Commit Graph

2773 Commits

Author SHA1 Message Date
Fabien Potencier
33a001e460 switched array() to [] 2019-01-16 10:39:14 +01:00
Robin Chalas
d6cfde94b4 [Security] Do not mix usage of password_*() functions and sodium_*() ones 2019-01-12 03:20:20 +01:00
Stefan Kruppa
f4cc30b72b Declare exceptions that are already thrown by implementations 2019-01-04 17:03:46 +01:00
Christian Flothmann
3860d685f4 Merge branch '4.2'
* 4.2:
  update years in license files
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  access the container getting it from the kernel
  Replace slave and master by replica and primary
  Fix erasing cookies issue
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [VarExporter] fix exporting array indexes
  [SecurityBundle] Fix traceable voters
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  Fixed minor typos in an error message
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:16:58 +01:00
Christian Flothmann
3007e36a5c Merge branch '4.1' into 4.2
* 4.1:
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  access the container getting it from the kernel
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:07:35 +01:00
Christian Flothmann
4973a5e9e1 Merge branch '3.4' into 4.1
* 3.4:
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:05:57 +01:00
Christian Flothmann
6c895b9757 update year in license files 2019-01-01 14:45:19 +01:00
Nicolas Grekas
edb12b48c7 Merge branch '4.2'
* 4.2:
  [Twig] Remove spaces to fix whitespace in tags
  [Twig] Replace for-loops with blocks for attributes
  fixed CS
  [Tests] Change to willThrowException
  [Console] fix PHPDoc in Command
  Update FileLoaderLoadException.php
  Fix wrong calls to clearstatcache
  Add Vietnamese translation for validators
  Allow running PHPUnit with "xdebug.scream" ON
  [VarDumper] Add descriptors tests
  [Cache] fix bad optim
  [Yaml] detect circular references
  [DI] fix reporting bindings on overriden services as unused
  [Routing] minor fix or previous PR
2018-12-24 11:03:37 +01:00
Nicolas Grekas
5ee0c04fd7 Merge branch '4.1' into 4.2
* 4.1:
  [Twig] Replace for-loops with blocks for attributes
  fixed CS
  [Tests] Change to willThrowException
  [Console] fix PHPDoc in Command
  Update FileLoaderLoadException.php
  Fix wrong calls to clearstatcache
  Add Vietnamese translation for validators
  Allow running PHPUnit with "xdebug.scream" ON
  [VarDumper] Add descriptors tests
  [Yaml] detect circular references
  [DI] fix reporting bindings on overriden services as unused
  [Routing] minor fix or previous PR
2018-12-24 11:01:29 +01:00
Fabien Potencier
729edde312 Merge branch '3.4' into 4.1
* 3.4:
  [Tests] Change to willThrowException
  [Console] fix PHPDoc in Command
  Fix wrong calls to clearstatcache
  Add Vietnamese translation for validators
  Allow running PHPUnit with "xdebug.scream" ON
  [Yaml] detect circular references
2018-12-23 15:06:12 +01:00
George Mponos
0695834657 [Tests] Change to willThrowException 2018-12-23 15:04:59 +01:00
Nicolas Grekas
75eebcf7dc Merge branch '4.2'
* 4.2:
  [Routing] fix trailing slash redirections involving a trailing var
  [EventDispatcher] Revers event tracing order
  [Security] Prefer clone over unserialize(serialize()) for user refreshment
  [Console] OutputFormatter: move strtolower to createStyleFromString
  Adjust tests to work in the armhf architecture. Fixes #29281.
  Vietnamese translations improvement
  [Form] Fixed FormErrorIterator class phpdoc
  Renamed test controller from Controller to TestController so it doesn't show up in the IDE autocomplete.
  Don't use he in docs when its not needed
  EventSubscriberInterface isn't a man
  Fix undefined variable in cache ArrayTrait
  fixed public directory of web server and assets install when configured in composer.json
2018-12-17 14:49:19 +01:00
Nicolas Grekas
8a6090793b Merge branch '4.1' into 4.2
* 4.1:
  [Routing] fix trailing slash redirections involving a trailing var
  [EventDispatcher] Revers event tracing order
  [Security] Prefer clone over unserialize(serialize()) for user refreshment
  [Console] OutputFormatter: move strtolower to createStyleFromString
  Adjust tests to work in the armhf architecture. Fixes #29281.
  Vietnamese translations improvement
  [Form] Fixed FormErrorIterator class phpdoc
  Renamed test controller from Controller to TestController so it doesn't show up in the IDE autocomplete.
