This PR was merged into the 4.1 branch.
Discussion
----------
[FrameworkBundle] give access to non-shared services when using test.service_container
| Q | A
| ------------- | ---
| Branch? | 4.1
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27488
| License | MIT
| Doc PR | -
Commits
-------
516ff5a985 [FrameworkBundle] give access to non-shared services when using test.service_container
This PR was merged into the 4.1 branch.
Discussion
----------
Avoid calling eval when there is no script embedded in the toolbar
| Q | A
| ------------- | ---
| Branch? | 4.1
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27583
| License | MIT
| Doc PR | n/a
#27189 changed the way embedded scripts were eval'd for the toolbar. But it also refactored the code in a way triggering `eval` all the time, even when there is no embedded script, which was reported several times as an issue with CSP.
While the debug panel (showing dumps) still requires having `unsafe-eval` in the CSP header (due to embedding scripts that we eval), this PR reverts back to the behavior of Symfony 4.0 and older, where only toolbars actually embedding scripts have this CSP compat issue.
Commits
-------
a0f78a5e0b Avoid calling eval when there is no script embedded in the toolbar
This PR was merged into the 4.1 branch.
Discussion
----------
[FrameworkBundle] fix for allowing single colon controller notation
| Q | A
| ------------- | ---
| Branch? | 4.1
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27522
| License | MIT
| Doc PR | -
This fixes a BC break introduced in https://github.com/symfony/symfony/pull/26085#pullrequestreview-126370222.
ping @Tobion
Commits
-------
1680674174 [FrameworkBundle] fix for allowing single colon controller notation
* 4.0:
fixed CS
Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener
fixed CS
Avoid migration on stateless firewalls
[Serializer] deserialize from xml: Fix a collection that contains the only one element
[PhpUnitBridge] Fix error on some Windows OS
[DI] Deduplicate generated proxy classes
* 3.4:
fixed CS
Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener
fixed CS
Avoid migration on stateless firewalls
[Serializer] deserialize from xml: Fix a collection that contains the only one element
[PhpUnitBridge] Fix error on some Windows OS
[DI] Deduplicate generated proxy classes
This PR was squashed before being merged into the 3.4 branch (closes#27556).
Discussion
----------
Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | Related to #27395
| License | MIT
| Doc PR | symfony/symfony-docs#9860
This is the sister PR to #27452, which covered all the other authentication listeners.
Commits
-------
c06f3229de Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener
This PR was squashed before being merged into the 2.8 branch (closes#27452).
Discussion
----------
Avoid migration on stateless firewalls
| Q | A
| ------------- | ---
| Branch? | 2.8
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | Related to #27395
| License | MIT
| Doc PR | symfony/symfony-docs#9860
This is a proof-of-concept. Once we agree / are happy, I need to add this to all of the other authentication mechanisms that recently got the session migration code & add tests.
Basically, this avoids migrating the session if the firewall is stateless. There were 2 options to do this:
A) Make the `SessionAuthenticationStrategy` aware of all stateless firewalls. **This is the current approach**
or
B) Make each individual authentication listener aware whether or not *its* firewall is stateless.
Commits
-------
cca73bb564 Avoid migration on stateless firewalls
This PR was squashed before being merged into the 3.4 branch (closes#27326).
Discussion
----------
[Serializer] deserialize from xml: Fix a collection that contains the only one element
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27279
| License | MIT
| Doc PR |
In xml when parent node (`restaurants`) contains several children nodes with the same tag (`restaurant`) it is clear that the children form a collection:
```
restaurants = {array} [1]
restaurant = {array} [2]
0 = {array} [2]
name = "Some restaurant name"
type = "Chinese"
1 = {array} [2]
name = "Another restaurant name"
type = "Italian"
```
Afterwards the object denormalizer has no problem to create a collection of restaurants.
But when there is only one child (`restaurant`) the decoded normalized array will not contain a collection:
```
restaurants = {array} [1]
restaurant = {array} [2]
name = "Some restaurant name"
type = "Chinese"
```
In this situation the object denormalizer threw unexpected exception. This PR modifies `AbstractObjectNormalizer` that is it will fill a collection containing the sole element properly.
Commits
-------
1f346f446d [Serializer] deserialize from xml: Fix a collection that contains the only one element
This PR was squashed before being merged into the 4.1 branch (closes#27562).
Discussion
----------
[HttpKernel] Log/Collect exceptions at prio 0
| Q | A
| ------------- | ---
| Branch? | 4.1
| Bug fix? | yes
| New feature? | no
| BC breaks? | no, fixes one
| Deprecations? | no
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #27440
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
So that it runs after the security exception listener, which runs at prio 1.
Im not sure what to do with the (wrong) changelog entry for 4.1.0 at this point.. should we add a new entry for 4.1.1?
Commits
-------
85b832bcc9 [HttpKernel] Log/Collect exceptions at prio 0
This PR was submitted for the master branch but it was merged into the 3.4 branch instead (closes#27567).
Discussion
----------
[PhpUnitBridge] Fix error on some Windows OS
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27439
| License | MIT
Bug Fix on PHPUnit Bridge
Commits
-------
50979b5ea4 [PhpUnitBridge] Fix error on some Windows OS
* 4.0:
[FrameworkBundle] decouple some cache-warmer's test from internal details
bug #27405 [Cache] TagAwareAdapter should not corrupt memcached connection in ascii mode
Remove released semaphore
* 3.4:
[FrameworkBundle] decouple some cache-warmer's test from internal details
bug #27405 [Cache] TagAwareAdapter should not corrupt memcached connection in ascii mode
Remove released semaphore
This PR was merged into the 3.4 branch.
Discussion
----------
[Lock] Remove released semaphore
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27356
| License | MIT
| Doc PR | NA
This PR remove the semaphore with `sem_remove`. By removing without releasing the semaphore, all pending blocking acquiring will fail that's why the acquire method has also been update to handle such case
Commits
-------
77b9f90a32 Remove released semaphore
This PR was merged into the 3.4 branch.
Discussion
----------
TagAwareAdapter over non-binary memcached connections corrupts memcache
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | no
| Fixed tickets | #27405
| License | MIT
| Doc PR |
TagAwareAdapter uses non-ascii symbols in key names. It breaks memcached connections in non-binary mode.
Commits
-------
67d4e6dd29 bug #27405 [Cache] TagAwareAdapter should not corrupt memcached connection in ascii mode
This PR was merged into the 3.4 branch.
Discussion
----------
[FrameworkBundle] decouple some cache-warmer's test from internal details
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
Commits
-------
847abd3ec9 [FrameworkBundle] decouple some cache-warmer's test from internal details
* 4.0:
[Cache][Security] Use Throwable where possible
revert #27545
Update Finder.php
[FrameworkBundle] remove dead code in CachePoolClearerPass
Fix security-core cross-dependencies, fixes#27507
Pass previous exception to FatalErrorException
