Commit Graph

2867 Commits

Author SHA1 Message Date
Fabien Potencier
5dba412d30 Merge branch '4.3'
* 4.3: (22 commits)
  [Messenger] Fix incorrect error when symfony/serializer is missing
  Allow WrappedListener to describe uncallable listeners.
  [HttpClient] fix handling exceptions thrown before first mock chunk
  [Filesystem] fix wrong method call casing
  [HttpClient] fix test
  [Translation] Fixed issue with new vs old TranslatorInterface in TranslationDataCollector
  Don't reference symfony/security
  [HttpClient] display proper error message on TransportException when curl is used
  [FrameworkBundle] fix named autowiring aliases for TagAwareCacheInterface
  [Cache] improve logged messages
  [FrameworkBundle] improve cs
  [Mime][HttpFoundation] Added mime type audio/x-hx-aac-adts
  bumped Symfony version to 4.3.0
  updated VERSION for 4.3.0-BETA2
  updated CHANGELOG for 4.3.0-BETA2
  [HttpClient] Only use CURLMOPT_MAX_HOST_CONNECTIONS & CURL_VERSION_HTTP2 if defined
  [Security] fixed a fatal error when upgrading from 4.2
  [HttpClient] Allow arrays as query parameters
  Throws UnrecoverableMessageHandlingException when passed invalid entity manager name for Doctrine middlewares
  [Messenger] Make redis Connection::get() non blocking by default
  ...
2019-05-26 11:07:14 +02:00
Ondrej Exner
45a8f893ef
fix phpdoc 2019-05-22 09:57:24 +02:00
Fabien Potencier
cd63446f9b [Security] fixed a fatal error when upgrading from 4.2 2019-05-21 22:19:00 +02:00
Fabien Potencier
387207f6c4 updated version to 4.4 2019-05-09 09:23:25 +02:00
Fabien Potencier
72863e441f fixed CS 2019-05-08 19:18:10 +02:00
Fabien Potencier
2e872c4be0 Merge branch '4.2'
* 4.2:
  [Console] Fix auto-complete for ChoiceQuestion (multi-select answers)
  Translated form, security, validators resources into Belarusian (be)
  [WebProfilerBundle] Don't filter submitted IP values
  [Intl] Cleanup
  bumped Symfony version to 4.2.9
  updated VERSION for 4.2.8
  updated CHANGELOG for 4.2.8
  bumped Symfony version to 3.4.28
  updated VERSION for 3.4.27
  update CONTRIBUTORS for 3.4.27
  updated CHANGELOG for 3.4.27
2019-05-07 08:08:50 +02:00
Fabien Potencier
b9637c9209 Merge branch '3.4' into 4.2
* 3.4:
  [Console] Fix auto-complete for ChoiceQuestion (multi-select answers)
  Translated form, security, validators resources into Belarusian (be)
  [WebProfilerBundle] Don't filter submitted IP values
  bumped Symfony version to 3.4.28
  updated VERSION for 3.4.27
  update CONTRIBUTORS for 3.4.27
  updated CHANGELOG for 3.4.27
2019-05-06 13:28:52 +02:00
Uladzimir Tsykun
3ae9de1ef3 Translated form, security, validators resources into Belarusian (be) 2019-05-05 18:11:06 +02:00
Amrouche Hamza
fa92272dc1
[Security] Change the phrasing of the deauthenticated event 2019-04-29 08:41:58 +02:00
Robin Chalas
f24e9a4973 feature #31138 [Security] Dispatch an event when "logout user on change" steps in (Simperfit)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[Security] Dispatch an event when "logout user on change" steps in

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #26902   <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | https://github.com/symfony/symfony-docs/pull/11450 <!-- required for new features -->

<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
 - Bug fixes must be submitted against the lowest branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the master branch.
-->

This adds a new event when the user has been changed and has been log out from the apps, it allow someone to register to this event and do something with either to token or the refreshedUser.

