Commit Graph

41712 Commits

Author SHA1 Message Date
Nicolas Grekas
6aec217e2b Merge branch '3.4' into 4.2
* 3.4:
  Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
  [FrameworkBundle] minor: remove a typo from changelog
  [VarDumper][Ldap] relax some locally failing tests
  [Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
  Make MimeTypeExtensionGuesser case insensitive
2019-04-17 16:56:00 +02:00
Nicolas Grekas
82f003eaf3 minor #31132 [VarDumper][Ldap] relax some locally failing tests (nicolas-grekas)
This PR was merged into the 3.4 branch.

Discussion
----------

[VarDumper][Ldap] relax some locally failing tests

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

88b27656cc [VarDumper][Ldap] relax some locally failing tests
2019-04-17 16:54:02 +02:00
Nicolas Grekas
f458e5b85a minor #31128 [Validator] Added the missing translations for the Tagalog ("tl") locale (johnillo)
This PR was merged into the 3.4 branch.

Discussion
----------

[Validator] Added the missing translations for the Tagalog ("tl") locale

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | No
| New feature?  | No
| BC breaks?    | No
| Deprecations? | No
| Tests pass?   | Yes
| Fixed tickets | #30192
| License       | MIT
| Doc PR        |

[Validator] This pull request will add the missing translations for the Tagalog ("tl") locale.

Commits
-------

6ab574b7c9 [Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
2019-04-17 16:53:01 +02:00
Nicolas Grekas
13113245bf bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Make MimeTypeExtensionGuesser case insensitive

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #...   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

Some mime types have a camelCase word in them.
The Apache HTTPD project list items are all lower case.
So I suggest making the $mimeType string lowercase while checking the array key.
That way, we can keep the list in sync.

Example: xlsm file mime type is `application/vnd.ms-excel.sheet.macroEnabled.12`
The key that matches the xlsm extension in the `$defaultExtensions` array is `application/vnd.ms-excel.sheet.macroenabled.12`

Example xlsm file:
https://github.com/vermeirentony/xlsm-example

Commits
-------

e294ee6b9a Make MimeTypeExtensionGuesser case insensitive
2019-04-17 16:51:18 +02:00
Nicolas Grekas
55a21fb08f bug #31142 Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)" (chalasr)
This PR was merged into the 3.4 branch.

Discussion
----------

Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? |no
| Tests pass?   | yes
| Fixed tickets | #31136
| License       | MIT
| Doc PR        | n/a

Commits
-------

cd77f6f91c Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
2019-04-17 16:49:35 +02:00
Nicolas Grekas
70166f03eb Merge remote-tracking branch 'origin/3.4' into 3.4
* origin/3.4:
  [FrameworkBundle] minor: remove a typo from changelog
2019-04-17 16:42:57 +02:00
Robin Chalas
a288a74d74 minor #31137 [FrameworkBundle] minor: remove a typo from changelog (Simperfit)
This PR was merged into the 3.4 branch.

Discussion
----------

[FrameworkBundle] minor: remove a typo from changelog

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | no
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | none <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | none. <!-- required for new features -->

<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
 - Bug fixes must be submitted against the lowest branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the master branch.
-->
just a little typo fix: new new -> new

Commits
-------

8f7682c175 [FrameworkBundle] minor: remove a typo from changelog
2019-04-17 16:02:10 +02:00
Robin Chalas
cd77f6f91c Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
This reverts commit fd1408b138, reversing
changes made to b93d2bf941.
2019-04-17 14:56:02 +02:00
Amrouche Hamza
59942b40d1
[Serializer] [DX] NotNormalizableValueException should note which attribute failed to denormalize when possible 2019-04-17 08:10:20 +02:00
Hamza Amrouche
8f7682c175
[FrameworkBundle] minor: remove a typo from changelog
new new -> new
2019-04-17 08:02:18 +02:00
Tobias Schultze
76f6c97416 [Routing] allow comma and other reserved chars without special meaing to not be encoded in the query and fragment 2019-04-16 17:05:04 +02:00
Nicolas Grekas
474a756162 [VarDumper] fix tests with ICU 64.1 2019-04-16 16:37:51 +02:00
Nicolas Grekas
0cdb808f1c [VarDumper] add caster for WeakReference instances of PHP 7.4 2019-04-16 16:30:49 +02:00
Nicolas Grekas
88b27656cc [VarDumper][Ldap] relax some locally failing tests 2019-04-16 15:58:17 +02:00
johnillo
6ab574b7c9 [Validator] #30192 Added the missing translations for the Tagalog ("tl") locale. 2019-04-16 19:21:44 +08:00
Nicolas Grekas
899985e1d5 Merge branch '4.2'
* 4.2:
  [DI] Check service IDs are valid
2019-04-16 13:20:43 +02:00
Nicolas Grekas
3fd01abf11 Merge branch '3.4' into 4.2
* 3.4:
  [DI] Check service IDs are valid
2019-04-16 13:19:53 +02:00
Nicolas Grekas
47cd029f65 security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas)
* di-sec-34:
  [DI] Check service IDs are valid
2019-04-16 13:14:11 +02:00
Nicolas Grekas
d2fb589392 [DI] Check service IDs are valid 2019-04-16 13:13:42 +02:00
Nicolas Grekas
96aee57143 Merge branch '4.2'
* 4.2:
  Fix XSS issues in the form theme of the PHP templating engine
2019-04-16 11:45:47 +02:00
Nicolas Grekas
91916451a5 Merge branch '3.4' into 4.2
* 3.4:
  Fix XSS issues in the form theme of the PHP templating engine
2019-04-16 11:43:21 +02:00
Nicolas Grekas
4585a419ff security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof)
This PR was merged into the 3.4 branch.

