This PR was merged into the 2.7 branch.
Discussion
----------
[Security] Improve entropy of generated salt
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Using a hash as a salt provides unnecessarily low entropy, especially when using Symfony's recommended password encoder (bcrypt) which truncates salt at 22 chars, giving only 16^22 bits entropy. Using base64 instead provides _up to_ 256^30 bits (256^16 to bcrypt).
This change doesn't break compatibility with the built-in PasswordEncoderInterface implementations (message-digest, pbkdf2, bcrypt, plaintext), but it _might_ not work with some custom encoders if they've been assuming hexit salts. On balance I think it's fine since the commit this patches was only merged a few hours ago :D
Commits
-------
d9b2500 Improve entropy of generated salt
This PR was submitted for the 2.7 branch but it was merged into the 2.6 branch instead (closes#14019).
Discussion
----------
[Process] Remove outdated docblock @return on Process->start()
| Q | A
| ------------- | ---
| Fixed tickets | #14004
| License | MIT
The original commit that introduced fluent interface for `Process->start()` was https://github.com/symfony/symfony/pull/8723 before Symfony 2.4. I couldn't find exactly where in history the start() `return $this` line was removed but it's not in v2.4.0 or any other stable branch.
Docs do not show start() as having a fluent interface: http://symfony.com/doc/current/components/process.html
Targeting 2.6 as currently maintained version.
🚀
Commits
-------
02a1413 [Process] Fix outdated Process->start() docblock
This PR was merged into the 2.6 branch.
Discussion
----------
[DomCrawler] Improve namespace discovery performance
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #12298
| License | MIT
| Doc PR | -
Before this quick-fix, xpath axes like `child::*` or `descendant-or-self::*` were considered namespaces. As a result, far too many xpath queries were being executed during namespace discovery.
Here's a full blackfire before/after comparision of @salaman's script: https://blackfire.io/profiles/compare/a80b9e77-8e55-45d3-a348-7d34a51053b6/graph
![domcrawler-xpath-query](https://cloud.githubusercontent.com/assets/190447/6767384/ba93c57a-d024-11e4-84e1-e58dd7527f03.png)
Commits
-------
b6af002 [DomCrawler] Improve namespace discovery performance
Currently, only the `PhpDumper` is able to dump inlined service
configurators. Since Symfony applications dump the compiled container
in XML, inlined configurators will break this process.
Using a hash as a salt provides unnecessarily low entropy, especially when using Symfony's recommended password encoder (bcrypt) which truncates salt at 22 chars, giving only 16^22 bits entropy. Using base64 instead provides _up to_ 256^30 bits (256^16 to bcrypt).
This change doesn't break compatibility with the built-in PasswordEncoderInterface implementations (message-digest, pbkdf2, bcrypt, plaintext), but it _might_ not work with some custom encoders if they've been assuming hexit salts. On balance I think it's fine since the commit this patches was only merged a few hours ago :D
* 2.6:
Fix small coding style
[2.3] Static Code Analysis for Components
[Form] fixed phpdoc
CS: Convert double quotes to single quotes
Fixed MongoODM entity loader. Improved loading behavior of entities and documents by reusing entity loader.
[Validator] added Japanese translation for unmatched charset (id: 80)
[WebProfilerBundle] fixed undefined buttons.
[WebProfilerBundle] Fix javascript toolbar on IE8
[DependencyInjection] Highest precedence for user parameters
bumped Symfony version to 2.6.6
[Translation][MoFileLoader] fixed load empty translation.
updated VERSION for 2.6.5
updated CHANGELOG for 2.6.5
bumped Symfony version to 2.3.27
updated VERSION for 2.3.26
update CONTRIBUTORS for 2.3.26
updated CHANGELOG for 2.3.26
[HttpKernel] UriSigner::buildUrl - default params for http_build_query
Conflicts:
src/Symfony/Bridge/Propel1/Tests/DataCollector/PropelDataCollectorTest.php
src/Symfony/Component/DependencyInjection/Dumper/PhpDumper.php
src/Symfony/Component/HttpKernel/Kernel.php
src/Symfony/Component/Security/Http/Firewall/AbstractPreAuthenticatedListener.php
src/Symfony/Component/Validator/Resources/translations/validators.ja.xlf
This PR was merged into the 2.3 branch.