Commits
-------

40e42183b8 [Security] Dispatch an event when "logout user on change" steps in
2019-04-28 14:04:43 +02:00
Fabien Potencier
e9aaaafbbb Merge branch '4.2'
* 4.2:
  [TwigBridge] Require twig ^1.40|^2.9
  [Serializer] Fix tests
  Use the apply tag instead of the filter tag
  Updated some translation files
  [Translator] Preserve default domain when extracting strings from php files
2019-04-28 08:09:58 +01:00
Fabien Potencier
454574b0a3 Merge branch '3.4' into 4.2
* 3.4:
  [TwigBridge] Require twig ^1.40|^2.9
  [Serializer] Fix tests
  Use the apply tag instead of the filter tag
  Updated some translation files
  [Translator] Preserve default domain when extracting strings from php files
2019-04-28 08:09:27 +01:00
Jordi Rejas
1d5aaf63f5 Updated some translation files 2019-04-27 17:49:24 +01:00
Amrouche Hamza
40e42183b8 [Security] Dispatch an event when "logout user on change" steps in 2019-04-27 16:12:39 +02:00
Robin Chalas
27d10a658d Merge branch '4.2'
* 4.2:
  Fix url matcher edge cases with trailing slash
  [Form] Fix author tag + exception messages
  [TwigBridge] Fix deprecation on twig 2.9
  Fix left-associative ternary deprecation warnings for PHP 7.4
  [Validator] Fixed imprecise translations
  [Validator] Add Dutch translations
  [Security] Cleanup "Digest nonce has expired." translation
  Intercept redirections only for HTML format
  [PhpUnitBridge] fix reading phpunit.xml on bootstrap
  resolve class name parameters
  Fix name and phpdoc of ContainerBuilder::removeBindings
  [Intl] Update the ICU data to 64.2
2019-04-27 14:01:28 +02:00
Roland Franssen
e95445d830 [Security] Cleanup "Digest nonce has expired." translation 2019-04-25 13:21:20 +02:00
Nicolas Grekas
e197398d2f [Security] deprecate BCryptPasswordEncoder in favor of NativePasswordEncoder 2019-04-18 18:59:05 +02:00
Robin Chalas
89ec31141f feature #31140 [Security] Add NativePasswordEncoder (nicolas-grekas)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[Security] Add NativePasswordEncoder

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

This PR adds a new `NativePasswordEncoder` that defaults to the best available hashing algo to `password_hash()`. Best is determined by "us" or "php", the goal being that this will change in the future as new algos are published.

This provides a native encoder that we should recommend using by default.

Commits
-------

28f7961c55 [Security] Add NativePasswordEncoder
2019-04-18 15:59:39 +02:00
Nicolas Grekas
28f7961c55 [Security] Add NativePasswordEncoder 2019-04-18 13:38:48 +02:00
Nicolas Grekas
8d9686105d Merge branch '4.2'
* 4.2:
  Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
  [FrameworkBundle] minor: remove a typo from changelog
  [VarDumper] fix tests with ICU 64.1
  [VarDumper][Ldap] relax some locally failing tests
  [Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
  Make MimeTypeExtensionGuesser case insensitive
  Fix get session when the request stack is empty
  [Routing] fix trailing slash redirection with non-greedy trailing vars
  [FrameworkBundle] decorate the ValidatorBuilder's translator with LegacyTranslatorProxy
2019-04-17 17:26:35 +02:00
Nicolas Grekas
6aec217e2b Merge branch '3.4' into 4.2
* 3.4:
  Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
  [FrameworkBundle] minor: remove a typo from changelog
  [VarDumper][Ldap] relax some locally failing tests
  [Validator] #30192 Added the missing translations for the Tagalog ("tl") locale.
  Make MimeTypeExtensionGuesser case insensitive
2019-04-17 16:56:00 +02:00
Nicolas Grekas
55a21fb08f bug #31142 Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)" (chalasr)
This PR was merged into the 3.4 branch.

Discussion
----------

Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? |no
| Tests pass?   | yes
| Fixed tickets | #31136
| License       | MIT
| Doc PR        | n/a

Commits
-------

cd77f6f91c Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
2019-04-17 16:49:35 +02:00
Robin Chalas
cd77f6f91c Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)"
This reverts commit fd1408b138, reversing
changes made to b93d2bf941.
2019-04-17 14:56:02 +02:00
Nicolas Grekas
14ba16bf74 Merge branch '4.2'
* 4.2:
  [Security] Add a separator in the remember me cookie hash
2019-04-16 10:58:59 +02:00
Nicolas Grekas
abd8b954f4 Merge branch '3.4' into 4.2
* 3.4:
  [Security] Add a separator in the remember me cookie hash
2019-04-16 10:58:51 +02:00
Nicolas Grekas
0a4ed67b0d security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli)
This PR was merged into the 3.4 branch.

