Commit Graph

2783 Commits

Author SHA1 Message Date
Nicolas Grekas
aff17e2cc4 Merge branch '3.4' into 4.1
* 3.4:
  Bump phpunit bridge cache id
  [appveyor] fix create-project phpunit
  Fix HttpKernel Debug requirement
  Fix heredoc
  use final annotation to allow mocking the class
  synchronise the form builder docblock
  Grammar fix in exception message
  fix tests
  forward the parse error to the calling code
  [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends
  ensure compatibility with older PHPUnit mocks
  [Security] Do not mix usage of password_*() functions and sodium_*() ones
2019-01-24 22:39:39 +01:00
Christian Flothmann
1da00db247 use final annotation to allow mocking the class 2019-01-22 15:51:10 +01:00
Robin Chalas
b972d15d52 bug #29863 [Security] Do not mix password_*() API with libsodium one (chalasr)
This PR was merged into the 3.4 branch.

Discussion
----------

[Security] Do not mix password_*() API with libsodium one

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | n/a
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Argon2IPasswordEncoder uses native `password_hash()` and `password_verify()` functions if the current PHP installation embeds Argon2 support (>=7.2, compiled `--with-password-argon2`).
Otherwise, it fallbacks to the libsodium extension.

This was fine at time the encoder was introduced, but meanwhile libsodium changed the algorithm used by `sodium_crypto_pwhash_str()` which is now argon2id, that goes outside of the scope of the encoder which was designed to deal with `argon2i` only.
Nothing we can do as databases may already contain passwords hashed with argon2id, the encoder must keep validating those.

However, the PHP installation may change as time goes by, and could suddenly embed the Argon2 core integration. In this case, the encoder would use the `password_verify()` function which would fail in case the password was not hashed using argon2i.
This PR prevents it by detecting that argon2id was used, avoiding usage of `password_verify()`.

See https://github.com/jedisct1/libsodium-php/issues/194 and https://github.com/symfony/symfony/issues/28093 for references.
Patch cannot be tested as it is platform dependent.

Side note: I'm currently working on a new implementation for 4.3 that will properly supports argon2id (which has been added to the PHP core sodium integration in 7.3) and argon2i, distinctively.