  Don't use he in docs when its not needed
  EventSubscriberInterface isn't a man
  fixed public directory of web server and assets install when configured in composer.json
2018-12-17 14:32:53 +01:00
Nicolas Grekas
7ccd4df8ad Merge branch '3.4' into 4.1
* 3.4:
  [EventDispatcher] Revers event tracing order
  [Security] Prefer clone over unserialize(serialize()) for user refreshment
  [Console] OutputFormatter: move strtolower to createStyleFromString
  Adjust tests to work in the armhf architecture. Fixes #29281.
  Vietnamese translations improvement
  [Form] Fixed FormErrorIterator class phpdoc
  Renamed test controller from Controller to TestController so it doesn't show up in the IDE autocomplete.
  Don't use he in docs when its not needed
  EventSubscriberInterface isn't a man
  fixed public directory of web server and assets install when configured in composer.json
2018-12-17 11:22:03 +01:00
Robin Chalas
a8eba803a3 [Security] Prefer clone over unserialize(serialize()) for user refreshment 2018-12-15 11:33:19 +01:00
Tri Pham
93a0c98cc2 Vietnamese translations improvement 2018-12-14 13:19:56 +01:00
Nicolas Grekas
df4ad4e7d4 Merge branch '4.2'
* 4.2: (27 commits)
  [VarExporter] dont call userland code with uninitialized objects
  Fix typos in doc blocks
  [Debug] ignore underscore vs backslash namespaces in DebugClassLoader
  [TwigBridge][Form] Prevent multiple rendering of form collection prototypes
  [FrameworkBundle] fix describing routes with no controllers
  [DI] move RegisterServiceSubscribersPass before DecoratorServicePass
  Update ValidationListener.php
  [Yaml] ensures that the mb_internal_encoding is reset to its initial value
  [Messenger] Restore message handlers laziness
  [WebLink] Fixed documentation link
  [Security] getTargetPath of TargetPathTrait must return string or null
  [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument
  Optimize perf by replacing call_user_func with dynamic vars
  [Cache] Fix dsn parsing
  [Routing] fix dumping same-path routes with placeholders
  [WebProfilerBundle][TwigBundle] CSS fixes
  Add a docblock for FormFactoryInterface
  [Security] defer log message in guard authenticator
  [Validator] Added IBAN format for Vatican City State
  merge conflicts
  ...
2018-12-13 13:43:21 +01:00
Nicolas Grekas
b88728a13a Merge branch '4.1' into 4.2
* 4.1:
  Fix typos in doc blocks
  [Debug] ignore underscore vs backslash namespaces in DebugClassLoader
  [TwigBridge][Form] Prevent multiple rendering of form collection prototypes
  [FrameworkBundle] fix describing routes with no controllers
  [DI] move RegisterServiceSubscribersPass before DecoratorServicePass
  Update ValidationListener.php
  [Yaml] ensures that the mb_internal_encoding is reset to its initial value
  [WebLink] Fixed documentation link
  [Security] getTargetPath of TargetPathTrait must return string or null
  [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument
  Optimize perf by replacing call_user_func with dynamic vars
  [Routing] fix dumping same-path routes with placeholders
  [Security] defer log message in guard authenticator
  [Validator] Added IBAN format for Vatican City State
  merge conflicts
  filter out invalid Intl values
  filter out invalid language values
  [Validator] Fixed grouped composite constraints
  [Form] Filter arrays out of scalar form types
  Fix HeaderBag::get phpdoc
2018-12-13 13:39:50 +01:00
Nicolas Grekas
547bf26eee Merge branch '3.4' into 4.1
* 3.4:
  [Debug] ignore underscore vs backslash namespaces in DebugClassLoader
  [TwigBridge][Form] Prevent multiple rendering of form collection prototypes
  [FrameworkBundle] fix describing routes with no controllers
  [DI] move RegisterServiceSubscribersPass before DecoratorServicePass
  Update ValidationListener.php
  [Yaml] ensures that the mb_internal_encoding is reset to its initial value
  [WebLink] Fixed documentation link
  [Security] getTargetPath of TargetPathTrait must return string or null
  [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument
  [Security] defer log message in guard authenticator
  merge conflicts
  Fix HeaderBag::get phpdoc
2018-12-13 13:30:33 +01:00
Fabien Potencier
68b823f243 minor #29408 [Security] getTargetPath of TargetPathTrait must return string or null (gmponos)
This PR was squashed before being merged into the 3.4 branch (closes #29408).

