
Christian Flothmann
4b78d03379 mock the proper method 2016-04-05 20:28:19 +02:00
Fabien Potencier
16ac46be44 Merge branch '2.7' into 2.8
* 2.7:
  [HttpFoundation] Improve phpdoc
  [Logging] Add support for firefox in ChromePhpHandler
  Windows 10 version check in just one line
  Detect CLI color support for Windows 10 build 10586
  [Security] Fixed SwitchUserListener when exiting an impersonication with AnonymousToken
  [EventDispatcher] Try first if the event is Stopped
  [FrameworkBundle] fixes grammar in container:debug command manual.
  [Form] fix "prototype" not required when parent form is not required
2016-04-05 18:36:54 +02:00
Fabien Potencier
034f47635c Merge branch '2.3' into 2.7
* 2.3:
  [HttpFoundation] Improve phpdoc
  [Logging] Add support for firefox in ChromePhpHandler
  [Security] Fixed SwitchUserListener when exiting an impersonication with AnonymousToken
  [Form] fix "prototype" not required when parent form is not required
2016-04-05 18:36:43 +02:00
Grégoire Pineau
59fea72a43 [Security] Fixed SwitchUserListener when exiting an impersonication with AnonymousToken
If you configure a firewall with switch user with `role: IS_AUTHENTICATED_ANONYMOUSLY` it's impossible to exit the
impersonation because the next line `$this->provider->refreshUser($original->getUser())` will fail. It fails because `RefreshUser`
expects an instance of `UserInterface` and here it's a string.

Therefore, it does not make sense to refresh an Anonymous Token, right ?
2016-04-04 14:27:18 +02:00
Christian Flothmann
d9be1b4cc4 fix mocks
* check for existance of `setMetadataFactory()` method (this is needed
  for tests run with deps=high as the method was removed in Symfony
  3.0)
* fix mock testing the `EngineInterface` as the `stream()` method cannot
  be mocked when it is does not exist in the mocked interface
2016-03-25 16:52:47 +01:00
Nicolas Grekas
c1ca48765e Merge branch '2.3' into 2.7
* 2.3:
  fix mocks

Conflicts:
	src/Symfony/Component/Security/Http/Tests/Firewall/SwitchUserListenerTest.php
2016-03-25 16:39:22 +01:00
Nicolas Grekas
5500fe7104 Merge branch '2.7' into 2.8
* 2.7:
  [HttpFoundation] Fix transient test
  [HttpFoundation] Add a dependency on the mbstring polyfill
  [2.7] update readme files for new components
  add readme files where missing
  fix lowest TwigBridge deps versions
  [EventDispatcher] fix syntax error
  Don't use reflections when possible
  Don't use reflections when possible
  [Form] Update form tests after the ICU data update
  [Intl] Update tests and the number formatter to match behaviour of the intl extension
  [Intl] Update the ICU data to version 55
  [Intl] Fix the update-data.php script in preparation for ICU 5.5
  [Process] Fix memory issue when using large input streams
  Use constant instead of function call.
  fixed test name
  automatically generate safe fallback filename
  [Console] default to stderr in the console helpers

Conflicts:
	composer.json
	src/Symfony/Bridge/PhpUnit/README.md
	src/Symfony/Bridge/Twig/composer.json
	src/Symfony/Component/Console/Helper/DialogHelper.php
	src/Symfony/Component/Debug/DebugClassLoader.php
	src/Symfony/Component/HttpFoundation/composer.json
	src/Symfony/Component/Security/Acl/README.md
	src/Symfony/Component/Security/Core/README.md
	src/Symfony/Component/Security/Csrf/README.md
	src/Symfony/Component/Security/Http/README.md
2016-03-07 15:04:32 +01:00
Christian Flothmann
5ba194ec52 [2.7] update readme files for new components 2016-03-07 12:06:07 +01:00
Nicolas Grekas
ab1fab2911 Merge branch '2.7' into 2.8
* 2.7:
  [Console] Add missing `@require` annotation in test
  Fix merge
  [appveyor] Fix failure reporting
  [#17634] move DebugBundle license file
  backport GlobTest from 2.7 branch
  Move licenses according to new best practices
  [FrameworkBundle] Remove unused code in test
  [2.3] Fixed an undefined variable in Glob::toRegex
  simplified a test
  fix container cache key generation
  [Form] fix option name in changelog
  [Translation] Add resources from fallback locale
  [DependencyInjection] enforce tags to have a name
  [YAML] Refine the return value of Yaml::parse()

