This repository has been archived on 2023-08-20. You can view files and clone it, but cannot push or open issues or pull requests.
symfony/UPGRADE-5.1.md
Fabien Potencier 1fc7b86f07 feature #36243 [Security] Refactor logout listener to dispatch an event instead (wouterj)
This PR was squashed before being merged into the 5.1-dev branch.

Discussion
----------

[Security] Refactor logout listener to dispatch an event instead

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | yes (sort of...)
| New feature?  | yes
| Deprecations? | yes
| Tickets       | Fix #25212, Fix #22473
| License       | MIT
| Doc PR        | tbd

The current `LogoutListener` has some extension points, but they are not really DX-friendly (ref #25212). It requires hacking a `addMethodCall('addHandler')` in the container builder to register a custom logout handler.
Also, it is impossible to overwrite the default logout functionality from a bundle (ref #22473).

This PR introduces a `LogoutEvent` that replaces both the `LogoutSuccessHandlerInterface` and `LogoutHandlerInterface`. This provides a DX-friendly extension point and also cleans up the authentication factories (no more `addMethodCall()`'s).

In order to allow different logout handlers for different firewalls, I created a specific event dispatcher for each firewall (as also shortly discussed in #33558). The `dispatcher` tag attribute allows you to specify which dispatcher it should be registered to (defaulting to the global dispatcher). The `EventBubblingLogoutListener` also dispatches logout events on the global dispatcher, to be used for listeners that should run on all firewalls.

_@weaverryan and I discussed this feature while working on #33558, but figured it was unrelated and could be done while preservering BC. So that's why a separate PR is created._

Commits
-------

a9f096eb1f [Security] Refactor logout listener to dispatch an event instead
2020-04-04 13:02:32 +02:00

4.7 KiB

UPGRADE FROM 5.0 to 5.1

Config

  • The signature of method NodeDefinition::setDeprecated() has been updated to NodeDefinition::setDeprecation(string $package, string $version, string $message).
  • The signature of method BaseNode::setDeprecated() has been updated to BaseNode::setDeprecation(string $package, string $version, string $message).
  • Passing a null message to BaseNode::setDeprecated() to un-deprecate a node is deprecated

Console

  • Command::setHidden() is final since Symfony 5.1

DependencyInjection

  • The signature of method Definition::setDeprecated() has been updated to Definition::setDeprecation(string $package, string $version, string $message).
  • The signature of method Alias::setDeprecated() has been updated to Alias::setDeprecation(string $package, string $version, string $message).
  • The signature of method DeprecateTrait::deprecate() has been updated to DeprecateTrait::deprecation(string $package, string $version, string $message).
  • Deprecated the Psr\Container\ContainerInterface and Symfony\Component\DependencyInjection\ContainerInterface aliases of the service_container service, configure them explicitly instead.

Dotenv

  • Deprecated passing $usePutenv argument to Dotenv's constructor, use Dotenv::usePutenv() instead.

EventDispatcher

  • Deprecated LegacyEventDispatcherProxy. Use the event dispatcher without the proxy.

Form

  • Implementing the FormConfigInterface without implementing the getIsEmptyCallback() method is deprecated. The method will be added to the interface in 6.0.
  • Implementing the FormConfigBuilderInterface without implementing the setIsEmptyCallback() method is deprecated. The method will be added to the interface in 6.0.
  • Added argument callable|null $filter to ChoiceListFactoryInterface::createListFromChoices() and createListFromLoader() - not defining them is deprecated.

FrameworkBundle

  • Deprecated passing a RouteCollectionBuilder to MicroKernelTrait::configureRoutes(), type-hint RoutingConfigurator instead
  • Deprecated not setting the "framework.router.utf8" configuration option as it will default to true in Symfony 6.0
  • Deprecated session.attribute_bag service and session.flash_bag service.

HttpFoundation

  • Deprecate Response::create(), JsonResponse::create(), RedirectResponse::create(), and StreamedResponse::create() methods (use __construct() instead)
  • Made the Mime component an optional dependency

HttpKernel

  • Deprecated support for service:action syntax to reference controllers. Use serviceOrFqcn::method instead.

Mailer

  • Deprecated passing Mailgun headers without their "h:" prefix.

Messenger

  • Deprecated AmqpExt transport. It has moved to a separate package. Run composer require symfony/amqp-messenger to use the new classes.
  • Deprecated Doctrine transport. It has moved to a separate package. Run composer require symfony/doctrine-messenger to use the new classes.
  • Deprecated RedisExt transport. It has moved to a separate package. Run composer require symfony/redis-messenger to use the new classes.
  • Deprecated use of invalid options in Redis and AMQP connections.
  • Deprecated not declaring a \Throwable argument in RetryStrategyInterface::isRetryable()
  • Deprecated not declaring a \Throwable argument in RetryStrategyInterface::getWaitingTime()

Notifier

  • [BC BREAK] The ChatMessage::fromNotification() method's $recipient and $transport arguments were removed.
  • [BC BREAK] The EmailMessage::fromNotification() and SmsMessage::fromNotification() methods' $transport argument was removed.

PhpUnitBridge

  • Deprecated the @expectedDeprecation annotation, use the ExpectDeprecationTrait::expectDeprecation() method instead.

Routing

  • Deprecated RouteCollectionBuilder in favor of RoutingConfigurator.
  • Added argument $priority to RouteCollection::add()
  • Deprecated the RouteCompiler::REGEX_DELIMITER constant

Security

  • Deprecated ROLE_PREVIOUS_ADMIN role in favor of IS_IMPERSONATOR attribute.

    before

    {% if is_granted('ROLE_PREVIOUS_ADMIN') %}
        <a href="">Exit impersonation</a>
    {% endif %}
    

    after

    {% if is_granted('IS_IMPERSONATOR') %}
        <a href="">Exit impersonation</a>
    {% endif %}
    
  • Deprecated LogoutSuccessHandlerInterface and LogoutHandlerInterface, register a listener on the LogoutEvent event instead.

  • Deprecated DefaultLogoutSuccessHandler in favor of DefaultLogoutListener.

Yaml

  • Deprecated using the !php/object and !php/const tags without a value.