Discussion
----------

[Security] Add a separator in the remember me cookie hash

Based on #89

Commits
-------

a29ce2817c [Security] Add a separator in the remember me cookie hash
2019-04-16 10:58:07 +02:00
Fabien Potencier
7e2fbe13c8 Merge branch '4.2'
* 4.2:
  fixed bad merge
  Show more accurate message in profiler when missing stopwatch
  CS Fixes: Not double split with one array argument
  [Serializer] Add default object class resolver
  Remove redundant animation prefixes
  Remove redundant `box-sizing` prefixes
  [VarExporter] support PHP7.4 __serialize & __unserialize
  Rework firewall access denied rule
  MetadataAwareNameConverter: Do not assume that property names are strings
  [VarExporter] fix exporting classes with private constructors
  fixed CS
  Fix missing $extraDirs when open_basedir returns
2019-04-10 21:42:49 +02:00
Fabien Potencier
b13a23fe45 Merge branch '3.4' into 4.2
* 3.4:
  Show more accurate message in profiler when missing stopwatch
  CS Fixes: Not double split with one array argument
  Remove redundant animation prefixes
  Remove redundant `box-sizing` prefixes
  Rework firewall access denied rule
  fixed CS
  Fix missing $extraDirs when open_basedir returns
2019-04-10 18:20:36 +02:00
Thomas Calvet
e6455ea2d8 [Security][TokenInterface] Prepare for the new serialization mechanism 2019-04-10 18:01:24 +02:00
Fabien Potencier
fd1408b138 bug #30423 [Security] Rework firewall's access denied rule (dimabory)
This PR was merged into the 3.4 branch.

Discussion
----------

[Security] Rework firewall's access denied rule

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | ~~#30099~~, #28229
| License       | MIT
| Doc PR        |

Follow tickets provided above to reproduce bugs. (there are also some project examples)

~~In addition, I'm looking for someone who knows an answer to [this](https://github.com/symfony/symfony/issues/30099#issuecomment-468693492) regarding rework in this PR.~~

Commits
-------

5790859275 Rework firewall access denied rule
2019-04-10 08:03:21 +02:00
Dmytro
5790859275 Rework firewall access denied rule 2019-04-09 18:04:58 +03:00
Robin Chalas
529211d7ed [Security] Replace Argon2*PasswordEncoder by SodiumPasswordEncoder
This reverts commit dc95a6fec6.
2019-04-08 22:34:55 +02:00
Robin Chalas
dc95a6fec6 [Security] Fix argon2 availability checks 2019-04-08 18:18:02 +02:00
Fabien Potencier
f539932899 fixed CS 2019-04-08 08:16:24 +02:00
Fabien Potencier
fa7df09dbb feature #30968 [Security] Add Argon2idPasswordEncoder (chalasr)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[Security] Add Argon2idPasswordEncoder

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | #28093
| License       | MIT
| Doc PR        | TODO

Currently we have a `Argon2iPasswordEncoder` that may hash passwords using `argon2id` instead of `argon2i` (platform-dependent) which is not good.
This deprecates producing/validating `argon2id` hashed passwords using the `Argon2iPasswordEncoder`, and adds a `Argon2idPasswordEncoder` able to produce/validate `argon2id` hashed passwords only.