Discussion
----------
CS: Convert double quotes to single quotes
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | N/A
| License | MIT
| Doc PR | N/A
Changes generated automatically by upcoming PHP CS Fixer.
To keep fabbot.io happy ;)
Commits
-------
f99c22c CS: Convert double quotes to single quotes
This PR was merged into the 2.7 branch.
Discussion
----------
[SecurityBundle] UserPasswordEncoderCommand: fix help arguments order.
| Q | A
| ------------- | ---
| Fixed tickets | ✘
| License | MIT
A very small fix about the newly introduced command to encode a user password (#12818).
The help message states the command looks like:
```
security:encode-password [password] [salt] [user-class]
```
but is the following instead:
```
security:encode-password [password] [user-class] [salt]
```
Commits
-------
0a5b1b9 [SecurityBundle] UserPasswordEncoderCommand: fix help arguments order.
Up until now xpath axes (child::*, descendant-or-self::** etc) were considered namespaces.
As a result, far too many xpath queries were being executed while namespace discovery.
This PR was merged into the 2.3 branch.
Discussion
----------
[2.3+][Form][DoctrineBridge] Improved loading of entities and documents
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #13961
| License | MIT
Commits
-------
529d99c Fixed MongoODM entity loader. Improved loading behavior of entities and documents by reusing entity loader.
This PR was submitted for the 2.7 branch but it was merged into the 2.3 branch instead (closes#13999).
Discussion
----------
Fix small coding style
[Component] [Translation] [Tests] [PluralizationRulesTest.php] Remove extra space from `PluralizationRulesTest` class declaration.
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Commits
-------
7d0bd63 Fix small coding style
This PR was submitted for the 2.3 branch but it was merged into the 2.7 branch instead (closes#14000).
Discussion
----------
[SECURITY][ACL] fixed Base ACL exceptions on the RuntimeException
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #13154
| License | MIT
| Doc PR | n/a
As said in the ticket issue #13154 "change to \RuntimeException, as this is a more detailed exception, giving users the opportunity to deal with the exceptions in a cleaner way (easier distinguish between runtime and logic exceptions for one)"
Commits
-------
9dcae6b [SECURITY][ACL] fixed Base ACL exceptions on the RuntimeException
This PR was merged into the 2.7 branch.
Discussion
----------
[2.7] [Security] [ACL] Improved MaskBuilder and PermissionMap
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #13566
| License | MIT
| Doc PR | I'll do it if needed
This PR refers to #13697 . The previous PR introduced a BC break, so i provide this one which is backward compatible.
The MaskBuilderRetrievalInterface::getMaskBuilder methods allows us to retrieve a new instance of the MaskBuilder used in our application, even if it's a custom one.
I also added a MaskBuilderInterface and an AbstractMaskBuilder which can be a great helper.
Commits
-------
3d79d8b added MaskBuilderRetrievalInterface
89a1f2a improved MaskBuilder
This PR was squashed before being merged into the 2.3 branch (closes#13995).
Discussion
----------
[2.3] Static Code Analysis for Components
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Static Code Analysis with Php Inspections (EA Extended), no functional changes:
- [Filesystem] : nested ifs, not optimal ifs
- in_array() miss-uses
- class re-implements an interface of super(s)
- array_keys/array_values as foreach array - fixed cases where changes has sense
Commits
-------
4abfabf [2.3] Static Code Analysis for Components
This PR was submitted for the 2.7 branch but it was merged into the 2.3 branch instead (closes#13993).