Commits
-------

d6cfde94b4 [Security] Do not mix usage of password_*() functions and sodium_*() ones
2019-01-18 19:41:49 +01:00
Fabien Potencier
51a359c079 Merge branch '4.2' into short-array-master
* 4.2:
  fixed CS
  fixed CS
  fixed tests
  fixed CS
  fixed CS
  fixed CS
  fixed short array CS in comments
  fixed CS in ExpressionLanguage fixtures
  fixed CS in generated files
  fixed CS on generated container files
  fixed CS on Form PHP templates
  fixed CS on YAML fixtures
  fixed fixtures
  switched array() to []
2019-01-16 22:53:39 +01:00
Fabien Potencier
e03db43894 fixed CS 2019-01-16 22:31:25 +01:00
Fabien Potencier
d2098d7e5d fixed CS 2019-01-16 21:35:37 +01:00
Fabien Potencier
c0323bd24b Merge branch '4.1' into 4.2
* 4.1:
  fixed tests
  fixed CS
  fixed CS
  fixed CS
  fixed short array CS in comments
  fixed CS in ExpressionLanguage fixtures
  fixed CS in generated files
  fixed CS on generated container files
  fixed CS on Form PHP templates
  fixed CS on YAML fixtures
  fixed fixtures
  switched array() to []
2019-01-16 21:31:39 +01:00
Fabien Potencier
d58b5c3b76 fixed CS 2019-01-16 19:35:49 +01:00
Fabien Potencier
572864b223 Merge branch '3.4' into 4.1
* 3.4:
  fixed CS
  fixed short array CS in comments
  fixed CS in ExpressionLanguage fixtures
  fixed CS in generated files
  fixed CS on generated container files
  fixed CS on Form PHP templates
  fixed CS on YAML fixtures
  fixed fixtures
  switched array() to []
2019-01-16 19:21:11 +01:00
Fabien Potencier
1429267f9c fixed short array CS in comments 2019-01-16 14:27:11 +01:00
Fabien Potencier
33a001e460 switched array() to [] 2019-01-16 10:39:14 +01:00
Robin Chalas
d6cfde94b4 [Security] Do not mix usage of password_*() functions and sodium_*() ones 2019-01-12 03:20:20 +01:00
Stefan Kruppa
f4cc30b72b Declare exceptions that are already thrown by implementations 2019-01-04 17:03:46 +01:00
Christian Flothmann
3860d685f4 Merge branch '4.2'
* 4.2:
  update years in license files
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  access the container getting it from the kernel
  Replace slave and master by replica and primary
  Fix erasing cookies issue
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [VarExporter] fix exporting array indexes
  [SecurityBundle] Fix traceable voters
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  Fixed minor typos in an error message
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:16:58 +01:00
Christian Flothmann
3007e36a5c Merge branch '4.1' into 4.2
* 4.1:
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  access the container getting it from the kernel
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:07:35 +01:00
Christian Flothmann
4973a5e9e1 Merge branch '3.4' into 4.1
* 3.4:
  Fix: Adjust DocBlock
  \"ParserTest->getParserTestData()\" -> only some more tests
  [Lock] Pedantic improvements for lock
  [EventDispatcher] Fixed phpdoc on interface
  update year in license files
  [Console] Fix help text for single command applications
  Fix random test failure on lock
  improve error message when using test client without the BrowserKit component
  [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset now sets callStack to null with test to dispatch after reset.
  Fixed minor typos
  Fix: Method can also return null
  [Stopwatch] Fixed phpdoc for category name
2019-01-03 10:05:57 +01:00
Christian Flothmann
6c895b9757 update year in license files 2019-01-01 14:45:19 +01:00
Nicolas Grekas
edb12b48c7 Merge branch '4.2'
* 4.2:
  [Twig] Remove spaces to fix whitespace in tags
  [Twig] Replace for-loops with blocks for attributes
  fixed CS
  [Tests] Change to willThrowException
  [Console] fix PHPDoc in Command
  Update FileLoaderLoadException.php
  Fix wrong calls to clearstatcache
  Add Vietnamese translation for validators
  Allow running PHPUnit with "xdebug.scream" ON
  [VarDumper] Add descriptors tests
  [Cache] fix bad optim
  [Yaml] detect circular references
  [DI] fix reporting bindings on overriden services as unused
  [Routing] minor fix or previous PR
2018-12-24 11:03:37 +01:00
Nicolas Grekas
5ee0c04fd7 Merge branch '4.1' into 4.2
* 4.1:
  [Twig] Replace for-loops with blocks for attributes
  fixed CS
  [Tests] Change to willThrowException
  [Console] fix PHPDoc in Command
  Update FileLoaderLoadException.php
  Fix wrong calls to clearstatcache
  Add Vietnamese translation for validators
  Allow running PHPUnit with "xdebug.scream" ON
  [VarDumper] Add descriptors tests
  [Yaml] detect circular references
  [DI] fix reporting bindings on overriden services as unused
  [Routing] minor fix or previous PR
2018-12-24 11:01:29 +01:00
Fabien Potencier
729edde312 Merge branch '3.4' into 4.1
* 3.4:
  [Tests] Change to willThrowException
  [Console] fix PHPDoc in Command
  Fix wrong calls to clearstatcache
  Add Vietnamese translation for validators
  Allow running PHPUnit with "xdebug.scream" ON
  [Yaml] detect circular references
2018-12-23 15:06:12 +01:00
George Mponos
0695834657 [Tests] Change to willThrowException 2018-12-23 15:04:59 +01:00
Nicolas Grekas
75eebcf7dc Merge branch '4.2'
* 4.2:
  [Routing] fix trailing slash redirections involving a trailing var
  [EventDispatcher] Revers event tracing order
  [Security] Prefer clone over unserialize(serialize()) for user refreshment
  [Console] OutputFormatter: move strtolower to createStyleFromString