#EUFOSSA

Commits
-------

0c82173b24 [Security] Add Argon2idPasswordEncoder
2019-04-08 08:14:55 +02:00
Robin Chalas
0c82173b24 [Security] Add Argon2idPasswordEncoder 2019-04-07 21:35:55 +02:00
Thomas Calvet
d412e77a9c Prepare for the new serialization mechanism 2019-04-07 20:20:37 +02:00
Pascal Borreli
a29ce2817c [Security] Add a separator in the remember me cookie hash 2019-04-06 21:17:28 +02:00
Fabien Potencier
f527acfac7 Merge branch '4.2'
* 4.2: (45 commits)
  [Form] various minor fixes
  Ensure the parent process is always killed
  bugfix: the terminal state was wrong and not reseted
  [Console] Fix inconsistent result for choice questions in non-interactive mode
  Define null return type for Constraint::getDefaultOption()
  [Routing] Fix: annotation loader ignores method's default values
  [HttpKernel] Fix DebugHandlersListener constructor docblock
  Skip Glob brace test when GLOB_BRACE is unavailable
  bumped Symfony version to 4.2.6
  updated VERSION for 4.2.5
  updated CHANGELOG for 4.2.5
  bumped Symfony version to 3.4.25
  updated VERSION for 3.4.24
  update CONTRIBUTORS for 3.4.24
  updated CHANGELOG for 3.4.24
  [EventDispatcher] cleanup
  fix testIgnoredAttributesInContext
  Re-generate icu 64.1 data
  Improve PHPdoc / IDE autocomplete for config tree builder
  [Bridge][Twig] DebugCommand - fix escaping and filter
  ...
2019-04-06 16:04:46 +02:00
Nicolas Grekas
99684434bc Merge branch '3.4' into 4.2
* 3.4:
  SCA: minor code tweaks
  [Intl] Update the ICU data to 64.1
  [Bridge][Twig] DebugCommand - fix escaping and filter
2019-04-01 09:32:59 +02:00
Vladimir Reznichenko
cc4529db51 SCA: minor code tweaks 2019-04-01 09:08:40 +02:00
Fabien Potencier
2fb2508cee Merge branch '3.4' into 4.2
* 3.4:
  [Serializer] Added check of constuctor modifiers to AbstractNormalizer
  [Intl] Simplify the compile binary
  [Routing] Fix routes annotation loading with glob pattern
  Fix hardcoded hotPathTagName
  [Validator] Improve constraint default option check
  [Validator] Fix annotation default for @Count and @Length
  Update composer.json
  Fix getSetMethodNormalizer to correctly ignore the attributes specified in "ignored_attributes"
  Add missing "vi" translations
  add missing German translations
  [Intl] Fix test
  added missing translation
  use behavior instead of behaviour
  [Validator] Translate JSON message to Hungarian
  [Validator] fix sr_Latn translations
  [FrameworkBundle][HttpFoundation] make session service resettable
2019-03-30 16:58:42 +01:00
SpacePossum
f8a033c0ef
Update composer.json 2019-03-29 09:11:11 +01:00
Nicolas Grekas
3c3db2f14a [Contracts][EventDispatcher] add EventDispatcherInterface to symfony/contracts and use it where possible 2019-03-25 18:18:00 +01:00
Oskar Stark
8b5c5ed587 use behavior instead of behaviour 2019-03-25 08:48:46 +01:00
Christian Flothmann
2d3f2b7a74 undeprecate the RoleHierarchyInterface
Instead of deprecating the interface it is sufficient to deprecate its
getReachableRoles() method and add a new getReachableRoleNames() method
in Symfony 5.
2019-03-22 16:40:58 +01:00
Fabien Potencier
522594a69d Merge branch '4.2'
* 4.2:
  [Phpunit] fixed support for PHP 5.3
  Response prepare method update
  [Workflow] Added missing license header
  Fix case when multiple loaders are providing paths for the same namespace
  Check if Client exists when test.client does not exist, to provide clearer exception message
  throw TypeErrors to prepare for type hints in 5.0
  [Form] Preventing validation of children if parent with Valid constraint has no validation groups
  [Form] Added ResetInterface to CachingFactoryDecorator
  Remove deprecated usage
  [Tests] fixed compatbility of assertEquals(): void
  Fixed usage of TranslatorInterface in form extension (fixes #30591)
  [Intl][4.2] Fix test
  [Intl] Fix test
  [Validator] Add the missing translations for the Arabic (ar) locale
  [Intl] Add compile binary
  Fix DebugCommand when chain loader is involved
  [Form] Fixed some phpdocs
2019-03-22 09:16:47 +01:00
Fabien Potencier
7e30c971ab fixed CS 2019-03-22 07:07:54 +01:00
Fabien Potencier
1479a26a0b feature #28920 [EventDispatcher] swap arguments of dispatch() to allow registering events by FQCN (nicolas-grekas)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[EventDispatcher] swap arguments of dispatch() to allow registering events by FQCN

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

PR green and ready. From UPGRADE files:

 EventDispatcher
---------------

 * The signature of the `EventDispatcherInterface::dispatch()` method should be updated to `dispatch($event, string $eventName = null)`, not doing so is deprecated

HttpKernel
----------

 * Renamed `FilterControllerArgumentsEvent` to `ControllerArgumentsEvent`
 * Renamed `FilterControllerEvent` to `ControllerEvent`
 * Renamed `FilterResponseEvent` to `ResponseEvent`
 * Renamed `GetResponseEvent` to `RequestEvent`
 * Renamed `GetResponseForControllerResultEvent` to `ViewEvent`
 * Renamed `GetResponseForExceptionEvent` to `ExceptionEvent`
 * Renamed `PostResponseEvent` to `TerminateEvent`

Security
---------

 * The `ListenerInterface` is deprecated, turn your listeners into callables instead.
 * The `Firewall::handleRequest()` method is deprecated, use `Firewall::callListeners()` instead.

Commits
-------

75369dabb8 [EventDispatcher] swap arguments of dispatch() to allow registering events by FQCN
2019-03-20 13:34:13 +01:00
Christian Flothmann
f18751bd98 throw TypeErrors to prepare for type hints in 5.0 2019-03-19 22:07:50 +01:00
Nicolas Grekas
b7e798ef74 Merge branch '4.2'
* 4.2:
  Fix Cache error while using anonymous class
  [Cache] fix LockRegistry
  Update validators.cs.xlf
  Make translations consistent with other translations.
  Correct language code for ukrainian language in security translations.
  Fix return type of Request::getRequestFormat
  [Cache] Fix perf when using RedisCluster by reducing roundtrips to the servers
2019-03-15 14:38:03 +01:00
Nicolas Grekas
75369dabb8 [EventDispatcher] swap arguments of dispatch() to allow registering events by FQCN 2019-03-14 08:32:46 +01:00
Nicolas Grekas
8907650424 Merge branch '3.4' into 4.2
* 3.4:
  Make translations consistent with other translations.
  Correct language code for ukrainian language in security translations.
  Fix return type of Request::getRequestFormat
  [Cache] Fix perf when using RedisCluster by reducing roundtrips to the servers
2019-03-13 17:19:01 +01:00
Stanislav Kocanda
b86fa9312b Correct language code for ukrainian language
in security translations.
2019-03-13 15:34:24 +01:00
Fabien Potencier
6c4ab8942e fixed CS 2019-03-04 10:20:13 +01:00
Nicolas Grekas
05d6475c5e Drop more usages of Serializable 2019-03-04 09:45:35 +01:00
Fabien Potencier
d2e9a7051f feature #22048 [Security] deprecate the Role and SwitchUserRole classes (xabbuh)
This PR was merged into the 4.3-dev branch.

