Commit Graph

37563 Commits

Author SHA1 Message Date
Nicolas Grekas
96504fb8c9 Merge branch '4.0' into 4.1
* 4.0:
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
2018-08-01 16:07:44 +02:00
Nicolas Grekas
974240e178 Merge branch '3.4' into 4.0
* 3.4:
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
2018-08-01 16:06:38 +02:00
Nicolas Grekas
bcf5897bb1 Merge branch '2.8' into 3.4
* 2.8:
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
2018-08-01 16:04:26 +02:00
Nicolas Grekas
0f7667d643 security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (nicolas-grekas)
* commit '725dee4cd8':
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
2018-08-01 15:48:20 +02:00
Nicolas Grekas
725dee4cd8 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer 2018-08-01 15:47:49 +02:00
Nicolas Grekas
bde8a7fca4 Merge branch '4.0' into 4.1
* 4.0:
  [HttpFoundation] Remove support for legacy and risky HTTP headers
2018-08-01 10:41:27 +02:00
Nicolas Grekas
45d6729ddc Merge branch '3.4' into 4.0
* 3.4:
  [HttpFoundation] Remove support for legacy and risky HTTP headers
2018-08-01 10:38:58 +02:00
Nicolas Grekas
768abbfe64 Merge branch '2.8' into 3.4
* 2.8:
  [HttpFoundation] Remove support for legacy and risky HTTP headers
2018-08-01 10:38:11 +02:00
Nicolas Grekas
6604978f83 security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (nicolas-grekas)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpFoundation] Remove support for legacy and risky HTTP headers

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

e447e8b921 [HttpFoundation] Remove support for legacy and risky HTTP headers
2018-08-01 10:34:59 +02:00
Nicolas Grekas
1d3f835e05 Merge branch '4.0' into 4.1
* 4.0:
  [HttpKernel] Fixed invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet
  [FrameworkBundle] fixed guard event names for transitions
  [DI] Improve class named servics error message
  [HttpFoundation] fixed using _method parameter with invalid type
  [Intl] Replace svn with git in the icu data update script
  [HttpFoundation] Fix Cookie::isCleared
2018-08-01 10:24:03 +02:00
Nicolas Grekas
e0ce427aef Merge branch '3.4' into 4.0
* 3.4:
  [HttpKernel] Fixed invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet
  [FrameworkBundle] fixed guard event names for transitions
  [DI] Improve class named servics error message
  [HttpFoundation] fixed using _method parameter with invalid type
  [Intl] Replace svn with git in the icu data update script
  [HttpFoundation] Fix Cookie::isCleared
2018-08-01 10:23:45 +02:00
Nicolas Grekas
e447e8b921 [HttpFoundation] Remove support for legacy and risky HTTP headers 2018-07-31 23:38:46 +02:00
Nicolas Grekas
7e3603dc38 Merge branch '2.8' into 3.4
* 2.8:
  [HttpKernel] Fixed invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet
  [HttpFoundation] fixed using _method parameter with invalid type
  [Intl] Replace svn with git in the icu data update script
  [HttpFoundation] Fix Cookie::isCleared
2018-07-31 11:47:14 +02:00
Nicolas Grekas
9d0ff4f22a bug #28003 [HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet (netiul)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28000    <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | n/a

When trusted proxies are configured including a subnet a subrequest initiated by the InlineFragmentRenderer would contain an invalid REMOTE_ADDR server variable.

Commits
-------

f657dd2444 [HttpKernel] Fixed invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet
2018-07-31 11:44:51 +02:00
Zacharias Luiten
f657dd2444 [HttpKernel] Fixed invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet 2018-07-31 11:18:51 +02:00
Nicolas Grekas
4081bc6a50 bug #28007 [FrameworkBundle] fixed guard event names for transitions (destillat)
This PR was submitted for the 3.3 branch but it was merged into the 3.4 branch instead (closes #28007).

