Commit Graph

27975 Commits

Author SHA1 Message Date
Kévin Dunglas 8c62ecfad2
CODEOWNERS: some more rules 2018-05-30 07:26:26 +02:00
Fabien Potencier fa7bec4816 minor #27418 Remove unneeded comments in tests (fabpot)
This PR was merged into the 2.8 branch.

Discussion
----------

Remove unneeded comments in tests

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| License       | MIT

<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
 - Bug fixes must be submitted against the lowest branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the master branch.
-->

Commits
-------

09c660d454 removed unneeded comments in tests
2018-05-30 06:20:36 +02:00
Fabien Potencier 09c660d454 removed unneeded comments in tests 2018-05-30 06:18:42 +02:00
Fabien Potencier 785b4319ad minor #27402 [HttpFoundation] Change PHPDoc in ResponseHeaderBag::getCookies() to help IDEs (dborsatto)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpFoundation] Change PHPDoc in ResponseHeaderBag::getCookies() to help IDEs

| Q             | A
| ------------- | ---
| Branch?       | master <!-- see below -->
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | none
| License       | MIT
| Doc PR        | none

Hello,

I'm proposing a very small change to `ResponseHeaderBag` in the HttpFoundation component. The change involves changing the PHPDoc return type of `getCookies()` from a simple `array` to `Cookie[]`. This way, IDEs will play nicely and understand that the returned value is in fact an array of Cookie objects. This is the current behavior:

![Before PR](https://user-images.githubusercontent.com/94651/40648899-d6690f84-632f-11e8-8e43-e09d71b9ccec.png)

whereas with the proposed change, the IDE correctly understands the type:

![After PR](https://user-images.githubusercontent.com/94651/40648980-109621c4-6330-11e8-8ead-f176307e5bda.png)

Commits
-------

479aa9074b Change PHPDoc in ResponseHeaderBag::getCookies() to help IDEs
2018-05-29 13:31:42 +02:00
Davide Borsatto 479aa9074b Change PHPDoc in ResponseHeaderBag::getCookies() to help IDEs 2018-05-29 13:28:37 +02:00
Fabien Potencier 518ec864e9 bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (kmadejski)
This PR was squashed before being merged into the 2.8 branch (closes #26973).

Discussion
----------

[HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer.

| Q             | A
| ------------- | ---
| Branch?       | 2.7 and up
| Bug fix?      | improvement
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | ---
| License       | MIT
| Doc PR        | ---

SubRequest used in `InlineFragmentRendered` explicitly sets `$server['REMOTE_ADDR']` to `127.0.0.1`. Therefore, it's required to configure `127.0.0.1` address in TRUSTED_PROXIES environment variable. Without that, `Request::isFromTrustedProxy()` will return false.
The current behavior might be a little bit problematic, for instance, in case where images are rendered through subrequests. These might end-up with an incorrect schema in URL (`http` instead of `https`).

Commits
-------

18f55feef8 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer.
2018-05-27 09:44:41 +02:00
Kamil Madejski 18f55feef8 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. 2018-05-27 09:44:31 +02:00
Fabien Potencier dc0ac87b89 bug #27303 [Process] Consider "executable" suffixes first on Windows (sanmai)
This PR was squashed before being merged into the 2.8 branch (closes #27303).

Discussion
----------

[Process] Consider "executable" suffixes first on Windows

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | n/a

Executable finder should consider "executable" suffixes first on Windows because we basically ignore executability on Windows (on the lines below changed), which leads, for example, to finding usually-non-executable `phpunit` file first where both `phpunit` and `phpunit.bat` are present.

I may miss something here, so please tell me if this makes any sense.

Same change against master: #27301

Commits
-------

9372e7a813 [Process] Consider \"executable\" suffixes first on Windows
2018-05-27 09:40:52 +02:00
Alexey Kopytko 9372e7a813 [Process] Consider \"executable\" suffixes first on Windows 2018-05-27 09:40:41 +02:00
Fabien Potencier 148e7eff50 bug #27297 Triggering RememberMe's loginFail() when token cannot be created (weaverryan)
This PR was submitted for the 2.7 branch but it was merged into the 2.8 branch instead (closes #27297).