Discussion
----------
[Form] fixed doc
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | -
| Fixed tickets | -
| License | MIT
| Doc PR | -
Commits
-------
9c55731 [Form] fixed phpdoc
This PR was merged into the 2.6 branch.
Discussion
----------
[WebProfilerBundle] Fix javascript toolbar on IE8
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | N/A
| License | MIT
| Doc PR | N/A
- `Array.prototype.slice.call(tbody.children);` called on HTMLCollection throws an error on IE8
- `XMLHttpRequest` has no event handler on IE8
- `document.getElementsByClassName` does not exist on IE8
Commits
-------
cbd89f5 [WebProfilerBundle] Fix javascript toolbar on IE8
This PR was merged into the 2.7 branch.
Discussion
----------
[VarDumper] Add catch-all-objects hook for casters
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Allows to create generic casters for any type of objects
Commits
-------
5999964 [VarDumper] Add catch-all-objects hook for casters
This PR was submitted for the 2.7 branch but it was merged into the 2.3 branch instead (closes#13992).
Discussion
----------
[Validator] added Japanese translation for unmatched charset (id: 80)
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | -
| Fixed tickets | -
| License | MIT
| Doc PR | -
Commits
-------
0ada9e4 [Validator] added Japanese translation for unmatched charset (id: 80)
This PR was merged into the 2.7 branch.
Discussion
----------
[VarDumper] Added support for amqp
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | ~
| License | MIT
| Doc PR | ~
![screenshot3](https://cloud.githubusercontent.com/assets/408368/6736802/5bcb2cfe-ce67-11e4-8bce-a5ca5f98239f.png)
Commits
-------
5fa063e [VarDumper] Added support for amqp
This PR was merged into the 2.7 branch.
Discussion
----------
[2.7][SecurityBundle] Added a command to encode a password
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #11206
| License | MIT
| Doc PR | ~
- [x] Give some love to the UI (need your feedbacks)
- [x] Write tests
- [x] Write documentation
-------------------------------------------------------
The encoder got depend directly from the configuration of the user class in the security.yml.
So the user choose the user type, and, using the method `getEncoder($user)` of the `security.encoder_factory` service, I get the right encoder configured.
*Here is the output for `security:encode-password`*:
![capture d ecran 2015-01-01 a 19 48 07](https://cloud.githubusercontent.com/assets/667519/5593008/3af45686-91ef-11e4-8024-e66a2e000fbe.png)
Commits
-------
a7bd0fc Added a command to encode a password
This PR was merged into the 2.7 branch.
Discussion
----------
[FrameworkBundle] Remove asset from require-dev
| Q | A
| ------------- | ---
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Not needed because already in `require`.
Commits
-------
3a29bb6 [FrameworkBundle] Remove asset from require-dev
This PR was merged into the 2.3 branch.
Discussion
----------
[DependencyInjection] Highest precedence for user parameters
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | ~
| License | MIT
| Doc PR | ~
If `router.request_context.host` is defined in `parameters.yml` and if this
key is used in `globals` section of twig bundle then the value registered in the
DIC/parameters is the default value (`localhost`).
It occurs because generally the framework bundle is defined before the twig
bundle. So after the first loop, the (user) value registered in the
`ContainerBuilder` is overridden by the default value of the framework bundle.
And so, when it comes the time to process twig bundle, the last one gets the
default value, and not the user value.
This patch force the merge of default value, but give an highest precedence of
user parameters for each extensions.
Commits
-------
ce2764d [DependencyInjection] Highest precedence for user parameters
This PR was merged into the 2.7 branch.
Discussion
----------
[FrameworkBundle] Fix regression introduced by #13107
| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
I've introduced a bug in 83b56f60d0. An error will be throw if the serializer is enabled but no cache is set.
This is the fix.
Commits
-------
efadac0 [FrameworkBundle] Fix regression introduced by #13107