Discussion
----------

[Security] getTargetPath of TargetPathTrait must return string or null

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes (possible bug)
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

Since the return type is string the default return value must be also string.

Commits
-------

8d4b787dd9 [Security] getTargetPath of TargetPathTrait must return string or null
2018-12-10 05:09:26 +01:00
Mponos George
8d4b787dd9 [Security] getTargetPath of TargetPathTrait must return string or null 2018-12-10 05:09:19 +01:00
Enrico Schultz
21c3030092 [Security] defer log message in guard authenticator
prevent an unneccessary log message if the guard authenticator does not support the current request
2018-12-09 17:00:22 +01:00
Nicolas Grekas
ee337dd761 Merge branch '4.2'
* 4.2:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:37:20 +00:00
Nicolas Grekas
95e4edba92 Merge branch '4.1' into 4.2
* 4.1:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:36:58 +00:00
Nicolas Grekas
34f6a4066d Merge branch '3.4' into 4.1
* 3.4:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:26:33 +00:00
Nicolas Grekas
3aaa5aba1b Merge branch '2.8' into 3.4
* 2.8:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:25:03 +00:00
Nicolas Grekas
410ed830c5 Merge branch '2.7' into 2.8
* 2.7:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:12:46 +00:00
Christian Flothmann
99a0cec0a6 [Security\Http] detect bad redirect targets using backslashes 2018-11-29 16:25:45 +01:00
Fabien Potencier
534b83f080 updated version to 4.3 2018-11-26 17:19:01 +01:00
Nicolas Grekas
fd74951405 Merge branch '4.1'
* 4.1:
  [Form] Hardened test suite for empty data
  Bump phpunit XSD version to 5.2
  [Fwb][EventDispatcher][HttpKernel] Fix getClosureScopeClass usage to describe callables
  Add required key attribute
2018-11-11 20:52:12 +01:00
Nicolas Grekas
913781baac Merge branch '3.4' into 4.1
* 3.4:
  [Form] Hardened test suite for empty data
  Bump phpunit XSD version to 5.2
  [Fwb][EventDispatcher][HttpKernel] Fix getClosureScopeClass usage to describe callables
  Add required key attribute
2018-11-11 20:51:29 +01:00
Nicolas Grekas
e32b518818 Merge branch '2.8' into 3.4
* 2.8:
  [Form] Hardened test suite for empty data
  Bump phpunit XSD version to 5.2
  Add required key attribute
2018-11-11 20:48:54 +01:00
Grégoire Paris
4dce4b7c30
Bump phpunit XSD version to 5.2
Some attributes being used in the phpunit configuration files, namely
failOnRisky and failOnWarning were introduced in phpunit 5.2.0. The
Composer configuration shows that tests should run with old versions of
phpunit, but phpunit only validates the configuration against the XSD
since phpunit 7.2.0.
These changes can be tested as follows:

wget http://schema.phpunit.de/5.2/phpunit.xsd
xargs xmllint --schema phpunit.xsd  1>/dev/null
find src -name phpunit.xml.dist| xargs xmllint --schema phpunit.xsd  1>/dev/null