Discussion
----------

[Security] deprecate the Role and SwitchUserRole classes

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | #20824
| License       | MIT
| Doc PR        | symfony/symfony-docs#11047

In #20801, we deprecated the `RoleInterface`. The next logical step would be to also deprecate the `Role` class. However, we currently have the `SwitchUserRole` class (a sub-class of `Role`) that acts as an indicator to check whether or not the authenticated user switched to another user.

This PR proposes an alternative solution to the usage of the special `SwitchUserRole` class by storing the original token inside the `UsernamePasswordToken`. This PR is not complete, but rather acts as a proof of concept of how we could get rid of the `Role` and the `SwitchUserRole` classes.

Please share your opinions whether you think this is a valid approach and I will be happy to finalise the PR.

Commits
-------

d7aaa615b9 deprecate the Role and SwitchUserRole classes
2019-02-25 17:04:33 +01:00
Nicolas Grekas
a0c566504c Merge branch '4.2'
* 4.2: (26 commits)
  Apply php-cs-fixer rule for array_key_exists()
  [Cache] fix warming up cache.system and apcu
  [Security] Change FormAuthenticator if condition
  handles multi-byte characters in autocomplete
  speed up tests running them without debug flag
  [Translations] added missing Croatian validators
  Fix getItems() performance issue with RedisCluster (php-redis)
  [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning
  IntegerType: reject submitted non-integer numbers
  be keen to newcomers
  [HttpKernel] Fix possible infinite loop of exceptions
  fixed CS
  [Validator] Added missing translations for Afrikaans
  do not validate non-submitted form fields in PATCH requests
  Update usage example in ArrayInput doc block.
  [Console] Prevent ArgvInput::getFirstArgument() from returning an option value
  [Validator] Fixed duplicate UUID
  fixed CS
  [EventDispatcher] Fix unknown priority
  Avoid mutating the Finder when building the iterator
  ...
2019-02-23 16:22:31 +01:00
Nicolas Grekas
87f3c36d60 Merge branch '3.4' into 4.2
* 3.4: (24 commits)
  Apply php-cs-fixer rule for array_key_exists()
  [Security] Change FormAuthenticator if condition
  handles multi-byte characters in autocomplete
  speed up tests running them without debug flag
  [Translations] added missing Croatian validators
  Fix getItems() performance issue with RedisCluster (php-redis)
  [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning
  IntegerType: reject submitted non-integer numbers
  be keen to newcomers
  [HttpKernel] Fix possible infinite loop of exceptions
  fixed CS
  [Validator] Added missing translations for Afrikaans
  do not validate non-submitted form fields in PATCH requests
  Update usage example in ArrayInput doc block.
  [Console] Prevent ArgvInput::getFirstArgument() from returning an option value
  [Validator] Fixed duplicate UUID
  fixed CS
  [EventDispatcher] Fix unknown priority
  Avoid mutating the Finder when building the iterator
  [Validator] Add the missing translations for the Greek (el) locale
  ...
2019-02-23 16:17:42 +01:00
Nicolas Grekas
b0a3208588 Apply php-cs-fixer rule for array_key_exists() 2019-02-23 16:06:07 +01:00
Patrick Reimers
67ae121b2e [Security] Change FormAuthenticator if condition 2019-02-23 15:32:34 +01:00
Christian Flothmann
d7aaa615b9 deprecate the Role and SwitchUserRole classes 2019-02-23 00:57:00 +01:00
Philipp Cordes
3a22cad29b Fix infinite recursion when passed an empty string 2019-02-19 23:14:55 +01:00
Nicolas Grekas
374c8b0063 Merge branch '4.2'
* 4.2:
  [Console] Fix command testing with missing inputs
  [Validator] Sync no/nb translation files
  [Translation] Added a script to display the status of translations
  [Validator] Added missing translations for Norwegian (\"no\") locale #30179
  [Security\Guard] bump lowest version of security-core
  [TwigBridge] Fix test
  Remove unnecessary ProgressBar stdout writes (fixes flickering)
  [Validator] improve translations for albanian ("sq") locale
  [VarDumper] fix serializing Stub instances
  [Validator] Added missing use statement for UnexpectedTypeException
  Don't resolve the Deprecation error handler mode until a deprecation is triggered
  bug #30245 fix lost namespace in eval (fizzka)
  fix lost namespace in eval
  [Twig] removed usage of non-namespaced classes
  added missing dot
  Update validators.lt.xlf