Discussion
----------

[FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine

Based on #88

Commits
-------

ab4d05358c Fix XSS issues in the form theme of the PHP templating engine
2019-04-16 11:42:16 +02:00
Nicolas Grekas
d140648929 Merge branch '4.2'
* 4.2:
  Prevent destructors with side-effects from being unserialized
2019-04-16 11:37:27 +02:00
Nicolas Grekas
4b18b32133 Merge branch '3.4' into 4.2
* 3.4:
  Prevent destructors with side-effects from being unserialized
2019-04-16 11:36:45 +02:00
Nicolas Grekas
d77e445697 security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas)
This PR was merged into the 3.4 branch.

Discussion
----------

[Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Reported for `FilesystemCommonTrait` at https://www.intigriti.com/company/submission/CfDJ8Pja6NZvkpNCmx5vVyiGSn7yW8c1j4H0-cnAhIk6fbstOMm028X-XD1kmSuQkGB2n0cRyyVrA2yAiLN_I0EVilaKVLSiSa0UXZJGfN1h85vmk5c2dBBpu619r1YQEIjcXA

Commits
-------

4fb9752816 Prevent destructors with side-effects from being unserialized
2019-04-16 11:03:16 +02:00
Nicolas Grekas
14ba16bf74 Merge branch '4.2'
* 4.2:
  [Security] Add a separator in the remember me cookie hash
2019-04-16 10:58:59 +02:00
Nicolas Grekas
abd8b954f4 Merge branch '3.4' into 4.2
* 3.4:
  [Security] Add a separator in the remember me cookie hash
2019-04-16 10:58:51 +02:00
Nicolas Grekas
0a4ed67b0d security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli)
This PR was merged into the 3.4 branch.

Discussion
----------

[Security] Add a separator in the remember me cookie hash

Based on #89

Commits
-------

a29ce2817c [Security] Add a separator in the remember me cookie hash
2019-04-16 10:58:07 +02:00
Nicolas Grekas
5d583073b5 Merge branch '4.2'
* 4.2:
  [HttpFoundation] reject invalid method override
2019-04-16 10:49:11 +02:00
Nicolas Grekas
a5039c81c9 Merge branch '3.4' into 4.2
* 3.4:
  [HttpFoundation] reject invalid method override
2019-04-16 10:49:01 +02:00
Nicolas Grekas
84ee31179f security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas)
This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] reject invalid method override