  Adjust tests to work in the armhf architecture. Fixes #29281.
  Vietnamese translations improvement
  [Form] Fixed FormErrorIterator class phpdoc
  Renamed test controller from Controller to TestController so it doesn't show up in the IDE autocomplete.
  Don't use he in docs when its not needed
  EventSubscriberInterface isn't a man
  Fix undefined variable in cache ArrayTrait
  fixed public directory of web server and assets install when configured in composer.json
2018-12-17 14:49:19 +01:00
Nicolas Grekas
8a6090793b Merge branch '4.1' into 4.2
* 4.1:
  [Routing] fix trailing slash redirections involving a trailing var
  [EventDispatcher] Revers event tracing order
  [Security] Prefer clone over unserialize(serialize()) for user refreshment
  [Console] OutputFormatter: move strtolower to createStyleFromString
  Adjust tests to work in the armhf architecture. Fixes #29281.
  Vietnamese translations improvement
  [Form] Fixed FormErrorIterator class phpdoc
  Renamed test controller from Controller to TestController so it doesn't show up in the IDE autocomplete.
  Don't use he in docs when its not needed
  EventSubscriberInterface isn't a man
  fixed public directory of web server and assets install when configured in composer.json
2018-12-17 14:32:53 +01:00
Nicolas Grekas
7ccd4df8ad Merge branch '3.4' into 4.1
* 3.4:
  [EventDispatcher] Revers event tracing order
  [Security] Prefer clone over unserialize(serialize()) for user refreshment
  [Console] OutputFormatter: move strtolower to createStyleFromString
  Adjust tests to work in the armhf architecture. Fixes #29281.
  Vietnamese translations improvement
  [Form] Fixed FormErrorIterator class phpdoc
  Renamed test controller from Controller to TestController so it doesn't show up in the IDE autocomplete.
  Don't use he in docs when its not needed
  EventSubscriberInterface isn't a man
  fixed public directory of web server and assets install when configured in composer.json
2018-12-17 11:22:03 +01:00
Robin Chalas
a8eba803a3 [Security] Prefer clone over unserialize(serialize()) for user refreshment 2018-12-15 11:33:19 +01:00
Tri Pham
93a0c98cc2 Vietnamese translations improvement 2018-12-14 13:19:56 +01:00
Nicolas Grekas
df4ad4e7d4 Merge branch '4.2'
* 4.2: (27 commits)
  [VarExporter] dont call userland code with uninitialized objects
  Fix typos in doc blocks
  [Debug] ignore underscore vs backslash namespaces in DebugClassLoader
  [TwigBridge][Form] Prevent multiple rendering of form collection prototypes
  [FrameworkBundle] fix describing routes with no controllers
  [DI] move RegisterServiceSubscribersPass before DecoratorServicePass
  Update ValidationListener.php
  [Yaml] ensures that the mb_internal_encoding is reset to its initial value
  [Messenger] Restore message handlers laziness
  [WebLink] Fixed documentation link
  [Security] getTargetPath of TargetPathTrait must return string or null
  [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument
  Optimize perf by replacing call_user_func with dynamic vars
  [Cache] Fix dsn parsing
  [Routing] fix dumping same-path routes with placeholders
  [WebProfilerBundle][TwigBundle] CSS fixes
  Add a docblock for FormFactoryInterface
  [Security] defer log message in guard authenticator
  [Validator] Added IBAN format for Vatican City State
  merge conflicts
  ...
2018-12-13 13:43:21 +01:00
Nicolas Grekas
b88728a13a Merge branch '4.1' into 4.2
* 4.1:
  Fix typos in doc blocks
  [Debug] ignore underscore vs backslash namespaces in DebugClassLoader
  [TwigBridge][Form] Prevent multiple rendering of form collection prototypes
  [FrameworkBundle] fix describing routes with no controllers
  [DI] move RegisterServiceSubscribersPass before DecoratorServicePass
  Update ValidationListener.php
  [Yaml] ensures that the mb_internal_encoding is reset to its initial value
  [WebLink] Fixed documentation link
  [Security] getTargetPath of TargetPathTrait must return string or null
  [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument
  Optimize perf by replacing call_user_func with dynamic vars
  [Routing] fix dumping same-path routes with placeholders
  [Security] defer log message in guard authenticator
  [Validator] Added IBAN format for Vatican City State
  merge conflicts
  filter out invalid Intl values
  filter out invalid language values
  [Validator] Fixed grouped composite constraints
  [Form] Filter arrays out of scalar form types
  Fix HeaderBag::get phpdoc
2018-12-13 13:39:50 +01:00
Nicolas Grekas
547bf26eee Merge branch '3.4' into 4.1
* 3.4:
  [Debug] ignore underscore vs backslash namespaces in DebugClassLoader
  [TwigBridge][Form] Prevent multiple rendering of form collection prototypes
  [FrameworkBundle] fix describing routes with no controllers
  [DI] move RegisterServiceSubscribersPass before DecoratorServicePass
  Update ValidationListener.php
  [Yaml] ensures that the mb_internal_encoding is reset to its initial value
  [WebLink] Fixed documentation link
  [Security] getTargetPath of TargetPathTrait must return string or null
  [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument
  [Security] defer log message in guard authenticator
  merge conflicts
  Fix HeaderBag::get phpdoc
2018-12-13 13:30:33 +01:00
Fabien Potencier
68b823f243 minor #29408 [Security] getTargetPath of TargetPathTrait must return string or null (gmponos)
This PR was squashed before being merged into the 3.4 branch (closes #29408).