See 7e06a82806
See 46e3745a03/composer.json (L98)
2018-11-11 12:18:13 +01:00
Nicolas Grekas
0970b09796 Merge branch '4.1'
* 4.1:
  SCA: removed unused variables
  Remove duplicate condition
  fix useless space in docblock
  remove unneeded tearDown method
  [Intl] Update the ICU data to 63.1
  [FrameworkBundle] Fix broken exception message
  [Messenger] send using the routing_key for AMQP transport
  also clean away the NO_AUTO_CACHE_CONTROL_HEADER if we have no session
  [TwigBundle] Fix usage of TwigBundle without FrameworkBundle
  Revert "fixed CS"
  [Serializer] Reduce class discriminator overhead
  Skip empty proxy code
  [Security] Fix "exclude-from-classmap"
  [Security] Removed unsed trait import
  [Config] Fix @method annotation
  add missing double-quotes to extra_fields output message
  [DI] Default undefined env to empty string during compile
  Convert InsufficientAuthenticationException to HttpException
2018-10-30 18:11:56 +01:00
Nicolas Grekas
4b1db0d32c Merge branch '3.4' into 4.1
* 3.4:
  Remove duplicate condition
  fix useless space in docblock
  remove unneeded tearDown method
  [Intl] Update the ICU data to 63.1
  [FrameworkBundle] Fix broken exception message
  [TwigBundle] Fix usage of TwigBundle without FrameworkBundle
  Revert "fixed CS"
  Skip empty proxy code
  [Security] Fix "exclude-from-classmap"
  add missing double-quotes to extra_fields output message
  Convert InsufficientAuthenticationException to HttpException
2018-10-30 18:00:46 +01:00
Nicolas Grekas
faec03105f Merge branch '2.8' into 3.4
* 2.8:
  Remove duplicate condition
  fix useless space in docblock
  remove unneeded tearDown method
  [FrameworkBundle] Fix broken exception message
  Revert "fixed CS"
  Skip empty proxy code
  [Security] Fix "exclude-from-classmap"
  add missing double-quotes to extra_fields output message
  Convert InsufficientAuthenticationException to HttpException
2018-10-30 17:50:50 +01:00
Laurent VOULLEMIER
8abb05607b [Security][SecurityBundle] Add voter individual decisions to profiler 2018-10-28 18:49:26 +01:00
Darryl Hein
feba3816dc
remove unneeded tearDown method 2018-10-27 15:32:49 -06:00
Sam Fleming
9702a212e2
Remove reference to http digest authentication
Seeing as HTTP Digest has been deprecated / removed, the README shouldn't be advertising it as a feature.
2018-10-26 09:20:42 +01:00
Albert Casademont
7b256a985d
[Security] Fix "exclude-from-classmap"
The "/Tests/" directory doesn't exist in the Security Component, tests are located within the Security components folders and none of the tests were being excluded in an --classmap-authoritative dump of the autoload.
2018-10-19 23:57:12 +02:00
Grégoire Pineau
f99786314e [Security] Removed unsed trait import 2018-10-19 14:22:12 +02:00
Christian Flothmann
493c13a9fb Merge branch '4.1'
* 4.1:
  fix merge
2018-10-10 16:58:57 +02:00
Christian Flothmann
61cf143727 fix merge 2018-10-10 16:49:00 +02:00
Nicolas Grekas
8848a1aa30 Merge branch '4.1'
* 4.1: (27 commits)
  Added the Code of Conduct file
  do not override custom access decision configs
  [Security] Do not deauthenticate user when the first refreshed user has changed
  fix a return type hint
  invalidate stale commits for PRs too
  add missing cache prefix seed attribute to XSD
  fix command description
  Fix class documentation
  [Validator] Add a missing translation
  [FrameworkBundle] Fix 3.4 tests
  [DI] fix dumping inline services again
  Rename consumer to receiver
  Register messenger before the profiler
  Fix phpdocs
  [EventDispatcher] Remove template method in test case
  Added LB translation for #27993 (UUID validator message translation)
  Replace deprecated validateValue with validate
  [FWBundle] Automatically enable PropertyInfo when using Flex
  [Process] fix locking of pipe files on Windows
  Correct PHPDoc type for float ttl
  ...
2018-10-10 06:54:27 -07:00
Nicolas Grekas
d9c9e0cf52 Merge branch '3.4' into 4.1
* 3.4: (21 commits)
  Added the Code of Conduct file
  do not override custom access decision configs
  [Security] Do not deauthenticate user when the first refreshed user has changed
  invalidate stale commits for PRs too
  add missing cache prefix seed attribute to XSD
  fix command description
  Fix class documentation
  [Validator] Add a missing translation
  [FrameworkBundle] Fix 3.4 tests
  [DI] fix dumping inline services again
  Fix phpdocs
  [EventDispatcher] Remove template method in test case
  Added LB translation for #27993 (UUID validator message translation)
  Replace deprecated validateValue with validate
  [FWBundle] Automatically enable PropertyInfo when using Flex
  [Process] fix locking of pipe files on Windows
  Correct PHPDoc type for float ttl
  bumped Symfony version to 3.4.18
  updated VERSION for 3.4.17
  updated CHANGELOG for 3.4.17
  ...
2018-10-10 06:52:42 -07:00
Vincent Chalamon
4503ac8e9f
Convert InsufficientAuthenticationException to HttpException 2018-10-10 14:45:47 +02:00
Robin Chalas
2f0e5d7a83 bug #28072 [Security] Do not deauthenticate user when the first refreshed user has changed (gpekz)
This PR was squashed before being merged into the 3.4 branch (closes #28072).

