* 3.4:
disallow FrameworkBundle 4.4+
propagate validation groups to subforms
[Form] [Validator] Add failing testcase to demonstrate group sequence issue
This PR was merged into the 3.4 branch.
Discussion
----------
[Form] propagate validation groups to subforms
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#38300
| License | MIT
| Doc PR |
Commits
-------
04f5698e29 propagate validation groups to subforms
e2c7c3373d [Form] [Validator] Add failing testcase to demonstrate group sequence issue
This PR was merged into the 3.4 branch.
Discussion
----------
[FrameworkBundle] disallow FrameworkBundle 4.4+
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets |
| License | MIT
| Doc PR |
Since #34619 (merged in 4.4.1) the request stack can no longer be passed as an argument to the `HtmlErrorRenderer` constructor. However, FrameworkBundle 4.4 refuses to be used with WebProfilerBundle 3.4 since #34369 (merged in 4.4.0-RC1).
Commits
-------
ad45e9cfdd disallow FrameworkBundle 4.4+
This PR was merged into the 4.4 branch.
Discussion
----------
[HttpClient] fix unsetting context[ssl][peer_name]
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | no (fixing a not released fix)
| New feature? | no
| Deprecations? | no
| Tickets | Fix https://github.com/symfony/symfony/pull/38375#issuecomment-702621658
| License | MIT
| Doc PR | -
/cc @bohanyang could you please confirm this fixes it?
Commits
-------
8eb8a7c400 [HttpClient] fix unsetting context[ssl][peer_name]
* 5.1:
[HttpClient] fix using proxies with NativeHttpClient
[4.4] Ignore more deprecations for Mockery mocks
[Routing] fix using !important and defaults/reqs in inline route definitions
[ErrorHandler][DebugClassLoader] Do not check Mockery mocks classes
[HttpClient] Fix using https with proxies
[TwigBundle] Only remove kernel exception listener if twig is used
[DI] Fix changelog
Remove CHANGELOG files for 4.x
Adjust expired range check
Fix redis connection error message
[DI] fix dumping non-shared lazy services
* 4.4:
[HttpClient] fix using proxies with NativeHttpClient
[4.4] Ignore more deprecations for Mockery mocks
[Routing] fix using !important and defaults/reqs in inline route definitions
[ErrorHandler][DebugClassLoader] Do not check Mockery mocks classes
[HttpClient] Fix using https with proxies
[TwigBundle] Only remove kernel exception listener if twig is used
Adjust expired range check
Fix redis connection error message
This PR was merged into the 4.4 branch.
Discussion
----------
[HttpClient] fix using proxies with NativeHttpClient
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
As spotted by @stof in https://github.com/symfony/symfony/pull/38368#issuecomment-702272737, we cannot use local DNS resolution with HTTP proxies.
Commits
-------
28f301bf03 [HttpClient] fix using proxies with NativeHttpClient
This PR was merged into the 4.4 branch.
Discussion
----------
[Routing] fix using !important and defaults/reqs in inline route definitions
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#33224
| License | MIT
| Doc PR | -
Commits
-------
826db225b7 [Routing] fix using !important and defaults/reqs in inline route definitions
This PR was squashed before being merged into the 5.2-dev branch.
Discussion
----------
[RateLimiter] Fix cache storage (use namespaced pool + remove \Serializable)
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#38365, fix#38338
| License | MIT
| Doc PR | -
Commits
-------
251c202874 Use a dedicated cache.rate_limiter cache pool
5dc562a318 Use __sleep/__wakeup instead of Serializable
This PR was merged into the 5.2-dev branch.
Discussion
----------
[Messenger] Added ErrorDetailsStamp
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | yes
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #32311
| License | MIT
| Doc PR | No doc changes are needed
#SymfonyHackday
This PR is part of the work started in #32341. That PR has a workaround for showing exceptions added to a previous retry. This PR stores error messages in a separate stamp, so they're more easily accessed.
I also added the exceptionClass as a separate string (independant of FlattenException), so that information is always available, even if the trace is not (due to FlattenException not being available).
Duplicated exceptions (compared to the last one) are not stored separately.
**Questions:**
- Should we limit the total amount of exceptions (remove the oldest when adding a new one)?