Discussion
----------

[Security] getTargetPath of TargetPathTrait must return string or null

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes (possible bug)
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

Since the return type is string the default return value must be also string.

Commits
-------

8d4b787dd9 [Security] getTargetPath of TargetPathTrait must return string or null
2018-12-10 05:09:26 +01:00
Mponos George
8d4b787dd9 [Security] getTargetPath of TargetPathTrait must return string or null 2018-12-10 05:09:19 +01:00
Enrico Schultz
21c3030092 [Security] defer log message in guard authenticator
prevent an unneccessary log message if the guard authenticator does not support the current request
2018-12-09 17:00:22 +01:00
Nicolas Grekas
ee337dd761 Merge branch '4.2'
* 4.2:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:37:20 +00:00
Nicolas Grekas
95e4edba92 Merge branch '4.1' into 4.2
* 4.1:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:36:58 +00:00
Nicolas Grekas
34f6a4066d Merge branch '3.4' into 4.1
* 3.4:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:26:33 +00:00
Nicolas Grekas
3aaa5aba1b Merge branch '2.8' into 3.4
* 2.8:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:25:03 +00:00
Nicolas Grekas
410ed830c5 Merge branch '2.7' into 2.8
* 2.7:
  [Security\Http] detect bad redirect targets using backslashes
  [Form] Filter file uploads out of regular form types
  Fix CI
  minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas)
  [travis] fix composer.lock invalidation for PRs patching several components
  [travis] fix composer.lock invalidation for deps=low
  minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas)
  [travis] ignore ordering when validating composer.lock files for deps=low
  minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas)
  fix ci
  [travis] fix requiring mongodb/mongodb before composer up
  minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas)
  [2.7] Make CI green
  updated VERSION for 2.7.49
  updated CHANGELOG for 2.7.49
  [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer
  [HttpFoundation] Remove support for legacy and risky HTTP headers
  updated VERSION for 2.7.48
  update CONTRIBUTORS for 2.7.48
  updated CHANGELOG for 2.7.48
2018-12-06 11:12:46 +00:00
Christian Flothmann
99a0cec0a6 [Security\Http] detect bad redirect targets using backslashes 2018-11-29 16:25:45 +01:00
Fabien Potencier
534b83f080 updated version to 4.3 2018-11-26 17:19:01 +01:00
Nicolas Grekas
fd74951405 Merge branch '4.1'
* 4.1:
  [Form] Hardened test suite for empty data
  Bump phpunit XSD version to 5.2
  [Fwb][EventDispatcher][HttpKernel] Fix getClosureScopeClass usage to describe callables
  Add required key attribute
2018-11-11 20:52:12 +01:00
Nicolas Grekas
913781baac Merge branch '3.4' into 4.1
* 3.4:
  [Form] Hardened test suite for empty data
  Bump phpunit XSD version to 5.2
  [Fwb][EventDispatcher][HttpKernel] Fix getClosureScopeClass usage to describe callables
  Add required key attribute
2018-11-11 20:51:29 +01:00
Nicolas Grekas
e32b518818 Merge branch '2.8' into 3.4
* 2.8:
  [Form] Hardened test suite for empty data
  Bump phpunit XSD version to 5.2
  Add required key attribute
2018-11-11 20:48:54 +01:00
Grégoire Paris
4dce4b7c30
Bump phpunit XSD version to 5.2
Some attributes being used in the phpunit configuration files, namely
failOnRisky and failOnWarning were introduced in phpunit 5.2.0. The
Composer configuration shows that tests should run with old versions of
phpunit, but phpunit only validates the configuration against the XSD
since phpunit 7.2.0.
These changes can be tested as follows:

wget http://schema.phpunit.de/5.2/phpunit.xsd
xargs xmllint --schema phpunit.xsd  1>/dev/null
find src -name phpunit.xml.dist| xargs xmllint --schema phpunit.xsd  1>/dev/null