Discussion
----------

[FrameworkBundle] fixed guard event names for transitions

| Q             | A
| ------------- | ---
| Branch?       | 3.3|4
| Bug fix?      | yes
| New feature?  |no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Framework yaml configuration support workflow transitions as both indexed and associative array e.g
```yaml
transitions:
    -    name: test
         from: open
         to: test
    -
```
```yaml
transitions:
    test:
         from: open
         to: test
```
Then it's used in foreach loop to register guard event listeners 4b92b96796/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php (L609)
Array keys are used as transition names but it's wrong for indexed array so we get event names like these
workflow.workflow_name.guard.transition_index instead of workflow.workflow_name.guard.tranision_name

Commits
-------

9bbb1e5cff [FrameworkBundle] fixed guard event names for transitions
2018-07-29 17:24:27 +02:00
Ivan Nikolaev
9bbb1e5cff [FrameworkBundle] fixed guard event names for transitions 2018-07-29 17:24:21 +02:00
Nicolas Grekas
f4951682bf minor #28057 [DI] Improve class named servics error message (ro0NL)
This PR was squashed before being merged into the 3.4 branch (closes #28057).

Discussion
----------

[DI] Improve class named servics error message

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #28006
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

Commits
-------

61de0601a1 [DI] Improve class named servics error message
2018-07-29 17:19:31 +02:00
Roland Franssen
61de0601a1 [DI] Improve class named servics error message 2018-07-29 17:19:21 +02:00
Nicolas Grekas
81eb54eb78 bug #28045 [HttpFoundation] Fix Cookie::isCleared (ro0NL)
This PR was merged into the 2.8 branch.

Discussion
----------

[HttpFoundation] Fix Cookie::isCleared

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #27946
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
 - Bug fixes must be submitted against the lowest branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the master branch.
-->

Commits
-------

d3d7766874 [HttpFoundation] Fix Cookie::isCleared
2018-07-29 17:16:40 +02:00
Nicolas Grekas
329d3f7cd7 minor #28066 [HttpFoundation] Remove unnecessary condition in MongoDbSessionHandler (raplider)
This PR was submitted for the 4.0 branch but it was merged into the 4.1 branch instead (closes #28066).

Discussion
----------

[HttpFoundation] Remove unnecessary condition in MongoDbSessionHandler

| Q             | A
| ------------- | ---
| Branch?       | 4.0
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
 - Bug fixes must be submitted against the lowest branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the master branch.
-->

Commits
-------

3f013a473a remove unnecessary instanceof in MongoDbSessionHandler
2018-07-29 17:15:13 +02:00
raplider
3f013a473a remove unnecessary instanceof in MongoDbSessionHandler 2018-07-29 17:15:07 +02:00
Nicolas Grekas
8e5bc07a51 minor #28067 [Intl] Replace svn with git in the icu data update script (jakzal)
This PR was merged into the 2.8 branch.

Discussion
----------

[Intl] Replace svn with git in the icu data update script

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Quoting http://site.icu-project.org/repository:

> Announcement 07/16/2018: The ICU source code repository has been migrated from Subversion to Git, and is now hosted on GitHub at the following location: https://github.com/unicode-org/icu.

The icu update script will from now on:
* use git
* fetch the latest release tag (no need to maintain the list anymore)

I rebuilt the data files, but since no new ICU releases has been made, none of files were actually updated.

Commits
-------

ebdf972e49 [Intl] Replace svn with git in the icu data update script
2018-07-29 17:14:19 +02:00
Nicolas Grekas
86dd8dbfdd bug #28080 [HttpFoundation] fixed using _method parameter with invalid type (Phobetor)
This PR was squashed before being merged into the 2.8 branch (closes #28080).

Discussion
----------

[HttpFoundation] fixed using _method parameter with invalid type

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28079
| License       | MIT
| Doc PR        | -

This change makes sure that an incoming `_method` parameter is only used when it is a string value.