- Yes, but in a new PR
- The current implementation adds this stamp in the Worker instead of the listeners to prevent duplicate code (due to the immutability of the envelope in the event). Is this the proper way to do this?
- No, create a new listener and a way to add stamps to the envelope inside the event.
- When adding details of a `HandlerFailedException`, should we add a stamp per wrapped `Throwable`? There can be multiple errors wrapped by a single `HandlerFailedException`.
- Yes, but in a later PR
**Todo:**
- [x] only add new information if it differs from the previous exception
- [x] add deprecations
- [x] fall back to old stamp data if no new stamp is available
- [x] rebase and retarget to master
- [x] update CHANGELOG.md
- [x] check for docs PR
**BC Breaks:**
When this PR is merged, RedeliveryStamps will no longer be populated with exception data. Any implementations that use `RedeliveryStamp::getExceptionMessage()` or `RedeliveryStamp::getFlattenedException()` will receive an empty string or `null` respectively for stamps added after this update. They should rely on `ErrorDetailsStamp` instead.
**New stuff:**
- New stamp `ErrorDetailsStamp`.
- New event subscriber `AddErrorDetailsStampListener`.
- New method `AbstractWorkerMessageEvent::addStamps`.
Commits
-------
cd27b863f9 [Messenger] Added FailedMessageErrorDetailsStamp
This PR was squashed before being merged into the 5.2-dev branch.
Discussion
----------
[Messenger] dispatch event when a message is retried
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| Deprecations? | no
| License | MIT
Hello,
i'm working on a bundle which helps to monitor messenger queues (add some stats for queues/transports + ability to manage failed messages from the browser)
https://github.com/SymfonyCasts/messenger-monitor-bundle/
and we're missing some hooks in the messaging system:
1. a way to know when a message has been retried (fixed by dispatching a new `WorkerMessageRetriedEvent` in `SendFailedMessageForRetryListener::onMessageFailed()`)
2. a way to update the enveloppe in worker message events (fixed by adding `AbstractWorkerMessageEvent::setEnvelope()`)
if needed i can provide some precise use cases.
thanks.
Commits
-------
55bddcb721 [Messenger] dispatch event when a message is retried
This PR was submitted for the 5.1 branch but it was merged into the 5.2-dev branch instead.
Discussion
----------
Can define ChatMessage transport to null
| Q | A
| ------------- | ---
| Branch? | 5.1
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | -
| License | MIT
I'm using notiier & messenger together to send notification asynchronously.
In order to have json messages in my broker, here is the messenger config I use:
```yaml
serializer:
default_serializer: messenger.transport.symfony_serializer
symfony_serializer:
format: json
context: { }
```
I send a new `ChatMessage`:
```php
use Symfony\Component\Notifier\ChatterInterface;
use Symfony\Component\Notifier\Message\ChatMessage;
$chatter->send(new ChatMessage('Using notifier & messenger together is amazing!');
```
Message is correctly sent to my broker, in json:
```json
{
"subject": "Using notifier & messenger together is amazing!",
"recipientId": null,
"options": null,
"transport": null,
"notification": null
}
```
But when I want to consume it, as the `transport` method used by the serializer to create the `ChatMessage` doesn't accept `null` value, I get the following error:
```
[Symfony\Component\Messenger\Exception\MessageDecodingFailedException]
Could not decode message: Failed to denormalize attribute "transport" value for class "Symfony\Component\Notifier\Message\ChatMessage": Expected argument of type "string", "null" given at property path "transport".
```
This PR correct the problem, even if I'm not sure it's the best way to go...
Commits
-------
09c9bde479 Can define ChatMessage transport to null
This PR was merged into the 5.2-dev branch.
