Commit Graph

98 Commits

Author SHA1 Message Date
Fabien Potencier
fa9b920051 [Security] renamed UserProviderInterface::loadUser() to refreshUser() 2011-06-16 18:00:36 +02:00
Fabien Potencier
fb24b95bd5 made some tweaks to error levels 2011-06-15 13:04:19 +02:00
Fabien Potencier
9e0d6177cb [Security] reverted some changes from previous merge 2011-06-15 12:35:09 +02:00
Fabien Potencier
01fcd7bdfd merged branch kaiwa/loglevel (PR #1073)
Commits
-------

cdf4b6a Checked log levels
a45d3ee Reverted last commit
529381b ControllerNotFound: Changed log level from info to error. Also moved throw exception code block up, to prevent the message from beeing logged multiple times.
7c29e88 Changed log level of "Matched route ..." message from info to debug
dca09fd Changed log level of "Using Controller ..." message from info to debug

Discussion
----------

Log levels

Just wanted to ask if the log level INFO is still correct for these messages?

As there are only four log levels left (DEBUG, INFO, WARNING, ERROR), DEBUG might be the more appropriate level for these messages now.

Let me give an example: An application is logging user actions (maybe to database) in order to assure comprehensibility, e. g. "User %s deleted post %d", "User %s written a message to user %s". These are not warnings of course, so the only suitable log level is INFO.
But they will be thrown together with these very common (at least two per request?) "Using controller..." and "Matched route..." messages when choosing INFO as log level.

---------------------------------------------------------------------------

by Seldaek at 2011/05/24 07:13:18 -0700

Agreed, this stuff is framework debug information.

---------------------------------------------------------------------------

by fabpot at 2011/05/24 08:53:24 -0700

Why do you want to change these two specific ones? The framework uses the INFO level at other places too. Is it a good idea to say that the framework only logs with DEBUG?

---------------------------------------------------------------------------

by stof at 2011/05/24 09:12:53 -0700

Doctrine logs at the INFO level too and I think it is useful to keep it as INFO. Being able to see the queries without having all DEBUG messages of the event dispatcher and security components is useful IMO.

---------------------------------------------------------------------------

by Seldaek at 2011/05/25 02:30:24 -0700

Yeah, that's true, maybe we just need to reintroduce (again, meh:) NOTICE between INFO and WARNING.

@kaiwa Of course the other way could be that you just add your DB handler to the app logger stack. That could be done in a onCoreRequest listener or such, basically you'd have to call `->pushHandler($yourDBHandler)` on the `monolog.logger.app` service. That way your messages will flow to it, but it won't receive noise from the framework stuff since those log on monolog.logger.request and other log channels.

---------------------------------------------------------------------------

by fabpot at 2011/05/25 02:48:26 -0700

@Seldaek: I don't think we need another level. We just need to come up with a standard rules about the usage of each level. Adapted from log4j:

* ERROR: Other runtime errors or unexpected conditions.
* WARN: Use of deprecated APIs, poor use of API, 'almost' errors, other runtime that are undesirable or unexpected, but not necessarily "wrong" (unable to write to the profiler DB, ).
* INFO: Interesting runtime events (security infos like the fact the user is logged-in or not, SQL logs, ...).
* DEBUG: Detailed information on the flow through the system (route match, security flow infos like the fact that a token was found or that remember-me cookie is found, ...).

What do you think?

---------------------------------------------------------------------------

by stloyd at 2011/05/25 02:53:38 -0700

+1 for this standard (also this PR can be merged then), but we should review code for other "wrong" log levels usage (if everyone accept this standard)

---------------------------------------------------------------------------

by fabpot at 2011/05/25 02:55:07 -0700

I won't merge this PR before all occurrences of the logger calls have been reviewed carefully and changed to the right level.

---------------------------------------------------------------------------

by kaiwa at 2011/05/25 02:58:44 -0700

@fabpot: Just noticed these two occurring for every request in my log file. You are right, there are other places where this changes must be applied if we will change the log level.