Commits
-------

63583debd2 [HttpFoundation] fixed using _method parameter with invalid type
2018-07-29 17:13:15 +02:00
Phobetor
63583debd2 [HttpFoundation] fixed using _method parameter with invalid type 2018-07-29 17:13:09 +02:00
Nicolas Grekas
a804b915f7 minor #28082 Renaming internal test class to help auto-completion (weaverryan)
This PR was merged into the 4.1 branch.

Discussion
----------

Renaming internal test class to help auto-completion

| Q             | A
| ------------- | ---
| Branch?       | 4.1
| Bug fix?      | yes-ish
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no->
| Tests pass?   | yes
| Fixed tickets | none
| License       | MIT
| Doc PR        | not needed

This fixes auto-completion issues in IDE's: when you start typing `AbstractContro...` it gives you two choices. Let's avoid calling test classes the same name as real classes when possible :).

Commits
-------

b5ffb305a7 Renaming internal test class to help auto-completion
2018-07-29 17:08:24 +02:00
Ryan Weaver
b5ffb305a7 Renaming internal test class to help auto-completion 2018-07-27 10:58:22 -04:00
Samuel ROZE
afb17aba09 bug #28059 [Messenger] Fix error message on undefined message class for non-subscriber handler (chalasr)
This PR was merged into the 4.1 branch.

Discussion
----------

[Messenger] Fix error message on undefined message class for non-subscriber handler

| Q             | A
| ------------- | ---
| Branch?       | 4.1
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Fixes a wrong hint talking about `getHandledMessages()` while the handler does not implement `MessageSubscriberInterface`.

Commits
-------

e5ea3bc032 [Messenger] Fix error message on undefined message class for non-subscriber handler
2018-07-26 22:05:42 +01:00
Jakub Zalas
ebdf972e49
[Intl] Replace svn with git in the icu data update script 2018-07-26 17:13:28 +01:00
Nicolas Grekas
0e07ee1a4b Merge branch '4.0' into 4.1
* 4.0:
  Fix tests for legacy phpunit versions
2018-07-26 14:00:37 +02:00
Nicolas Grekas
4fadd36072 Merge branch '3.4' into 4.0
* 3.4:
  Fix tests for legacy phpunit versions
2018-07-26 13:59:25 +02:00
Nicolas Grekas
d0eef33763 Fix tests for legacy phpunit versions 2018-07-26 13:58:24 +02:00
Nicolas Grekas
c4d10c4d4d Merge branch '4.0' into 4.1
* 4.0:
  Enable native_constant_invocation CS fixer
2018-07-26 13:24:31 +02:00
Nicolas Grekas
b5143233d2 Merge branch '3.4' into 4.0
* 3.4:
  Enable native_constant_invocation CS fixer
2018-07-26 13:22:46 +02:00
Nicolas Grekas
f569f58b66 Merge branch '2.8' into 3.4
* 2.8:
  Enable native_constant_invocation CS fixer
2018-07-26 13:19:56 +02:00
Nicolas Grekas
2ba0fa4a14 Enable native_constant_invocation CS fixer 2018-07-26 13:13:39 +02:00
Nicolas Grekas
091c5f690d Merge branch '4.0' into 4.1
* 4.0:
  Fix tests for legacy phpunit versions
  Add missing Ukrainian translations
  Use an empty string as default for assertEquals
2018-07-26 13:00:49 +02:00
Nicolas Grekas
7e01f9b138 Merge branch '3.4' into 4.0
* 3.4:
  Fix tests for legacy phpunit versions
  Add missing Ukrainian translations
  Use an empty string as default for assertEquals
2018-07-26 13:00:39 +02:00
Nicolas Grekas
dcdd803f40 Merge branch '2.8' into 3.4
* 2.8:
  Add missing Ukrainian translations
2018-07-26 12:58:10 +02:00
Nicolas Grekas
bf7e25f759 Fix tests for legacy phpunit versions 2018-07-26 12:58:07 +02:00
Nicolas Grekas
af5f7d34ba minor #28025 Use an empty string as default for assertEquals (DavidPrevot)
This PR was merged into the 3.4 branch.