See 7e06a82806
See 46e3745a03/composer.json (L98)
2018-11-11 12:18:13 +01:00
Nicolas Grekas
0970b09796 Merge branch '4.1'
* 4.1:
  SCA: removed unused variables
  Remove duplicate condition
  fix useless space in docblock
  remove unneeded tearDown method
  [Intl] Update the ICU data to 63.1
  [FrameworkBundle] Fix broken exception message
  [Messenger] send using the routing_key for AMQP transport
  also clean away the NO_AUTO_CACHE_CONTROL_HEADER if we have no session
  [TwigBundle] Fix usage of TwigBundle without FrameworkBundle
  Revert "fixed CS"
  [Serializer] Reduce class discriminator overhead
  Skip empty proxy code
  [Security] Fix "exclude-from-classmap"
  [Security] Removed unsed trait import
  [Config] Fix @method annotation
  add missing double-quotes to extra_fields output message
  [DI] Default undefined env to empty string during compile
  Convert InsufficientAuthenticationException to HttpException
2018-10-30 18:11:56 +01:00
Nicolas Grekas
4b1db0d32c Merge branch '3.4' into 4.1
* 3.4:
  Remove duplicate condition
  fix useless space in docblock
  remove unneeded tearDown method
  [Intl] Update the ICU data to 63.1
  [FrameworkBundle] Fix broken exception message
  [TwigBundle] Fix usage of TwigBundle without FrameworkBundle
  Revert "fixed CS"
  Skip empty proxy code
  [Security] Fix "exclude-from-classmap"
  add missing double-quotes to extra_fields output message
  Convert InsufficientAuthenticationException to HttpException
2018-10-30 18:00:46 +01:00
Nicolas Grekas
faec03105f Merge branch '2.8' into 3.4
* 2.8:
  Remove duplicate condition
  fix useless space in docblock
  remove unneeded tearDown method
  [FrameworkBundle] Fix broken exception message
  Revert "fixed CS"
  Skip empty proxy code
  [Security] Fix "exclude-from-classmap"
  add missing double-quotes to extra_fields output message
  Convert InsufficientAuthenticationException to HttpException
2018-10-30 17:50:50 +01:00
Laurent VOULLEMIER
8abb05607b [Security][SecurityBundle] Add voter individual decisions to profiler 2018-10-28 18:49:26 +01:00
Darryl Hein
feba3816dc
remove unneeded tearDown method 2018-10-27 15:32:49 -06:00
Sam Fleming
9702a212e2
Remove reference to http digest authentication
Seeing as HTTP Digest has been deprecated / removed, the README shouldn't be advertising it as a feature.
2018-10-26 09:20:42 +01:00
Albert Casademont
7b256a985d
[Security] Fix "exclude-from-classmap"
The "/Tests/" directory doesn't exist in the Security Component, tests are located within the Security components folders and none of the tests were being excluded in an --classmap-authoritative dump of the autoload.
2018-10-19 23:57:12 +02:00
Grégoire Pineau
f99786314e [Security] Removed unsed trait import 2018-10-19 14:22:12 +02:00
Christian Flothmann
493c13a9fb Merge branch '4.1'
* 4.1:
  fix merge
2018-10-10 16:58:57 +02:00
Christian Flothmann
61cf143727 fix merge 2018-10-10 16:49:00 +02:00
Nicolas Grekas
8848a1aa30 Merge branch '4.1'
* 4.1: (27 commits)
  Added the Code of Conduct file
  do not override custom access decision configs
  [Security] Do not deauthenticate user when the first refreshed user has changed
  fix a return type hint
  invalidate stale commits for PRs too
  add missing cache prefix seed attribute to XSD
  fix command description
  Fix class documentation
  [Validator] Add a missing translation
  [FrameworkBundle] Fix 3.4 tests
  [DI] fix dumping inline services again
  Rename consumer to receiver
  Register messenger before the profiler
  Fix phpdocs
  [EventDispatcher] Remove template method in test case
  Added LB translation for #27993 (UUID validator message translation)
  Replace deprecated validateValue with validate
  [FWBundle] Automatically enable PropertyInfo when using Flex
  [Process] fix locking of pipe files on Windows
  Correct PHPDoc type for float ttl
  ...
2018-10-10 06:54:27 -07:00
Nicolas Grekas
d9c9e0cf52 Merge branch '3.4' into 4.1
* 3.4: (21 commits)
  Added the Code of Conduct file
  do not override custom access decision configs
  [Security] Do not deauthenticate user when the first refreshed user has changed
  invalidate stale commits for PRs too
  add missing cache prefix seed attribute to XSD
  fix command description
  Fix class documentation
  [Validator] Add a missing translation
  [FrameworkBundle] Fix 3.4 tests
  [DI] fix dumping inline services again
  Fix phpdocs
  [EventDispatcher] Remove template method in test case
  Added LB translation for #27993 (UUID validator message translation)
  Replace deprecated validateValue with validate
  [FWBundle] Automatically enable PropertyInfo when using Flex
  [Process] fix locking of pipe files on Windows
  Correct PHPDoc type for float ttl
  bumped Symfony version to 3.4.18
  updated VERSION for 3.4.17
  updated CHANGELOG for 3.4.17
  ...
2018-10-10 06:52:42 -07:00
Vincent Chalamon
4503ac8e9f
Convert InsufficientAuthenticationException to HttpException 2018-10-10 14:45:47 +02:00
Robin Chalas
2f0e5d7a83 bug #28072 [Security] Do not deauthenticate user when the first refreshed user has changed (gpekz)
This PR was squashed before being merged into the 3.4 branch (closes #28072).

Discussion
----------

[Security] Do not deauthenticate user when the first refreshed user has changed

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Currently the token is deauthenticated when the first refreshed user has changed. In theory, a second user provider could find a user that is the same than the user stored in the token.

Also, the deauthentication is currently affected by the order of the user providers in the security.yaml and IMHO it does not make sense.