Discussion
----------

[Security] Do not deauthenticate user when the first refreshed user has changed

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Currently the token is deauthenticated when the first refreshed user has changed. In theory, a second user provider could find a user that is the same than the user stored in the token.

Also, the deauthentication is currently affected by the order of the user providers in the security.yaml and IMHO it does not make sense.

Commits
-------

95dce67 [Security] Do not deauthenticate user when the first refreshed user has changed
2018-10-10 10:05:32 +02:00
Geoffrey Pécro
95dce67629 [Security] Do not deauthenticate user when the first refreshed user has changed 2018-10-10 10:05:21 +02:00
Robin Chalas
5093b9fb47 [Security] Deprecate simple_preauth and simple_form in favor of Guard 2018-10-03 09:02:12 +02:00
Nicolas Grekas
a9c90ca77a Merge branch '4.1'
* 4.1: (21 commits)
  [php_cs] disable fopen_flags
  [DI] fix error in dumped container
  [CS] Remove unused variables passed to closures
  [DI] fix dumping setters before their inlined instances
  [CS] Remove empty comment
  [CS] Enforces null type hint on last position in phpDocs
  [CS] Use combined assignment operators when possible
  Fix a typo in error messages
  Don't return early as this bypasses the auto exit feature
  [Console] Add missing null to input values allowed types
  [PHPUnitBridge] Fix microtime() format
  bumped Symfony version to 4.1.6
  updated VERSION for 4.1.5
  updated CHANGELOG for 4.1.5
  bumped Symfony version to 3.4.17
  updated VERSION for 3.4.16
  updated CHANGELOG for 3.4.16
  bumped Symfony version to 2.8.47
  update CONTRIBUTORS for 2.8.46
  updated VERSION for 2.8.46
  ...
2018-10-02 14:43:31 +02:00
Nicolas Grekas
196086c513 Merge branch '3.4' into 4.1
* 3.4:
  [php_cs] disable fopen_flags
  [DI] fix error in dumped container
  [CS] Remove unused variables passed to closures
  [DI] fix dumping setters before their inlined instances
  [CS] Remove empty comment
  [CS] Enforces null type hint on last position in phpDocs
  [CS] Use combined assignment operators when possible
  Fix a typo in error messages
  Don't return early as this bypasses the auto exit feature
  [Console] Add missing null to input values allowed types
  [PHPUnitBridge] Fix microtime() format
  bumped Symfony version to 3.4.17
  updated VERSION for 3.4.16
  updated CHANGELOG for 3.4.16
  bumped Symfony version to 2.8.47
  update CONTRIBUTORS for 2.8.46
  updated VERSION for 2.8.46
  updated CHANGELOG for 2.8.46
2018-10-02 14:40:59 +02:00
Nicolas Grekas
25055be92e Merge branch '2.8' into 3.4
* 2.8:
  [php_cs] disable fopen_flags
  [CS] Remove unused variables passed to closures
  [CS] Remove empty comment
  [CS] Enforces null type hint on last position in phpDocs
  [CS] Use combined assignment operators when possible
  Fix a typo in error messages
  [Console] Add missing null to input values allowed types
  [PHPUnitBridge] Fix microtime() format
  bumped Symfony version to 2.8.47
  update CONTRIBUTORS for 2.8.46
  updated VERSION for 2.8.46
  updated CHANGELOG for 2.8.46
2018-10-02 14:28:39 +02:00
Gabriel Caruso
efbba25577
[CS] Enforces null type hint on last position in phpDocs 2018-10-02 00:12:00 -03:00
Achilles Kaloeridis
07b67ec2cd Fix a typo in error messages 2018-10-01 21:18:23 +03:00
Fabien Potencier
deaf53c231 Merge branch '4.1'
* 4.1:
  [Console] simplified code
  removed useless phpdoc
  improve docblocks around group sequences
  [Cache] prevent getting older entries when the version key is evicted
  [WebProfilerBundle] added a note in the README
  [Yaml] Skip parser test with root user
  [Filesystem] Skip tests on readable file when run with root user
  [FWBundle] Fix an error in WebTestCase::createClient's PHPDoc
  [HttpFoundation][Security] forward locale and format to subrequests
  [Console] Send the right exit code to console.terminate listeners
  [HttpFoundation] fix hidding warnings from session handlers
  Caching missed templates on cache warmup
2018-09-30 05:40:00 +02:00
Fabien Potencier
46fff8b4d7 Merge branch '3.4' into 4.1
* 3.4:
  [Console] simplified code
  removed useless phpdoc
  improve docblocks around group sequences
  [Cache] prevent getting older entries when the version key is evicted
  [WebProfilerBundle] added a note in the README
  [Yaml] Skip parser test with root user
  [Filesystem] Skip tests on readable file when run with root user
  [FWBundle] Fix an error in WebTestCase::createClient's PHPDoc
  [HttpFoundation][Security] forward locale and format to subrequests
  [Console] Send the right exit code to console.terminate listeners
  [HttpFoundation] fix hidding warnings from session handlers
  Caching missed templates on cache warmup
2018-09-30 05:38:13 +02:00
Fabien Potencier
592bbf3470 Merge branch '2.8' into 3.4
* 2.8:
  improve docblocks around group sequences
  [WebProfilerBundle] added a note in the README
  [Filesystem] Skip tests on readable file when run with root user
  [FWBundle] Fix an error in WebTestCase::createClient's PHPDoc
  [HttpFoundation][Security] forward locale and format to subrequests
  [Console] Send the right exit code to console.terminate listeners
  Caching missed templates on cache warmup
2018-09-30 05:32:28 +02:00
Fabien Potencier
60fac5cefa feature #28447 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0 (nicolas-grekas)
This PR was merged into the 4.2-dev branch.