Conflicts:
	src/Symfony/Component/DependencyInjection/Tests/Loader/YamlFileLoaderTest.php
2016-02-02 10:49:18 +01:00
Nicolas Grekas
fc5e80c0cb Merge branch '2.3' into 2.7
* 2.3:
  [appveyor] Fix failure reporting
2016-02-01 21:45:15 +01:00
Fabien Potencier
6704f62b4d Merge branch '2.7' into 2.8
* 2.7:
  Increase the inlining YAML level for config:debug
  [Serializer] Minor: fix CS and PHPDoc
  [Form] fix tests
  [Serializer] Ensure that groups are strings
  [Debug] Tell that the extension is for PHP 5 only
  Static code analysis
  Update AnnotationDirectoryLoader.php
  added a test
  Escape the delimiter in Glob::toRegex
  [FrameworkBundle] Fix template location for PHP templates
  [FrameworkBundle] Add path verification to the template parsing test cases
2016-01-27 06:14:19 +01:00
Fabien Potencier
1876b4f1c8 Merge branch '2.3' into 2.7
* 2.3:
  Static code analysis
  Update AnnotationDirectoryLoader.php
  [FrameworkBundle] Fix template location for PHP templates
  [FrameworkBundle] Add path verification to the template parsing test cases
2016-01-27 06:09:39 +01:00
Fabien Potencier
4ed54a39ab Merge branch '2.7' into 2.8
* 2.7:
  Typo fix
  [2.3] Static Code Analysis for Components
  Added support \IteratorAggregate for UniqueEntityValidator
  Update AbstractChoiceListTest.php
  Fix #17306 Paths with % in it are note allowed (like urlencoded)
  Use proper class to fetch $versionStrategy property
  Added sort order SORT_STRING for params in UriSigner
  Remove normalizer cache in Serializer class
2016-01-12 18:46:01 +01:00
Fabien Potencier
da655a9368 Merge branch '2.3' into 2.7
* 2.3:
  Typo fix
  [2.3] Static Code Analysis for Components
  Added support \IteratorAggregate for UniqueEntityValidator
  Fix #17306 Paths with % in it are note allowed (like urlencoded)
  Added sort order SORT_STRING for params in UriSigner
  Remove normalizer cache in Serializer class
2016-01-12 18:44:11 +01:00
Vladimir Reznichenko
81f81812a5 [2.3] Static Code Analysis for Components 2016-01-12 12:31:34 +01:00
Fabien Potencier
0606d9c8b4 Merge branch '2.7' into 2.8
* 2.7:
  updated copyright year
  Update copyright year
  [2.3] Static Code Analysis for Components
2016-01-03 16:33:41 +01:00
Fabien Potencier
6dbef8ccb8 updated copyright year 2016-01-03 16:33:06 +01:00
Nicolas Grekas
6cc5756d8b Merge branch '2.7' into 2.8
* 2.7:
  prefer phpunit 5.x on hhvm
  [FrameworkBundle][HttpKernel] the finder is required to discover bundle commands
  [travis] Auto-conf deps=high matrix line
  Fix the logout path when not using the router
  Fix the logout path when not using the router
  [Form] cast IDs to match deprecated behaviour of EntityChoiceList
  [HttpFoundation] Added the ability of mapping stream wrapper protocols when using X-Sendfile
  [HttpFoundation] Add a test case for using BinaryFileResponse with stream wrappers

Conflicts:
	.travis.yml
	src/Symfony/Bundle/FrameworkBundle/composer.json
2015-12-18 16:38:35 +01:00
Christophe Coevoet
542b877424 Fix the logout path when not using the router
This needs to use the base url, not the base path, so that it goes
through the front controller when not using url rewriting.
2015-12-17 14:04:43 +01:00
Tobias Schultze
3a57b77bc7 Merge branch '2.7' into 2.8 2015-12-15 02:39:37 +01:00
Tobias Schultze
88d586b447 Merge branch '2.3' into 2.7 2015-12-15 02:31:17 +01:00
Hugo Hamon
cab6fd531e [Security] backported phpdoc from Guard component. 2015-12-10 09:14:03 +01:00
Jakub Zalas
04508658b5 [Security][SecurityBundle] Use csrf_token_id instead of deprecated intention 2015-11-28 16:40:40 +01:00
Fabien Potencier
0cb308f634 minor #16697 CS: remove impossible default argument value (keradus)
This PR was merged into the 2.7 branch.