  #30172 Add the missing validation translations for the Luxembourgish …
  [Debug][ErrorHandler] Preserve next error handler
2019-02-19 19:29:52 +01:00
Nicolas Grekas
890c2ac9f5 Merge branch '3.4' into 4.2
* 3.4:
  [Console] Fix command testing with missing inputs
  [Validator] Sync no/nb translation files
  [Translation] Added a script to display the status of translations
  [Validator] Added missing translations for Norwegian (\"no\") locale #30179
  [Security\Guard] bump lowest version of security-core
2019-02-19 19:28:05 +01:00
Nicolas Grekas
93cfd5b2a0 [Security\Guard] bump lowest version of security-core 2019-02-17 23:00:14 +01:00
Fabien Potencier
3c2dc44af6 Merge branch '4.2'
* 4.2: (25 commits)
  Add missing ID_id validators translation
  fixed CS
  Added missing translations in validators.tr.xlf
  Update validators.es.xlf
  Update validators.hu.xlf
  [Validator] Add the missing translations for the Welsh (cy) locale
  [Validator] Add missing DE validator translations
  [Validator] Add the missing translations for the Dutch (nl) locale
  Add missing PL translation
  Add missing translations.
  Add missing translations for IT to Validator
  minor #30184 [Validator] Add the missing translations for the Russian (ru) locale (antonch1989)
  [Validator] Add the missing translations for the Arabic (ar) locale
  add_missing_translations_for_portuguese : [Validator] Add the missing translations for the Portuguese ("pt") locale
  [Validator] Add the missing translations for the French (fr) locale
  [Validator] Add some missing contents to the English translation
  use PropertyAccessorInterface instead of PropertyAccessor
  Fix KernelTestCase compatibility for PhpUnit 8 (bis)
  add xabbuh as code owner of the Form component
  [Validator] Added a missing translation
  ...
2019-02-12 21:07:40 +01:00
Fabien Potencier
1614a52b28 Merge branch '3.4' into 4.2
* 3.4: (25 commits)
  Add missing ID_id validators translation
  fixed CS
  Added missing translations in validators.tr.xlf
  Update validators.es.xlf
  Update validators.hu.xlf
  [Validator] Add the missing translations for the Welsh (cy) locale
  [Validator] Add missing DE validator translations
  [Validator] Add the missing translations for the Dutch (nl) locale
  Add missing PL translation
  Add missing translations.
  Add missing translations for IT to Validator
  minor #30184 [Validator] Add the missing translations for the Russian (ru) locale (antonch1989)
  [Validator] Add the missing translations for the Arabic (ar) locale
  add_missing_translations_for_portuguese : [Validator] Add the missing translations for the Portuguese ("pt") locale
  [Validator] Add the missing translations for the French (fr) locale
  [Validator] Add some missing contents to the English translation
  use PropertyAccessorInterface instead of PropertyAccessor
  Fix KernelTestCase compatibility for PhpUnit 8 (bis)
  add xabbuh as code owner of the Form component
  [Validator] Added a missing translation
  ...
2019-02-12 21:06:11 +01:00
Antoine Lamirault
15db914984 [Security] fix switch user without having current token 2019-02-09 10:27:13 +01:00
renanbr
006c6ddda3 makes serialize methods final 2019-02-07 09:54:38 +01:00
Nicolas Grekas
23fe9c89db Merge branch '4.2'
* 4.2:
  fix pruning pdo cache for vendors that throw on execute
  Fix typo in translation
  Declare exceptions that are already thrown by implementations
2019-02-01 12:07:50 +01:00
Nicolas Grekas
d44fba1260 Merge branch '3.4' into 4.2
* 3.4:
  Fix typo in translation
  Declare exceptions that are already thrown by implementations
2019-02-01 11:47:37 +01:00
Tarjei Huse
e8cdda3cf2 Fix typo in translation 2019-01-31 11:03:47 +01:00
Robin Chalas
52a986b15e minor #29779 [Security] Declare exceptions that are already thrown by implementations (umulmrum)
This PR was merged into the 3.4 branch.

Discussion
----------

[Security] Declare exceptions that are already thrown by implementations

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #29650
| License       | MIT
| Doc PR        |

Adding exception declarations for PasswordEncoderInterface. I think it's a matter of opinion whether this change is a BC break. The BC promise doesn't cover such a case; I'd see it as a BC break to add exceptions in general, but in this case it's more of a "documentation" issue, as most implementations of the interface have been throwing those exceptions for years.