Discussion
----------

[HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | #26731
| License       | MIT
| Doc PR        | -

By creating Cookie instances using `null` for the `$secure` argument, this PR allows making cookies inherit their "secure" attribute from the request.

This PR also adds a forward to make $secure=null and samesite=lax the defaults in Symfony 5.0:
- either define all constructor's arguments explicitly
- or use the new `Cookie::create()` factory

Commits
-------

9493cfd5f2 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0
2018-09-26 07:44:22 +02:00
Nicolas Grekas
41eb1914f6 [HttpFoundation][Security] forward locale and format to subrequests 2018-09-23 17:27:53 +02:00
Nicolas Grekas
9493cfd5f2 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0 2018-09-20 08:41:35 +02:00
Nicolas Grekas
6ec223bf6f [SecurityBundle] make remember-me cookies auto-secure + inherit their default config from framework.session.cookie_* 2018-09-18 21:47:13 +02:00
kevin.nadin
f75fffa997 Trigger deprecation notices when inherited class calls parent method but misses adding new arguments 2018-09-09 20:06:02 +02:00
Nicolas Grekas
004c315b0c Merge branch '4.1'
* 4.1:
  [DI] configure inlined services before injecting them when dumping the container
  Consistently throw exceptions on a single line
  fix fopen calls
  Update .editorconfig
2018-09-08 15:42:43 +02:00
Nicolas Grekas
6fec32c0d0 Merge branch '3.4' into 4.1
* 3.4:
  [DI] configure inlined services before injecting them when dumping the container
  Consistently throw exceptions on a single line
  fix fopen calls
  Update .editorconfig
2018-09-08 15:24:10 +02:00
Nicolas Grekas
8bc014c211 Merge branch '2.8' into 3.4
* 2.8:
  Consistently throw exceptions on a single line
  fix fopen calls
  Update .editorconfig
2018-09-08 15:15:14 +02:00
Nicolas Grekas
721dc8661f Consistently throw exceptions on a single line 2018-09-08 14:44:02 +02:00
Fabien Potencier
7c394e3daa minor #28307 Mark ExceptionInterfaces throwable #2 (ostrolucky)
This PR was merged into the 4.2-dev branch.

Discussion
----------

Mark ExceptionInterfaces throwable #2

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

This has been reverted in beta of 4.1 because of lack of support in prophecy, which has been fixed since then (incl. release). Can be merged again.