@stof: Hmm, i see. It is not possible to set the logger separately for each bundle, is it? That maybe would solve the problem. If somebody is interested in seeing the queries, he could set the log handler level to DEBUG for doctrine bundle, but still use INFO for the framwork itself. Plus he could even define a different output file or a completely different handler.

I'm not sure if something like that is possible already (?) or realizable at all... just came into my mind.

---------------------------------------------------------------------------

by Seldaek at 2011/05/25 03:01:07 -0700

Just FYI, from Monolog\Logger (which has CRITICAL and ALERT):

     * Debug messages
    const DEBUG = 100;

     * Messages you usually don't want to see
    const INFO = 200;

     * Exceptional occurences that are not errors
     * This is typically the logging level you want to use
    const WARNING = 300;

     * Errors
    const ERROR = 400;

     * Critical conditions (component unavailable, etc.)
    const CRITICAL = 500;

     * Action must be taken immediately (entire service down)
     * Should trigger alert by sms, email, etc.
    const ALERT = 550;

The values kind of match http error codes too, 4xx are expected errors that are not really important (404s etc) and 5xx are server errors that you'd better fix ASAP. I'm ok with the descriptions, but I think alert and critical should be included too. I'll probably update Monolog docblocks to match whatever ends up in the docs.

---------------------------------------------------------------------------

by Seldaek at 2011/05/25 03:03:21 -0700

@kaiwa you can do a lot, but not from the default monolog configuration entry, I'm not sure if we can really make that fully configurable without having a giant config mess. Please refer to my [comment above](https://github.com/symfony/symfony/pull/1073#issuecomment-1234316) to see how you could solve it. Maybe @fabpot has an idea how to make this more usable though.

---------------------------------------------------------------------------

by stof at 2011/05/25 03:19:43 -0700

@Seldaek the issue is that the different logging channels are only know in the compiler pass, not in the DI extension. So changing the level in the extension is really hard IMO.
Thus, the handlers are shared between the different logging channels (needed to open the log file only once for instance, or to send a single mail instead of one per channel) and the level is handled in the handlers, not the logger.

I'm +1 for the standard, by adding the distinction between 400 and 500 status calls using ERROR and CRITICAL (which is already the case in the code).

@kaiwa do you have time to review the calls to the logger between DEBUG and INFO or do you prefer I do it ? For instance, the Security component currently logs all message at DEBUG level and some of them should be INFO.

---------------------------------------------------------------------------

by kaiwa at 2011/05/25 04:31:04 -0700

@stof ok i'll do that

---------------------------------------------------------------------------

by kaiwa at 2011/05/25 12:22:51 -0700

Need some help :) I came across `ControllerNameParser::handleControllerNotFoundException()` which leads to redundant log messages currently:

>[2011-05-25 20:53:16] request.INFO: Unable to find controller "AppBaseBundle:Blog" - class "App\BaseBundle\Controller\BlogController" does not exist.

>[2011-05-25 20:53:16] request.ERROR: InvalidArgumentException: Unable to find controller "AppBaseBundle:Blog" - class "App\BaseBundle\Controller\BlogController" does not exist. (uncaught exception) at /home/ruth/symfony3/src/Symfony/Bundle/FrameworkBundle/Controller/ControllerNameParser.php line 87

Is it necessary to call `$this->logger->info($log);` if the InvalidArgumentException will be logged anyway?

---------------------------------------------------------------------------

by stof at 2011/05/25 12:39:22 -0700

Well, the issue is that the ControllerNameParser logs messages and then uses them to throw an exception. I guess the logging call should be removed as it is redundant with the one of the ExceptionListener. @fabpot thoughts ?

---------------------------------------------------------------------------

by kaiwa at 2011/05/27 11:39:25 -0700

I checked all debug, info and log calls. Sometimes it is hard to distinguish between the levels, so it would be great if someone reviews @cdf4b6a. @stof, maybe you want to take a look?

---------------------------------------------------------------------------

by kaiwa at 2011/05/31 12:52:07 -0700

@stof, thanks for your comments. I added some replies above, please let me know your suggestions.