Commits
-------

95dce67 [Security] Do not deauthenticate user when the first refreshed user has changed
2018-10-10 10:05:32 +02:00
Geoffrey Pécro
95dce67629 [Security] Do not deauthenticate user when the first refreshed user has changed 2018-10-10 10:05:21 +02:00
Robin Chalas
5093b9fb47 [Security] Deprecate simple_preauth and simple_form in favor of Guard 2018-10-03 09:02:12 +02:00
Nicolas Grekas
a9c90ca77a Merge branch '4.1'
* 4.1: (21 commits)
  [php_cs] disable fopen_flags
  [DI] fix error in dumped container
  [CS] Remove unused variables passed to closures
  [DI] fix dumping setters before their inlined instances
  [CS] Remove empty comment
  [CS] Enforces null type hint on last position in phpDocs
  [CS] Use combined assignment operators when possible
  Fix a typo in error messages
  Don't return early as this bypasses the auto exit feature
  [Console] Add missing null to input values allowed types
  [PHPUnitBridge] Fix microtime() format
  bumped Symfony version to 4.1.6
  updated VERSION for 4.1.5
  updated CHANGELOG for 4.1.5
  bumped Symfony version to 3.4.17
  updated VERSION for 3.4.16
  updated CHANGELOG for 3.4.16
  bumped Symfony version to 2.8.47
  update CONTRIBUTORS for 2.8.46
  updated VERSION for 2.8.46
  ...
2018-10-02 14:43:31 +02:00
Nicolas Grekas
196086c513 Merge branch '3.4' into 4.1
* 3.4:
  [php_cs] disable fopen_flags
  [DI] fix error in dumped container
  [CS] Remove unused variables passed to closures
  [DI] fix dumping setters before their inlined instances
  [CS] Remove empty comment
  [CS] Enforces null type hint on last position in phpDocs
  [CS] Use combined assignment operators when possible
  Fix a typo in error messages
  Don't return early as this bypasses the auto exit feature
  [Console] Add missing null to input values allowed types
  [PHPUnitBridge] Fix microtime() format
  bumped Symfony version to 3.4.17
  updated VERSION for 3.4.16
  updated CHANGELOG for 3.4.16
  bumped Symfony version to 2.8.47
  update CONTRIBUTORS for 2.8.46
  updated VERSION for 2.8.46
  updated CHANGELOG for 2.8.46
2018-10-02 14:40:59 +02:00
Nicolas Grekas
25055be92e Merge branch '2.8' into 3.4
* 2.8:
  [php_cs] disable fopen_flags
  [CS] Remove unused variables passed to closures
  [CS] Remove empty comment
  [CS] Enforces null type hint on last position in phpDocs
  [CS] Use combined assignment operators when possible
  Fix a typo in error messages
  [Console] Add missing null to input values allowed types
  [PHPUnitBridge] Fix microtime() format
  bumped Symfony version to 2.8.47
  update CONTRIBUTORS for 2.8.46
  updated VERSION for 2.8.46
  updated CHANGELOG for 2.8.46
2018-10-02 14:28:39 +02:00
Gabriel Caruso
efbba25577
[CS] Enforces null type hint on last position in phpDocs 2018-10-02 00:12:00 -03:00
Achilles Kaloeridis
07b67ec2cd Fix a typo in error messages 2018-10-01 21:18:23 +03:00
Fabien Potencier
deaf53c231 Merge branch '4.1'
* 4.1:
  [Console] simplified code
  removed useless phpdoc
  improve docblocks around group sequences
  [Cache] prevent getting older entries when the version key is evicted
  [WebProfilerBundle] added a note in the README
  [Yaml] Skip parser test with root user
  [Filesystem] Skip tests on readable file when run with root user
  [FWBundle] Fix an error in WebTestCase::createClient's PHPDoc
  [HttpFoundation][Security] forward locale and format to subrequests
  [Console] Send the right exit code to console.terminate listeners
  [HttpFoundation] fix hidding warnings from session handlers
  Caching missed templates on cache warmup
2018-09-30 05:40:00 +02:00
Fabien Potencier
46fff8b4d7 Merge branch '3.4' into 4.1
* 3.4:
  [Console] simplified code
  removed useless phpdoc
  improve docblocks around group sequences
  [Cache] prevent getting older entries when the version key is evicted
  [WebProfilerBundle] added a note in the README
  [Yaml] Skip parser test with root user
  [Filesystem] Skip tests on readable file when run with root user
  [FWBundle] Fix an error in WebTestCase::createClient's PHPDoc
  [HttpFoundation][Security] forward locale and format to subrequests
  [Console] Send the right exit code to console.terminate listeners
  [HttpFoundation] fix hidding warnings from session handlers
  Caching missed templates on cache warmup
2018-09-30 05:38:13 +02:00
Fabien Potencier
592bbf3470 Merge branch '2.8' into 3.4
* 2.8:
  improve docblocks around group sequences
  [WebProfilerBundle] added a note in the README
  [Filesystem] Skip tests on readable file when run with root user
  [FWBundle] Fix an error in WebTestCase::createClient's PHPDoc
  [HttpFoundation][Security] forward locale and format to subrequests
  [Console] Send the right exit code to console.terminate listeners
  Caching missed templates on cache warmup
2018-09-30 05:32:28 +02:00
Fabien Potencier
60fac5cefa feature #28447 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0 (nicolas-grekas)
This PR was merged into the 4.2-dev branch.