Discussion
----------

Triggering RememberMe's loginFail() when token cannot be created

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no (but minor behavior change)
| Deprecations? | no->
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | not needed

This is an edge-case bug fix. If, for example, someone tampers with the remember me cookie, and so it is invalid, this causes the `->autoLogin()` call to throw an `AuthenticationException`. But, this did not call the `loginFail()` method.

Honestly, I'm not sure if the old or new behavior is correct. But, we should discuss and merge or close.

Commits
-------

e3412e6a67 Triggering RememberMe's loginFail() when token cannot be created
2018-05-27 09:16:38 +02:00
Ryan Weaver e3412e6a67 Triggering RememberMe's loginFail() when token cannot be created 2018-05-27 09:16:31 +02:00
Nicolas Grekas 4279f53e34 bug #27366 [DI] never inline lazy services (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[DI] never inline lazy services

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | no
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Should apply also:
- to deprecated services since 2.8
- to errored services since 3.4

Commits
-------

3b4d7ab56c [DI] never inline lazy services
2018-05-25 16:36:25 +02:00
Nicolas Grekas 9c089b3f09 minor #27355 Add code of Conduct links in our README (javiereguiluz)
This PR was submitted for the 2.7 branch but it was merged into the 2.8 branch instead (closes #27355).

Discussion
----------

Add code of Conduct links in our README

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | no
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | -   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | - <!-- required for new features -->

Commits
-------

40e59a6415 Add code of Conduct links in our README
2018-05-25 16:34:13 +02:00
Javier Eguiluz 40e59a6415 Add code of Conduct links in our README 2018-05-25 16:34:01 +02:00
Nicolas Grekas 3b4d7ab56c [DI] never inline lazy services 2018-05-25 15:50:34 +02:00
Nicolas Grekas 586b1231f8 minor #27370 Default testsuite to latest PHPUnit 6.* (ostrolucky)
This PR was submitted for the 2.7 branch but it was merged into the 2.8 branch instead (closes #27370).

Discussion
----------

Default testsuite to latest PHPUnit 6.*

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Necessary to fix each() function deprecation calls introduced in PHP 7.2

![obrazok](https://user-images.githubusercontent.com/496233/40514525-b6099d64-5fa9-11e8-906b-ccd8c358b5a5.png)

Commits
-------

37e543329a Default testsuite to latest PHPUnit 6.*
2018-05-25 15:04:14 +02:00
Gabriel Ostrolucký 37e543329a Default testsuite to latest PHPUnit 6.*
Necessary to fix each() function deprecation calls introduced in PHP 7.2
2018-05-25 15:04:04 +02:00
Nicolas Grekas 2fd6ab9b02 minor #27376 [Github] Update the pull-request template (sroze)
This PR was squashed before being merged into the 2.8 branch (closes #27376).

Discussion
----------

[Github] Update the pull-request template

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | ø
| License       | MIT
| Doc PR        | ø

2.7 is end of life.

Commits
-------

99327a6153 [Github] Update the pull-request template
2018-05-25 15:02:56 +02:00
Samuel ROZE 99327a6153 [Github] Update the pull-request template 2018-05-25 15:02:46 +02:00
Fabien Potencier 37846d453a bumped Symfony version to 2.8.42 2018-05-25 14:30:40 +02:00
Fabien Potencier 24fc640d54
Merge pull request #27375 from fabpot/release-2.8.41
released v2.8.41
2018-05-25 14:03:11 +02:00
Fabien Potencier 786970f17d updated VERSION for 2.8.41 2018-05-25 14:02:50 +02:00
Fabien Potencier ef0b5004f8 updated CHANGELOG for 2.8.41 2018-05-25 14:02:41 +02:00
Fabien Potencier ca6cc78c7e Merge branch '2.7' into 2.8
* 2.7:
  [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization
2018-05-25 13:00:14 +02:00
Fabien Potencier ab32125187 bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas)
This PR was merged into the 2.7 branch.