---------------------------------------------------------------------------

by stof at 2011/05/31 14:04:22 -0700

@kaiwa As I said before, all the security logging calls should be DEBUG (most of them) or INFO (the one syaing that authentication succeeded for instance), but not WARN or ERROR as the exception don't go outside the firewall.
2011-06-15 12:31:31 +02:00
Fabien Potencier
a12ea12fc1 fixed CS 2011-06-13 18:54:20 +02:00
Ned Schwartz
47df88bfc9 made logoutPath localizable as well 2011-06-10 15:04:50 -07:00
Ned Schwartz
8fd4158468 storing localized targetPath in a string as opposed to updating the attribute 2011-06-10 14:32:10 -07:00
Ned Schwartz
17b7b558ce In the spirit of 882a8e3f09 allow for localized logout target url 2011-06-10 12:24:27 -07:00
Fabien Potencier
1aabc5da64 fixed CS 2011-06-08 12:16:48 +02:00
Fabien Potencier
188e74273a [Security] fixed sub-requests creation (closes #1212) 2011-06-08 10:36:14 +02:00
Christophe Coevoet
f3031251c5 Added the support of the locale in the login path and the check path 2011-06-06 21:44:53 +02:00
Johannes M. Schmitt
672cf78816 [Security/Http] removed irrelevant code 2011-06-03 14:02:57 +02:00
Fabien Potencier
02605f3481 merged origin/master 2011-05-31 08:34:05 +02:00
Fabien Potencier
514bf9af5d [Security] fixed wrong function call 2011-05-30 22:52:35 +02:00
Fabien Potencier
9181e5dd0c merged origin/master 2011-05-30 14:28:54 +02:00
Fabien Potencier
d7220f0c1a [Security] fixed event names 2011-05-30 13:53:47 +02:00
Johannes M. Schmitt
8837ce0e57 Merge branch 'master' of http://github.com/symfony/symfony into security 2011-05-30 10:00:07 +02:00
Fabien Potencier
0ce22f6bbe [Security] removed obsolete use statements 2011-05-30 09:36:59 +02:00
Fabien Potencier
c171142c01 renamed constants to upper cased 2011-05-30 09:04:37 +02:00
Fabien Potencier
5059559035 Merge remote branch 'Seldaek/events' into events1
* Seldaek/events:
  [EventDispatcher] Removed temporary code
  [FrameworkBundle] Improved code readability
  [FrameworkBundle] Clarified code and fixed regression
  Update Core and Security events to latest model
  [EventDispatcher] Allow registration of arbitrary callbacks
  [EventDispatcher] Remove useless code
  [EventDispatcher] Minor memory optimization to getListeners()
  [FrameworkBundle] Small optimization, remove some function calls
2011-05-30 08:58:49 +02:00
Pascal Borreli
824e48efa7 [Various] Fixed phpdoc 2011-05-29 23:33:36 +00:00
Johannes Schmitt
f37386e336 Merge branch 'master' of git://github.com/symfony/symfony into security 2011-05-28 17:07:16 +02:00
kaiwa
cdf4b6aa77 Checked log levels 2011-05-27 20:29:51 +02:00
Ryan Weaver
bad1cb61d0 [Security] Adding tests and then fixing bug where ContextListener did no logging 2011-05-26 15:08:19 -05:00
Jordi Boggiano
af0bd8a136 Update Core and Security events to latest model
The main benefit is that in XML/YML files we have common syntax (i.e. core.controller, form.pre_bind) that properly namespaces event names (before: onCoreController was ok, preBind was not).
On the other hand in PHP land we also have namespaced events, CoreEvents::controller, FormEvents::preBind, before it was Events::onCoreController, Events::onPreBind, we now have more context.
2011-05-26 11:55:07 +02:00
Jordi Boggiano
1246503e55 [EventDispatcher] Allow registration of arbitrary callbacks
This in effect removes the direct link between event name and the method name on the handler.
Any callback can be given as a handler and the event name becomes an arbitrary string. Allowing for easier namespacing (see next commit)
2011-05-26 11:54:06 +02:00
Johannes Schmitt
bd9bfafd9c [Security/Http] use deep parameter for CSRF parameter 2011-05-18 13:01:54 +02:00
Johannes Schmitt
0eb7564f7d Merge remote branch 'origin/master' into security
Conflicts:
	src/Symfony/Bundle/FrameworkBundle/Listener/RequestAttributeInitializingListener.php
2011-05-18 12:54:47 +02:00
Kris Wallsmith
b645278f8b [Security] updated with "intention" 2011-05-16 14:16:30 -07:00
Johannes Schmitt
28bee92c75 [Security/Http] better error message when session times out, or cookies are disabled 2011-05-14 16:41:18 +02:00
Johannes Schmitt
0acffb1a1a [Security/Http] {_locale} can be used as placeholder in target path generation
fixes #861
2011-05-14 16:21:27 +02:00
Johannes Schmitt
9408ab3010 [Security] use deep flag when retrieving username + password 2011-05-10 11:22:28 +02:00
Johannes Schmitt
362b7264d1 [Security][HttpFoundation] splits Request::hasSession() into hasSession(), and hasPreviousSession()
This closes #774, and fixes #772.
2011-05-05 08:38:07 +02:00
Pascal Borreli
8c0beea677 [Phpdoc] Cleaning/fixing 2011-04-23 15:18:47 +00:00
Fabien Potencier
9a4da005a2 Merge remote branch 'bschussek/form-extensions'
* bschussek/form-extensions:
  [Form] Refactored code from CoreExtension to new ValidatorExtension
  [Form] Added FormTypeExtensionInterface
  [Form] Reorganized code into "form extensions"
2011-04-23 09:11:25 +02:00
Pascal Borreli
b5769c52d6 Fixed various typo 2011-04-22 23:12:50 +00:00
Bernhard Schussek
54e66c518f [Form] Reorganized code into "form extensions"
The extension classes are now the only constructor argument of the FormFactory class. They replace the existing "type loader" classes.