Discussion
----------

CS: remove impossible default argument value

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | ?
| Fixed tickets | N/A
| License       | MIT
| Doc PR        | N/A

Commits
-------

acef3a3 CS: remove impossible default argument value
2015-11-28 11:22:51 +01:00
Dariusz Ruminski
acef3a3b34 CS: remove impossible default argument value 2015-11-26 23:11:33 +01:00
Fabien Potencier
2dbb75aef4 removed usage of the deprecated StringUtils::equals() method 2015-11-23 11:39:33 +01:00
Fabien Potencier
8a6da3f021 Merge branch '2.7' into 2.8
* 2.7:
  fixed tests
  migrate session after remember me authentication
  prevent timing attacks in digest auth listener
  mitigate CSRF timing attack vulnerability
  fix potential timing attack issue
2015-11-23 11:34:41 +01:00
Fabien Potencier
5edc71e2fc Merge branch '2.3' into 2.7
* 2.3:
  migrate session after remember me authentication
  prevent timing attacks in digest auth listener
  mitigate CSRF timing attack vulnerability
  fix potential timing attack issue
2015-11-23 11:34:14 +01:00
Fabien Potencier
f95078c409 security #16631 n/a (xabbuh)
This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

f88e600 migrate session after remember me authentication
2015-11-23 11:22:15 +01:00
Christian Flothmann
f88e600833 migrate session after remember me authentication 2015-11-23 11:04:06 +01:00
Christian Flothmann
819aa54fe4 prevent timing attacks in digest auth listener 2015-11-23 11:02:49 +01:00
Christian Flothmann
f1fd7686c5 fix potential timing attack issue 2015-11-23 11:02:49 +01:00
Nicolas Grekas
ecdd681898 Merge branch '2.7' into 2.8
* 2.7:
  Fix undefined array $server
  Fix bug in windows detection
  [ProxyManager] Tmp fix composer reqs issue in ZF
  Add missing exclusions from phpunit.xml.dist
  [Serializer] ObjectNormalizer: don't serialize static methods and props
  Fix the server variables in the router_*.php files
  [Validator] Allow an empty path with a non empty fragment or a query
  The following change adds support for Armenian pluralization.
  [2.3][Process] fix Proccess run with pts enabled

Conflicts:
	composer.json
	src/Symfony/Bridge/ProxyManager/composer.json
	src/Symfony/Component/Security/phpunit.xml.dist
2015-11-18 14:45:00 +01:00
Nicolas Grekas
a8d21b5ca9 Merge branch '2.3' into 2.7
* 2.3:
  Fix undefined array $server
  [ProxyManager] Tmp fix composer reqs issue in ZF
  Add missing exclusions from phpunit.xml.dist
  Fix the server variables in the router_*.php files
  [Validator] Allow an empty path with a non empty fragment or a query
  The following change adds support for Armenian pluralization.
  [2.3][Process] fix Proccess run with pts enabled

Conflicts:
	composer.json
	src/Symfony/Bridge/ProxyManager/composer.json
	src/Symfony/Bundle/DebugBundle/phpunit.xml.dist
	src/Symfony/Component/Security/phpunit.xml.dist
2015-11-18 14:41:01 +01:00
WouterJ
55f59d55a2 Renamed key to secret 2015-11-07 18:34:16 +01:00
Fabien Potencier
a15c9eb82d Merge branch '2.7' into 2.8
* 2.7:
  added the new Composer exclude-from-classmap option
  added the new Composer exclude-from-classmap option
  fix expected argument type docblock
  Set back libxml settings after testings.
  fixed Twig deprecation notices
2015-10-30 13:15:42 -07:00
Fabien Potencier
6d0e05cd1d added the new Composer exclude-from-classmap option 2015-10-30 13:13:17 -07:00
Nicolas Grekas
303f05baaf Rely on iconv and symfony/polyfill-* 2015-10-28 03:15:07 +01:00
Tobias Schultze
912fc4de8f [Routing] deprecate the old url generator reference type values 2015-10-18 22:34:15 +02:00
Fabien Potencier
945630a8fa Merge branch '2.7' into 2.8
* 2.7:
  [Routing] use constants in tests
  [Process] tweaked README
  [Validator] Allow an empty path in a URL with only a fragment or a query
  [HttpFoundation] Fix some typo in the Request doc
  fixed CS
  Added separated handling of root paths
2015-10-18 22:23:24 +02:00
Fabien Potencier
fa6c58c90d Merge branch '2.3' into 2.7
* 2.3:
  [Routing] use constants in tests
  [Validator] Allow an empty path in a URL with only a fragment or a query
  [HttpFoundation] Fix some typo in the Request doc
  fixed CS
  Added separated handling of root paths
2015-10-18 22:23:18 +02:00
Fabien Potencier
6f48ec5be6 Merge branch '2.7' into 2.8
* 2.7:
  [TwigBundle] Fix Twig cache is not properly warmed
  [Security] Use SessionAuthenticationStrategy on RememberMe login
2015-10-17 17:40:24 +02:00