Discussion
----------
[HttpClient] provide response body to the RetryDecider
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| Deprecations? | yes but for not-yet released 5.2 feature
| Tickets | /
| License | MIT
| Doc PR | TODO
Some servers, like AWS, does not always return standard HTTP code. The strategy needs to parse the body to take a decision.
example:
```
400
x-amzn-requestid: XXXXX
content-type: application/x-amz-json-1.1
content-length: 58
date: Thu, 24 Sep 2020 11:17:35 GMT
connection: close
{"__type":"ThrottlingException","message":"Rate exceeded"}
````
This PR update the `RetryDeciderInterface` interface to let the decider notifying the Client when it need the body to take a decision. in that case, the Client, fetch te client, and call again the decider with the full body.
usage
```php
class Decider implements RetryDeciderInterface {
public function shouldRetry(string $requestMethod, string $requestUrl, array $requestOptions, int $responseCode, array $responseHeaders, ?string $responseContent, \Throwable $throwable = null): ?bool
{
if (null !== $throwable) {
return true;
}
if (in_array($responseCode, [423, 425, 429, 500, 502, 503, 504, 507, 510])) {
return true;
}
if (
$responseCode !== 400
|| $headers['content-type'][0] ?? null !== 'application/x-amz-json-1.1'
|| (int) $headers['content-length'][0] ?? '0' > 1024
) {
return false;
}
if (null === $responseContent) {
return null; // null mean no decision taken and need to be called again with the body
}
$data = json_decode($responseContent, true);
return $data['__type'] ?? '' === 'ThrottlingException';
}
}
```
Commits
-------
321be5884d [HttpClient] provide response body to the RetryDecider
This PR was squashed before being merged into the 4.4 branch.
Discussion
----------
[HttpClient] Fix using https with proxies
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| License | MIT
| Doc PR | -
According to my test, when `request_fulluri` is set to true,
the host appears in the URL will be the Host header,
even if the Host header is set in the context http header.
Since HttpClient has its own DNS cache, the host inside the URL is usually an IP address.
So this can break many things.
```
{
"args": {},
"headers": {
"Accept": "*/*",
"Accept-Encoding": "gzip",
"Host": "3.211.1.78",
"User-Agent": "Symfony HttpClient/Native",
"X-Amzn-Trace-Id": "Root=1-5f75a59e-62c8c81e4490e09c700d6180"
},
"origin": "xxx.xxx.xxx.xxx",
"url": "https://3.211.1.78/get"
}
* Hostname was NOT found in DNS cache
* Added httpbin.org:0:3.211.1.78 to DNS cache
* Establish HTTP proxy tunnel to tcp://10.22.22.21:7777
> GET https://3.211.1.78/get HTTP/1.1
Accept: */*
Accept-Encoding: gzip
Host: httpbin.org
User-Agent: Symfony HttpClient/Native
< HTTP/1.1 200 OK
< Date: Thu, 01 Oct 2020 09:47:10 GMT
< Content-Type: application/json
< Content-Length: 300
< Connection: close
< Server: gunicorn/19.9.0
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Credentials: true
<
```
I've also found this https://github.com/guzzle/guzzle/issues/791
We can also create an option to make it customizable.
Commits
-------
7e0cd4e621 [HttpClient] Fix using https with proxies
This PR was squashed before being merged into the 4.4 branch.
Discussion
----------
[TwigBundle] Only remove kernel exception listener if twig is used
| Q | A
| ------------- | ---
| Branch? | 4.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | https://github.com/contao/contao/issues/1527
| License | MIT
| Doc PR |
In a setup using the template engine but not twig as the template engine no exceptions are logged. This is caused by the twig-bundle which removes the `exception_listener` service. For my understanding this should only happen if twig is used as template engine. This PR fixes the logic that only for the case where twig is enabled as template engine the http kernel exception listener is removed. Otherwise the twig exception listener got removed now.
Disclaimer: I'm not too deep into the details, so maybe I oversee something why it's implemented the way it is.
Commits
-------
7c34f6e866 [TwigBundle] Only remove kernel exception listener if twig is used
This PR was merged into the 5.1 branch.
Discussion
----------
[DI] Fix changelog
| Q | A
| ------------- | ---
| Branch? | 5.1
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
This one's confusing with L7, the actual deprecation.
Commits
-------
d784b50da3 [DI] Fix changelog
This PR was merged into the 3.4 branch.
Discussion
----------
[BrowserKit] Cookie expiration at current timestamp
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| License | MIT
In `Symfony\Component\BrowserKit\Cookie` a cookie is expired if the `expires` timestamp is in the past. I would like to change it to also be expired if the `expires` timestamp equals the current exact timestamp. This would still be in line with [RFC 6265](https://tools.ietf.org/html/rfc6265#section-4.1.2.1), as it states `The Expires attribute indicates the maximum lifetime of the cookie, represented as the date and time at which the cookie expires`.