    new FormFactory(array(
        new CoreExtension($validator, $storage),
        new CsrfExtension($csrfProvider),
        new DoctrineOrmExtension($em),
    ));

Together with a few upcoming commits this mechanism will make

 * extension of the form framework in bundles and
 * usage of the forms outside of Symfony2

much easier.
2011-04-22 17:41:21 +02:00
Johannes M. Schmitt
c660fcd2f2 fixes a bug in the SwitchUserListener 2011-04-19 14:24:37 +02:00
Alexey Popkov
7423f0bf50 [SecurityBundle] fixed missing argument EventDisplatcher in RememberMe service 2011-03-24 14:00:16 +03:00
Christophe Coevoet
cc036b4f2b [Security] Removed useless method call 2011-03-23 00:02:57 +01:00
Christophe Coevoet
8b8bb66afe [Security] Fixed some listeners not updated after the event refactoring 2011-03-22 23:56:46 +01:00
Miha Vrhovnik
e35832ef2d Fixing failure on forward which was broken by Event refactoring 2011-03-19 13:06:52 +01:00
Amal Raghav
eff6bc8a80 fix to use setException 2011-03-19 17:08:34 +05:30
Fabien Potencier
cdfc731ff5 Merge remote branch 'schmittjoh/security' 2011-03-18 21:07:11 +01:00
Fabien Potencier
f990bf96ee Merge remote branch 'ornicar/removeNamespaceInSwitchUserListener' 2011-03-18 20:57:48 +01:00
ornicar
5e75c66a66 [Security] Remove duplicated namespace in SwitchUserListener 2011-03-18 12:30:09 -07:00
Johannes Schmitt
7e1c4d5748 [Security] removed un-needed event parameter from many interfaces 2011-03-18 20:20:19 +01:00
Johannes Schmitt
a56dbec6d8 [Security] removed un-needed event parameter from many interfaces 2011-03-18 18:26:55 +01:00
Fabien Potencier
e286adf173 [Security] fixed typos 2011-03-18 07:58:51 +01:00
Fabien Potencier
1af43a1562 fixed various bugs introduced during the event system migration 2011-03-18 07:35:59 +01:00