Commits
-------

f4cc30b72b Declare exceptions that are already thrown by implementations
2019-01-31 10:50:26 +01:00
Nicolas Grekas
25fcc3ed77 Merge branch '4.2'
* 4.2:
  [DI] Fix dumping Doctrine-like service graphs
  fix serialization workaround in CustomUserMessageAuthenticationException
  PHPUnit Bridge: Rollback to traditional array syntax.
  [Form] fix some docblocks and type checks
2019-01-30 18:52:12 +01:00
Nicolas Grekas
4f6541e4f5 Merge branch '3.4' into 4.2
* 3.4:
  [DI] Fix dumping Doctrine-like service graphs
  fix serialization workaround in CustomUserMessageAuthenticationException
  PHPUnit Bridge: Rollback to traditional array syntax.
  [Form] fix some docblocks and type checks
2019-01-30 18:51:38 +01:00
renanbr
542e9e29b9 fix serialization workaround in CustomUserMessageAuthenticationException 2019-01-30 16:28:03 +01:00
Nicolas Grekas
32aa969dff Merge branch '4.2'
* 4.2:
  [Routing] dont redirect routes with greedy trailing vars with no explicit slash
  skip native serialize among child and parent serializable objects
  [Routing] backport tests from 4.1
  [MonologBridge] Remove unused local variable
  Remove unreachable code
  Add PackageNameTest to ConfigurationTest also add in the changelog the corresponding entry to this PR
  Support use of hyphen in asset package name
  Fix format strings for deprecation notices
  Remove a harmless duplicate array key from VarDumper
  [VarDumper] Fixed search bar
  Remove gendered pronouns
  Replace gender by eye color in tests
  [Security] dont do nested calls to serialize()
2019-01-29 10:50:57 +01:00
Nicolas Grekas
adbdec838a Merge branch '4.1' into 4.2
* 4.1:
  [Routing] dont redirect routes with greedy trailing vars with no explicit slash
  skip native serialize among child and parent serializable objects
  [Routing] backport tests from 4.1
  [MonologBridge] Remove unused local variable
  Remove unreachable code
  Add PackageNameTest to ConfigurationTest also add in the changelog the corresponding entry to this PR
  Support use of hyphen in asset package name
  Remove gendered pronouns
  Replace gender by eye color in tests
  [Security] dont do nested calls to serialize()
2019-01-29 10:49:29 +01:00
Nicolas Grekas
78c23c7838 Merge branch '3.4' into 4.1
* 3.4:
  skip native serialize among child and parent serializable objects
  [Routing] backport tests from 4.1
  Add PackageNameTest to ConfigurationTest also add in the changelog the corresponding entry to this PR
  Support use of hyphen in asset package name
  Remove gendered pronouns
  Replace gender by eye color in tests
  [Security] dont do nested calls to serialize()
2019-01-29 10:21:38 +01:00
Renan
10256fc4fd skip native serialize among child and parent serializable objects 2019-01-29 10:04:09 +01:00
Nicolas Grekas
41000f1de0 [Security] dont do nested calls to serialize() 2019-01-25 18:08:32 +01:00
Nicolas Grekas
d8af8b6edd Merge branch '4.2'
* 4.2:
  Bump phpunit bridge cache id
  [appveyor] fix create-project phpunit
  Fix HttpKernel Debug requirement
  Fix heredoc
  use final annotation to allow mocking the class
  synchronise the form builder docblock
  Grammar fix in exception message
  fix tests
  forward the parse error to the calling code
  Avoid dots in generated class names.
  [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends
  ensure compatibility with older PHPUnit mocks
  [Security] Do not mix usage of password_*() functions and sodium_*() ones
2019-01-24 22:40:22 +01:00
Nicolas Grekas
61bf16c71d Merge branch '4.1' into 4.2
* 4.1:
  Bump phpunit bridge cache id
  [appveyor] fix create-project phpunit
  Fix HttpKernel Debug requirement
  Fix heredoc
  use final annotation to allow mocking the class
  synchronise the form builder docblock
  Grammar fix in exception message
  fix tests
  forward the parse error to the calling code
  [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends
  ensure compatibility with older PHPUnit mocks
  [Security] Do not mix usage of password_*() functions and sodium_*() ones
2019-01-24 22:39:51 +01:00
Nicolas Grekas
aff17e2cc4 Merge branch '3.4' into 4.1
* 3.4:
  Bump phpunit bridge cache id
  [appveyor] fix create-project phpunit
  Fix HttpKernel Debug requirement
  Fix heredoc
  use final annotation to allow mocking the class
  synchronise the form builder docblock
  Grammar fix in exception message
  fix tests
  forward the parse error to the calling code
  [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends
  ensure compatibility with older PHPUnit mocks
  [Security] Do not mix usage of password_*() functions and sodium_*() ones
2019-01-24 22:39:39 +01:00
Christian Flothmann
1da00db247 use final annotation to allow mocking the class 2019-01-22 15:51:10 +01:00
Robin Chalas
b972d15d52 bug #29863 [Security] Do not mix password_*() API with libsodium one (chalasr)
This PR was merged into the 3.4 branch.