Reason for this change: Cookies usually both have `expires` and `Max-Age` set, and Symfony sets `Max-Age` to zero if a cookie is expired (in `Symfony\Component\HttpFoundation\Cookie`). When converting cookies between string and object representations, `Max-Age` is the preferred source of truth for the expiration, but `Max-Age` set to zero is converted to an `expires` timestamp at this exact second, currently making the cookie not expired in `Symfony\Component\BrowserKit\Cookie`, even though it should be.
I noticed this discrepancy in my tests when checking if a cookie no longer existed after deleting it, yet it was still there, because `Cookie` thought it would only expire after the `expires` timestamp had passed. I am also thinking of raising an issue for `Symfony\Component\HttpFoundation\Cookie`, as importing and exporting an expired cookie (via strings) changes the `expired` value. I thought this change was a simpler one for now, and should have no negative/unexpected impact.
Commits
-------
9d187c0d1a Adjust expired range check
This PR was merged into the 5.1 branch.
Discussion
----------
Remove CHANGELOG files for 4.x
| Q | A
| ------------- | ---
| Branch? | 5.0 (maintenance only)
| Bug fix? | no
| New feature? | no
| Deprecations? | no
| Tickets | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
See #36436
Commits
-------
e0f90b4032 Remove CHANGELOG files for 4.x
This PR was merged into the 5.1 branch.
Discussion
----------
[DI] fix dumping non-shared lazy services
| Q | A
| ------------- | ---
| Branch? | 5.1
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | Fix#38327
| License | MIT
| Doc PR | -
It took me a while to get this correct, but here we are.
Commits
-------
e33a0b0f94 [DI] fix dumping non-shared lazy services
This PR was merged into the 5.2-dev branch.
Discussion
----------
[Security][RateLimiter] Added request rate limiter to prevent breadth-first attacks
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | yes
| Deprecations? | no
| Tickets | -
| License | MIT
| Doc PR | -
This allows limiting on different elements of a request. The normal `CompoundLimiter` requires the same key for all its limiters.
This request limiter is useful to e.g. prevent breadth-first attacks, by allowing to enforce a limit on both IP and IP+username. It can also be useful for applications using some sort of API request limiting (or e.g. file upload limiting).
The default login throttling limiter will allow `max_attempts` (default: 5) attempts per minute for `username + IP` and `5 * max_attempts` for `IP`. Customizing this will require creating a new service that extends `AbstractRequestRateLimiter` and implementing `getLimiters(Request $request): LimiterInterface[]`.
Commits
-------
5d03afea99 Added request rate limiters and improved login throttling
This PR was squashed before being merged into the 5.2-dev branch (closes#38351).
Discussion
----------
[Console] clone stream on multiline questions so EOT doesn't close input
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| Tickets | N/A
| License | MIT
| Doc PR | N/A
This fixes a bug in the multiline question feature that was introduced in #37683.
Today, @epitre commented on https://github.com/symfony/symfony/pull/37683#issuecomment-700666826:
> If I ask a question AFTER using the multiline option in a previous question, then it seems that the ctrl+d is kind of saved, and the command gets aborted.
I'm honestly not sure how I missed this while working on #37683, since I was testing it with multiple questions, but I think it might have resulted from some of the back-and-forth and the lack of ability to effectively test the EOT character from a unit test.
The solution was to _clone_ the input stream resource and use the clone to read the multiline input and capture the EOT byte. In this way, the primary input stream is not closed by the EOT.
This is similar to @epitre's solution in https://github.com/symfony/symfony/pull/38345, but I'm using the `uri` and `mode` from `stream_get_meta_data()` to create the new stream, and if the existing stream has any data and is seekable and writable (like the streams used in the tests), I add the data to the clone and seek to the same offset.
I've ensured that this solution works on a question that is in the middle of a series of other questions, and I've tested in on *nix and Windows. I've also improved the tests for multiline questions. While I'm unable to test (with a unit test) that an EOT character effectively stops reading from STDIN while continuing to the next question and prompt, I feel confident that the tests here provide sufficient coverage.
Commits
-------
ec688a361e [Console] clone stream on multiline questions so EOT doesn't close input