References:
https://github.com/symfony/symfony/pull/26702
https://github.com/symfony/symfony/pull/27420
https://github.com/symfony/symfony/issues/27419
https://github.com/phpspec/prophecy/pull/412

ping @dunglas @ciaranmcnulty @dkarlovi @Wirone @teohhanhui @stof @nicolas-grekas @ondrejmirtes

Commits
-------

17c3675226 Mark ExceptionInterfaces throwable
2018-09-04 18:55:13 +02:00
Fabien Potencier
a82b2a78c6 Merge branch '4.1'
* 4.1:
  fixed usage of setUp in tests
  fixed usage of setUp in tests
  fixed usage of setUp in tests
  [travis] minor fix (quater)
2018-09-04 08:30:07 +02:00
Fabien Potencier
525c98b224 Merge branch '3.4' into 4.1
* 3.4:
  fixed usage of setUp in tests
  fixed usage of setUp in tests
  [travis] minor fix (quater)
2018-09-04 08:28:44 +02:00
Fabien Potencier
fcc31cb6dd Merge branch '2.8' into 3.4
* 2.8:
  fixed usage of setUp in tests
  [travis] minor fix (quater)
2018-09-04 08:27:33 +02:00
Fabien Potencier
62e620843e fixed usage of setUp in tests 2018-09-04 07:42:16 +02:00
Samuel ROZE
6b8e6ce73a Merge branch '4.1'
* 4.1:
  Use the real image URL for the filesystem tests
  [Finder] Update PHPdoc append()
  [DI] Fix phpdoc
  Fix code examples in PHPDoc
  [HttpKernel] Fix inheritdocs
  bumped Symfony version to 3.4.16
  updated VERSION for 3.4.15
  updated CHANGELOG for 3.4.15
2018-09-02 18:48:09 +01:00
Samuel ROZE
e2107d24e2 Merge branch '3.4' into 4.1
* 3.4:
  Use the real image URL for the filesystem tests
  [Finder] Update PHPdoc append()
  [DI] Fix phpdoc
  Fix code examples in PHPDoc
  [HttpKernel] Fix inheritdocs
  bumped Symfony version to 3.4.16
  updated VERSION for 3.4.15
  updated CHANGELOG for 3.4.15
2018-09-02 18:33:37 +01:00
Nicolas Grekas
aa13bfdde0 Merge branch '2.8' into 3.4
* 2.8:
  Use the real image URL for the filesystem tests
  [Finder] Update PHPdoc append()
  [DI] Fix phpdoc
  Fix code examples in PHPDoc
  [HttpKernel] Fix inheritdocs
2018-09-02 19:11:59 +02:00
Gabriel Ostrolucký
17c3675226 Mark ExceptionInterfaces throwable 2018-08-29 17:58:00 +02:00
Dany Maillard
1afb043dc5 Fix code examples in PHPDoc 2018-08-29 15:11:53 +02:00
Nicolas Grekas
4f7b41a83d [FrameworkBundle] Added new "auto" mode for framework.session.cookie_secure to turn it on when https is used 2018-08-27 18:13:55 +02:00
Nicolas Grekas
3063c62bba Merge branch '4.1'
* 4.1:
  [travis] fix composer.lock invalidation for deps=low
  [Security\Http] Restore laziness of listener iterator
  Make the `message_bus` alias public
2018-08-19 10:17:45 +02:00
Nicolas Grekas
cd14b22f18 Merge branch '3.4' into 4.1
* 3.4:
  [travis] fix composer.lock invalidation for deps=low
  [Security\Http] Restore laziness of listener iterator
2018-08-19 10:16:41 +02:00
Nicolas Grekas
2ebc75b9a1 [Security\Http] Restore laziness of listener iterator 2018-08-18 22:38:48 +02:00
Nicolas Grekas
1c248e572e Merge branch '4.1'
* 4.1:
  fix merge
  [travis][appveyor] use symfony/flex to accelerate builds
  Add missing stderr redirection
  clean up unused code
  Remove the HTML5 validation from the profiler URL search form
  [Filesystem] Add test to prevent regression when using array|resource with dumpFile
  Add help texts for checkboxes in horizontal bootstrap 4 forms
  [Security] Call AccessListener after LogoutListener
2018-08-18 18:57:16 +02:00
Nicolas Grekas
2dedacbc04 Merge branch '3.4' into 4.1
* 3.4:
  [travis][appveyor] use symfony/flex to accelerate builds
  Add missing stderr redirection
  clean up unused code
  [Filesystem] Add test to prevent regression when using array|resource with dumpFile
  [Security] Call AccessListener after LogoutListener
2018-08-18 18:52:46 +02:00
Nicolas Grekas
d351daab04 Merge branch '2.8' into 3.4
* 2.8:
  [travis][appveyor] use symfony/flex to accelerate builds
  [Security] Call AccessListener after LogoutListener
2018-08-18 18:47:20 +02:00
Robin Chalas
ea0b508c8e bug #28100 [Security] Call AccessListener after LogoutListener (chalasr)
This PR was merged into the 2.8 branch.