Discussion
----------

[HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | #26731
| License       | MIT
| Doc PR        | -

By creating Cookie instances using `null` for the `$secure` argument, this PR allows making cookies inherit their "secure" attribute from the request.

This PR also adds a forward to make $secure=null and samesite=lax the defaults in Symfony 5.0:
- either define all constructor's arguments explicitly
- or use the new `Cookie::create()` factory

Commits
-------

9493cfd5f2 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0
2018-09-26 07:44:22 +02:00
Nicolas Grekas
41eb1914f6 [HttpFoundation][Security] forward locale and format to subrequests 2018-09-23 17:27:53 +02:00
Nicolas Grekas
9493cfd5f2 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0 2018-09-20 08:41:35 +02:00
Nicolas Grekas
6ec223bf6f [SecurityBundle] make remember-me cookies auto-secure + inherit their default config from framework.session.cookie_* 2018-09-18 21:47:13 +02:00
kevin.nadin
f75fffa997 Trigger deprecation notices when inherited class calls parent method but misses adding new arguments 2018-09-09 20:06:02 +02:00
Nicolas Grekas
004c315b0c Merge branch '4.1'
* 4.1:
  [DI] configure inlined services before injecting them when dumping the container
  Consistently throw exceptions on a single line
  fix fopen calls
  Update .editorconfig
2018-09-08 15:42:43 +02:00
Nicolas Grekas
6fec32c0d0 Merge branch '3.4' into 4.1
* 3.4:
  [DI] configure inlined services before injecting them when dumping the container
  Consistently throw exceptions on a single line
  fix fopen calls
  Update .editorconfig
2018-09-08 15:24:10 +02:00
Nicolas Grekas
8bc014c211 Merge branch '2.8' into 3.4
* 2.8:
  Consistently throw exceptions on a single line
  fix fopen calls
  Update .editorconfig
2018-09-08 15:15:14 +02:00
Nicolas Grekas
721dc8661f Consistently throw exceptions on a single line 2018-09-08 14:44:02 +02:00
Fabien Potencier
7c394e3daa minor #28307 Mark ExceptionInterfaces throwable #2 (ostrolucky)
This PR was merged into the 4.2-dev branch.

Discussion
----------

Mark ExceptionInterfaces throwable #2

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

This has been reverted in beta of 4.1 because of lack of support in prophecy, which has been fixed since then (incl. release). Can be merged again.

References:
https://github.com/symfony/symfony/pull/26702
https://github.com/symfony/symfony/pull/27420
https://github.com/symfony/symfony/issues/27419
https://github.com/phpspec/prophecy/pull/412

ping @dunglas @ciaranmcnulty @dkarlovi @Wirone @teohhanhui @stof @nicolas-grekas @ondrejmirtes