Discussion
----------

[HttpFoundation] Fix perf issue during MimeTypeGuesser intialization

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #27307
| License       | MIT
| Doc PR        | -

introduced in #26886

![image](https://user-images.githubusercontent.com/243674/40451947-918f5358-5ee0-11e8-9f1a-cf707bf3cefa.png)

Commits
-------

f8e7a18d1b [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization
2018-05-25 12:53:06 +02:00
Fabien Potencier 2ed0cedb19 fixed constraints 2018-05-25 09:32:23 +02:00
Fabien Potencier 43a0affb8f Merge branch '2.7' into 2.8
* 2.7:
  fixed constraints
  bumped dep
  bumped dep
2018-05-25 08:52:49 +02:00
Fabien Potencier 2f34263a1a fixed constraints 2018-05-25 08:35:17 +02:00
Fabien Potencier 1151ab28c0 bumped dep 2018-05-25 08:20:37 +02:00
Fabien Potencier 87153549f6 bumped dep 2018-05-25 07:45:02 +02:00
Christian Flothmann 32c73a71a7 fixtures config fix 2018-05-24 20:59:44 +02:00
Fabien Potencier 6d455f224b Merge branch '2.7' into 2.8
* 2.7:
  [SecurityBundle] Fail if security.http_utils cannot be configured
2018-05-24 15:22:57 +02:00
Fabien Potencier b20e83562e security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured
* cve-2018-11408-2.7:
  [SecurityBundle] Fail if security.http_utils cannot be configured
2018-05-24 15:22:46 +02:00
Nicolas Grekas c003b7a247 [SecurityBundle] Fail if security.http_utils cannot be configured 2018-05-24 15:22:37 +02:00
Fabien Potencier 2111742676 Merge branch '2.7' into 2.8
* 2.7:
  clear CSRF tokens when the user is logged out
2018-05-24 14:58:29 +02:00
Fabien Potencier 319e1bdd43 security #cve-2018-11406 clear CSRF tokens when the user is logged out
* cve-2018-11406-2.7:
  clear CSRF tokens when the user is logged out
2018-05-24 14:39:56 +02:00
Christian Flothmann 4b91c171af clear CSRF tokens when the user is logged out 2018-05-24 14:39:52 +02:00
Nicolas Grekas f8e7a18d1b [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization 2018-05-23 23:23:26 +02:00
Fabien Potencier fad1e1f2ea security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation
* cve-2018-11385-2.8:
  Adding session authentication strategy to Guard to avoid session fixation
2018-05-23 15:51:54 +02:00
Ryan Weaver f2e83ba44d Adding session authentication strategy to Guard to avoid session
fixation
2018-05-23 15:51:48 +02:00
Fabien Potencier a1a5fa8b2f Merge branch '2.7' into 2.8
* 2.7:
  Adding session strategy to ALL listeners to avoid *any* possible fixation
2018-05-23 15:51:01 +02:00
Fabien Potencier fa5bf4b17d security #cve-2018-11385 Adding session strategy to ALL listeners to avoid *any* possible fixation
* cve-2018-11385-2.7:
  Adding session strategy to ALL listeners to avoid *any* possible fixation
2018-05-23 15:50:13 +02:00
Ryan Weaver a5855e8c97 Adding session strategy to ALL listeners to avoid *any* possible
fixation
2018-05-23 15:49:30 +02:00
Fabien Potencier abc802390b Merge branch '2.7' into 2.8
* 2.7:
  [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
2018-05-23 15:29:24 +02:00
Fabien Potencier a75781cc29 Merge branch '2.7' into 2.8
* 2.7:
  bumped Symfony version to 2.7.48
  updated VERSION for 2.7.47
  update CONTRIBUTORS for 2.7.47
  updated CHANGELOG for 2.7.47
2018-05-23 15:24:13 +02:00
Fabien Potencier 47e72683c6 security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
* cve-2018-11386:
  [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
2018-05-23 15:15:59 +02:00
Nicolas Grekas 0cf874e23e [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode 2018-05-23 14:36:15 +02:00
Fabien Potencier 6d4de55666 bumped Symfony version to 2.8.41 2018-05-21 15:43:22 +02:00
Fabien Potencier 901a4fb385
Merge pull request #27328 from fabpot/release-2.8.40
released v2.8.40
2018-05-21 15:17:42 +02:00
Fabien Potencier ca80b59dc1 updated VERSION for 2.8.40 2018-05-21 15:17:29 +02:00