Based on #86

Commits
-------

944e60f083 [HttpFoundation] reject invalid method override
2019-04-16 10:46:31 +02:00
Nicolas Grekas
278a7ece35 Merge branch '4.2'
* 4.2:
  bumped Symfony version to 4.2.7
  updated VERSION for 4.2.6
  updated CHANGELOG for 4.2.6
  bumped Symfony version to 3.4.26
  updated VERSION for 3.4.25
  update CONTRIBUTORS for 3.4.25
  updated CHANGELOG for 3.4.25
  Workaround for \DateInterval::createFromDateString()
  [DoctrineBridge] [DX] Update exception text in ManagerRegistry::resetService to avoid confusion.
  Missing Lithuanian translations added to validator component.
2019-04-16 09:33:54 +02:00
Nicolas Grekas
20739e7158 Merge branch '3.4' into 4.2
* 3.4:
  bumped Symfony version to 3.4.26
  updated VERSION for 3.4.25
  update CONTRIBUTORS for 3.4.25
  updated CHANGELOG for 3.4.25
  Workaround for \DateInterval::createFromDateString()
  Missing Lithuanian translations added to validator component.
2019-04-16 09:32:54 +02:00
Fabien Potencier
4a60fff2e4 bumped Symfony version to 4.2.7 2019-04-16 09:23:50 +02:00
Fabien Potencier
cd999a4b6c
Merge pull request #31125 from fabpot/release-4.2.6
released v4.2.6
2019-04-16 09:20:43 +02:00
Fabien Potencier
25eff940aa updated VERSION for 4.2.6 2019-04-16 09:20:25 +02:00
Fabien Potencier
3f1cd59ace updated CHANGELOG for 4.2.6 2019-04-16 09:20:18 +02:00
Nicolas Grekas
944e60f083 [HttpFoundation] reject invalid method override 2019-04-16 07:40:48 +01:00
Fabien Potencier
b7bdf2ce43 bumped Symfony version to 3.4.26 2019-04-16 08:16:04 +02:00
Fabien Potencier
2445423481
Merge pull request #31123 from fabpot/release-3.4.25
released v3.4.25
2019-04-16 08:02:31 +02:00
Fabien Potencier
b316b58098 updated VERSION for 3.4.25 2019-04-16 08:02:09 +02:00
Fabien Potencier
13da753e41 update CONTRIBUTORS for 3.4.25 2019-04-16 08:02:07 +02:00
Fabien Potencier
f7b9a8cb3b updated CHANGELOG for 3.4.25 2019-04-16 08:01:59 +02:00
Tony Vermeiren
e294ee6b9a Make MimeTypeExtensionGuesser case insensitive 2019-04-16 08:01:19 +02:00
Yonel Ceruto
d62ca37ab6 Fix get session when the request stack is empty 2019-04-15 19:32:39 -04:00
Fabien Potencier
7cf96a48e6 feature #31082 [Form] Show all option normalizers on debug:form command (yceruto)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[Form] Show all option normalizers on debug:form command

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT

Follow-up https://github.com/symfony/symfony/pull/30371

![normalizers](https://user-images.githubusercontent.com/2028198/55996454-6667df80-5c85-11e9-94f6-9ee3988833f3.png)

Commits
-------

f1d3bc0e62 Show all option normalizers on debug:form command
2019-04-15 22:27:06 +02:00
Fabien Potencier
e683dfaf60 feature #30957 [Messenger] Remove base64_encode & use addslashes (weaverryan)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[Messenger] Remove base64_encode & use addslashes

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | none
| License       | MIT
| Doc PR        | already covered by existing issue

In #30814, we base64_encoded messages because some transports (specifically DoctrineTransport + Postgresql & SQS) do not allow binary data.

The downside is that the messages become unreadable, which makes it much less convenient to debug your messages with 3rd party monitoring tools, for example.

This PR replaces base64_encode with addslashes. Another alternative (that I first tried in this PR) was to use a blob type, which Drupal does in its code (https://www.drupal.org/project/drupal/issues/690746). But, it still meant that binary data could cause problems with other transports, like SQS.

I also put all the serializer config under a nice, neat `serializer` key under messenger.

Best seen with `?w=1`.

Cheers!

Commits
-------

70b448d120 Reorganizing messenger serializer config and replacing base64_encode with addslashes
2019-04-15 22:19:39 +02:00
Fabien Potencier
9aedfebd87 bug #31040 [BrowserKit] Fixed BC-break introduced by rename of Client to Browser (Devristo)
This PR was squashed before being merged into the 4.3-dev branch (closes #31040).

Discussion
----------

[BrowserKit] Fixed BC-break introduced by rename of Client to Browser

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | https://github.com/symfony/symfony/issues/31039
| License       | MIT
| Doc PR        |

Since #30541 the inheritance hierarchy of `\Symfony\Component\BrowserKit\Client` has changed. Notably the test.client no longer is an instance of `\Symfony\Component\BrowserKit\Client`.

This PR uses `class_alias` to fix the class hierarchy similarly as has been done in Twig. In this case I copied the approach of `Twig_TokenParser_AutoEscape` and `\Twig\TokenParser\AutoEscapeTokenParser`

Commits
-------

6a94dea5cd [BrowserKit] Fixed BC-break introduced by rename of Client to Browser
2019-04-15 22:15:34 +02:00
Chris Tanaskoski
6a94dea5cd [BrowserKit] Fixed BC-break introduced by rename of Client to Browser 2019-04-15 22:15:25 +02:00
Nicolas Grekas
498c749639 minor #31118 [HttpClient] fix too high timeout in test (nicolas-grekas)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[HttpClient] fix too high timeout in test

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

This makes tests pass without waiting for no reasons.

Commits
-------

8f699541f5 [HttpClient] fix too high timeout in test
2019-04-15 21:05:45 +02:00