Commits
-------

17c3675226 Mark ExceptionInterfaces throwable
2018-09-04 18:55:13 +02:00
Fabien Potencier
a82b2a78c6 Merge branch '4.1'
* 4.1:
  fixed usage of setUp in tests
  fixed usage of setUp in tests
  fixed usage of setUp in tests
  [travis] minor fix (quater)
2018-09-04 08:30:07 +02:00
Fabien Potencier
525c98b224 Merge branch '3.4' into 4.1
* 3.4:
  fixed usage of setUp in tests
  fixed usage of setUp in tests
  [travis] minor fix (quater)
2018-09-04 08:28:44 +02:00
Fabien Potencier
fcc31cb6dd Merge branch '2.8' into 3.4
* 2.8:
  fixed usage of setUp in tests
  [travis] minor fix (quater)
2018-09-04 08:27:33 +02:00
Fabien Potencier
62e620843e fixed usage of setUp in tests 2018-09-04 07:42:16 +02:00
Samuel ROZE
6b8e6ce73a Merge branch '4.1'
* 4.1:
  Use the real image URL for the filesystem tests
  [Finder] Update PHPdoc append()
  [DI] Fix phpdoc
  Fix code examples in PHPDoc
  [HttpKernel] Fix inheritdocs
  bumped Symfony version to 3.4.16
  updated VERSION for 3.4.15
  updated CHANGELOG for 3.4.15
2018-09-02 18:48:09 +01:00
Samuel ROZE
e2107d24e2 Merge branch '3.4' into 4.1
* 3.4:
  Use the real image URL for the filesystem tests
  [Finder] Update PHPdoc append()
  [DI] Fix phpdoc
  Fix code examples in PHPDoc
  [HttpKernel] Fix inheritdocs
  bumped Symfony version to 3.4.16
  updated VERSION for 3.4.15
  updated CHANGELOG for 3.4.15
2018-09-02 18:33:37 +01:00
Nicolas Grekas
aa13bfdde0 Merge branch '2.8' into 3.4
* 2.8:
  Use the real image URL for the filesystem tests
  [Finder] Update PHPdoc append()
  [DI] Fix phpdoc
  Fix code examples in PHPDoc
  [HttpKernel] Fix inheritdocs
2018-09-02 19:11:59 +02:00
Gabriel Ostrolucký
17c3675226 Mark ExceptionInterfaces throwable 2018-08-29 17:58:00 +02:00
Dany Maillard
1afb043dc5 Fix code examples in PHPDoc 2018-08-29 15:11:53 +02:00
Nicolas Grekas
4f7b41a83d [FrameworkBundle] Added new "auto" mode for framework.session.cookie_secure to turn it on when https is used 2018-08-27 18:13:55 +02:00
Nicolas Grekas
3063c62bba Merge branch '4.1'
* 4.1:
  [travis] fix composer.lock invalidation for deps=low
  [Security\Http] Restore laziness of listener iterator
  Make the `message_bus` alias public
2018-08-19 10:17:45 +02:00
Nicolas Grekas
cd14b22f18 Merge branch '3.4' into 4.1
* 3.4:
  [travis] fix composer.lock invalidation for deps=low
  [Security\Http] Restore laziness of listener iterator
2018-08-19 10:16:41 +02:00
Nicolas Grekas
2ebc75b9a1 [Security\Http] Restore laziness of listener iterator 2018-08-18 22:38:48 +02:00
Nicolas Grekas
1c248e572e Merge branch '4.1'
* 4.1:
  fix merge
  [travis][appveyor] use symfony/flex to accelerate builds
  Add missing stderr redirection
  clean up unused code
  Remove the HTML5 validation from the profiler URL search form
  [Filesystem] Add test to prevent regression when using array|resource with dumpFile
  Add help texts for checkboxes in horizontal bootstrap 4 forms
  [Security] Call AccessListener after LogoutListener
2018-08-18 18:57:16 +02:00
Nicolas Grekas
2dedacbc04 Merge branch '3.4' into 4.1
* 3.4:
  [travis][appveyor] use symfony/flex to accelerate builds
  Add missing stderr redirection
  clean up unused code
  [Filesystem] Add test to prevent regression when using array|resource with dumpFile
  [Security] Call AccessListener after LogoutListener
2018-08-18 18:52:46 +02:00
Nicolas Grekas
d351daab04 Merge branch '2.8' into 3.4
* 2.8:
  [travis][appveyor] use symfony/flex to accelerate builds
  [Security] Call AccessListener after LogoutListener
2018-08-18 18:47:20 +02:00
Robin Chalas
ea0b508c8e bug #28100 [Security] Call AccessListener after LogoutListener (chalasr)
This PR was merged into the 2.8 branch.

Discussion
----------

[Security] Call AccessListener after LogoutListener

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #28058
| License       | MIT
| Doc PR        | n/a

Commits
-------

44dbea6 [Security] Call AccessListener after LogoutListener
2018-08-11 13:15:56 +02:00
Nicolas Grekas
4ebecdbc05 Merge branch '4.1'
* 4.1:
  [travis] cache composer.lock files for deps=low
  [Security] Remove wrong sentence about ACL
  Update validators.nl.xlf
  [Routing] Fixed scheme redirecting for root path
  [Form] Remove extra .form-group wrapper around file widget in bootstrap 4
2018-08-07 11:35:17 +02:00
Nicolas Grekas
9654de3527 Merge branch '3.4' into 4.1
* 3.4:
  [travis] cache composer.lock files for deps=low
  [Security] Remove wrong sentence about ACL
  Update validators.nl.xlf
2018-08-07 11:35:05 +02:00
Nicolas Grekas
87fff65cd0 Merge branch '2.8' into 3.4
* 2.8:
  [travis] cache composer.lock files for deps=low
  [Security] Remove wrong sentence about ACL
  Update validators.nl.xlf
2018-08-07 11:33:53 +02:00
Robin Chalas
67f3e3ff4e [Security] Remove wrong sentence about ACL 2018-08-05 19:43:29 +02:00
Robin Chalas
44dbea6330 [Security] Call AccessListener after LogoutListener 2018-08-01 20:49:49 +02:00
Nicolas Grekas
f834c9262b Merge branch '4.1'
* 4.1:
  Alpha-ordering for "use" statements
2018-07-26 11:13:01 +02:00