Discussion
----------

[Security] Call AccessListener after LogoutListener

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28058
| License       | MIT
| Doc PR        | n/a

Commits
-------

44dbea6 [Security] Call AccessListener after LogoutListener
2018-08-11 13:15:56 +02:00
Nicolas Grekas
4ebecdbc05 Merge branch '4.1'
* 4.1:
  [travis] cache composer.lock files for deps=low
  [Security] Remove wrong sentence about ACL
  Update validators.nl.xlf
  [Routing] Fixed scheme redirecting for root path
  [Form] Remove extra .form-group wrapper around file widget in bootstrap 4
2018-08-07 11:35:17 +02:00
Nicolas Grekas
9654de3527 Merge branch '3.4' into 4.1
* 3.4:
  [travis] cache composer.lock files for deps=low
  [Security] Remove wrong sentence about ACL
  Update validators.nl.xlf
2018-08-07 11:35:05 +02:00
Nicolas Grekas
87fff65cd0 Merge branch '2.8' into 3.4
* 2.8:
  [travis] cache composer.lock files for deps=low
  [Security] Remove wrong sentence about ACL
  Update validators.nl.xlf
2018-08-07 11:33:53 +02:00
Robin Chalas
67f3e3ff4e [Security] Remove wrong sentence about ACL 2018-08-05 19:43:29 +02:00
Robin Chalas
44dbea6330 [Security] Call AccessListener after LogoutListener 2018-08-01 20:49:49 +02:00
Nicolas Grekas
f834c9262b Merge branch '4.1'
* 4.1:
  Alpha-ordering for "use" statements
2018-07-26 11:13:01 +02:00
Nicolas Grekas
a23a4a4398 Merge branch '4.0' into 4.1
* 4.0:
  Alpha-ordering for "use" statements
2018-07-26 11:10:45 +02:00
Nicolas Grekas
6b7e951fdc Merge branch '3.4' into 4.0
* 3.4:
  Alpha-ordering for "use" statements
2018-07-26 11:08:35 +02:00
Nicolas Grekas
7b80bc2c78 Merge branch '2.8' into 3.4
* 2.8:
  Alpha-ordering for "use" statements
2018-07-26 11:06:28 +02:00
Nicolas Grekas
528eef336b Alpha-ordering for "use" statements 2018-07-26 11:03:18 +02:00
Nicolas Grekas
e81285249b Merge branch '4.1'
* 4.1:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:59:12 +02:00
Nicolas Grekas
933b774844 Merge branch '4.0' into 4.1
* 4.0:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:55:25 +02:00
Nicolas Grekas
b9433001cb Merge branch '3.4' into 4.0
* 3.4:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:51:09 +02:00
Nicolas Grekas
f5939a8336 Merge branch '2.8' into 3.4
* 2.8:
  Fix Clidumper tests
  Enable the fixer enforcing fully-qualified calls for compiler-optimized functions
  Apply fixers
  Disable the native_constant_invocation fixer until it can be scoped
  Update the list of excluded files for the CS fixer
2018-07-26 10:45:46 +02:00
Christophe Coevoet
04654cfeb3 Enable the fixer enforcing fully-qualified calls for compiler-optimized functions 2018-07-24 12:05:38 +02:00
Fabien Potencier
5362ff35fc feature #27943 [Security] Deprecate returning stringish objects from Security::getUser (ro0NL)
This PR was squashed before being merged into the 4.2-dev branch (closes #27943).

Discussion
----------

[Security] Deprecate returning stringish objects from Security::getUser

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | yes-ish
| New feature?  | no
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #...   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

`$user` can also be an object implementing `__ toString`. Here we want only true user objects...

Commits
-------

8c410da7e7 [Security] Deprecate returning stringish objects from Security::getUser
2018-07-18 05:37:25 +02:00