Discussion
----------

[Security] Do not mix password_*() API with libsodium one

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | n/a
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Argon2IPasswordEncoder uses native `password_hash()` and `password_verify()` functions if the current PHP installation embeds Argon2 support (>=7.2, compiled `--with-password-argon2`).
Otherwise, it fallbacks to the libsodium extension.

This was fine at time the encoder was introduced, but meanwhile libsodium changed the algorithm used by `sodium_crypto_pwhash_str()` which is now argon2id, that goes outside of the scope of the encoder which was designed to deal with `argon2i` only.
Nothing we can do as databases may already contain passwords hashed with argon2id, the encoder must keep validating those.

However, the PHP installation may change as time goes by, and could suddenly embed the Argon2 core integration. In this case, the encoder would use the `password_verify()` function which would fail in case the password was not hashed using argon2i.
This PR prevents it by detecting that argon2id was used, avoiding usage of `password_verify()`.

See https://github.com/jedisct1/libsodium-php/issues/194 and https://github.com/symfony/symfony/issues/28093 for references.
Patch cannot be tested as it is platform dependent.

Side note: I'm currently working on a new implementation for 4.3 that will properly supports argon2id (which has been added to the PHP core sodium integration in 7.3) and argon2i, distinctively.

Commits
-------

d6cfde94b4 [Security] Do not mix usage of password_*() functions and sodium_*() ones
2019-01-18 19:41:49 +01:00
Fabien Potencier
51a359c079 Merge branch '4.2' into short-array-master
* 4.2:
  fixed CS
  fixed CS
  fixed tests
  fixed CS
  fixed CS
  fixed CS
  fixed short array CS in comments
  fixed CS in ExpressionLanguage fixtures
  fixed CS in generated files
  fixed CS on generated container files
  fixed CS on Form PHP templates
  fixed CS on YAML fixtures
  fixed fixtures
  switched array() to []
2019-01-16 22:53:39 +01:00
Fabien Potencier
e03db43894 fixed CS 2019-01-16 22:31:25 +01:00
Fabien Potencier
d2098d7e5d fixed CS 2019-01-16 21:35:37 +01:00
Fabien Potencier
c0323bd24b Merge branch '4.1' into 4.2
* 4.1:
  fixed tests
  fixed CS
  fixed CS
  fixed CS
  fixed short array CS in comments
  fixed CS in ExpressionLanguage fixtures
  fixed CS in generated files
  fixed CS on generated container files
  fixed CS on Form PHP templates
  fixed CS on YAML fixtures
  fixed fixtures
  switched array() to []
2019-01-16 21:31:39 +01:00
Fabien Potencier
d58b5c3b76 fixed CS 2019-01-16 19:35:49 +01:00
Fabien Potencier
572864b223 Merge branch '3.4' into 4.1
* 3.4:
  fixed CS
  fixed short array CS in comments
  fixed CS in ExpressionLanguage fixtures
  fixed CS in generated files
  fixed CS on generated container files
  fixed CS on Form PHP templates
  fixed CS on YAML fixtures
  fixed fixtures
  switched array() to []
2019-01-16 19:21:11 +01:00
Fabien Potencier
1429267f9c fixed short array CS in comments 2019-01-16 14:27:11 +01:00
Fabien Potencier
33a001e460 switched array() to [] 2019-01-16 10:39:14 +01:00
Robin Chalas
d6cfde94b4 [Security] Do not mix usage of password_*() functions and sodium_*() ones 2019-01-12 03:20:20 +01:00
Stefan Kruppa
f4cc30b72b Declare exceptions that are already thrown by implementations 2019-01-04 17:03:46 +01:00
Christian Flothmann
3860d685f4 Merge branch '4.2'
* 4.2:
  update years in license files
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  access the container getting it from the kernel
  Replace slave and master by replica and primary
  Fix erasing cookies issue
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [VarExporter] fix exporting array indexes
  [SecurityBundle] Fix traceable voters
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  Fixed minor typos in an error message
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:16:58 +01:00
Christian Flothmann
3007e36a5c Merge branch '4.1' into 4.2
* 4.1:
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  access the container getting it from the kernel
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:07:35 +01:00
Christian Flothmann
4973a5e9e1 Merge branch '3.4' into 4.1
* 3.4:
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:05:57 +01:00