Discussion
----------

Use an empty string as default for assertEquals

Make sure it isn’t interpreted as a type NULL, making the test fail with PHPUnit 7.2.

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

This shouldn’t break the existing tests, but will also make them work with recent PHPUnit.

Commits
-------

31353147a3 Use an empty string as default for assertEquals
2018-07-26 12:03:52 +02:00
Nicolas Grekas
2f6125f4cc minor #28034 [Validator] Add missing Ukrainian translations (azhurb)
This PR was merged into the 2.8 branch.

Discussion
----------

[Validator] Add missing Ukrainian translations

| Q             | A
| ------------- | ---
| Branch?       | 2.8 <!-- see below -->
| Bug fix?      | yes
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| License       | MIT

Add missing Ukrainian translations.

<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
 - Bug fixes must be submitted against the lowest branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the master branch.
-->

Commits
-------

b7d55ede15 Add missing Ukrainian translations
2018-07-26 11:27:25 +02:00
Nicolas Grekas
a23a4a4398 Merge branch '4.0' into 4.1
* 4.0:
  Alpha-ordering for "use" statements
2018-07-26 11:10:45 +02:00
Nicolas Grekas
6b7e951fdc Merge branch '3.4' into 4.0
* 3.4:
  Alpha-ordering for "use" statements
2018-07-26 11:08:35 +02:00
Nicolas Grekas
7b80bc2c78 Merge branch '2.8' into 3.4
* 2.8:
  Alpha-ordering for "use" statements
2018-07-26 11:06:28 +02:00
Nicolas Grekas
528eef336b Alpha-ordering for "use" statements 2018-07-26 11:03:18 +02:00
Nicolas Grekas
933b774844 Merge branch '4.0' into 4.1
* 4.0:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:55:25 +02:00
Nicolas Grekas
b9433001cb Merge branch '3.4' into 4.0
* 3.4:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:51:09 +02:00
Nicolas Grekas
f5939a8336 Merge branch '2.8' into 3.4
* 2.8:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:45:46 +02:00
Nicolas Grekas
82d13dae31 minor #27852 Fix coding standards (stof)
This PR was squashed before being merged into the 2.8 branch (closes #27852).

Discussion
----------

Fix coding standards

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

This PR is mostly about running the PHP-CS-Fixer (v2.12.1) in the whole codebase.

- I updated the exclude rule to avoid some false positives for the `error_suppression` fixer (we have more files triggering unsilenced deprecations on purpose than when building the initial whitelist, mostly).
- I ran the fixer with this updated config. Most changes were related to fully-qualifying some constants, with the new fixer implemented in https://github.com/FriendsOfPHP/PHP-CS-Fixer/pull/3127, for which @nicolas-grekas and I suggested a config to include in the Symfony ruleset. Based on the output, I suggested a feature request in https://github.com/FriendsOfPHP/PHP-CS-Fixer/issues/3872 as we might want to avoid the `\` in non-namespaced files to improve readability. We might want to remove the second commit of this PR if we decide to wait for the feature to be implemented (update: implementation is contributed in https://github.com/FriendsOfPHP/PHP-CS-Fixer/pull/3876)
- I added the `native_function_invocation` fixer explicitly, to automatically fully-qualify calls to compiler-optimized functions. This feature was implemented in PHP-CS-Fixer based on our feature request (as currently, we do such thing only manually in some hot path, because it could not be automated). I opened https://github.com/FriendsOfPHP/PHP-CS-Fixer/pull/3873 to include it in the ruleset automatically.

TODOs:
- [x] agree on the updated rules
- [x] update fabbot to use the new version of PHP-CS-Fixer
- [ ] make separate PRs for newer branches with their own updates (exclude rules, and CS fixes), once this PR gets merged.

Commits
-------

538c69dc26 Fix Clidumper tests
04654cfeb3 Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
f00b3279ea Apply fixers
720ed4d379 Disable the native_constant_invocation fixer until it can be scoped
8892b98627 Update the list of excluded files for the CS fixer
2018-07-26 10:30:16 +02:00