f2d687a08f
This PR was merged into the 2.7 branch.
Discussion
----------
[Security] Fail gracefully if the security token cannot be unserialized from the session
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
If the security token in the session can't be unserialized, an `E_NOTICE` is issued. This prevents it (and provides a better log message if it's not even a `__PHP_Incomplete_Class`).
This is similar to #24731, but I saw it triggered when changing OAuth library (https://github.com/elifesciences/journal/pull/824), so the token class itself no longer exists. (I want to avoid having to manually invalidate all sessions, as not all sessions use that token class.)
Commits
-------
|
||
|---|---|---|
| .. | ||
| Asset | ||
| BrowserKit | ||
| ClassLoader | ||
| Config | ||
| Console | ||
| CssSelector | ||
| Debug | ||
| DependencyInjection | ||
| DomCrawler | ||
| EventDispatcher | ||
| ExpressionLanguage | ||
| Filesystem | ||
| Finder | ||
| Form | ||
| HttpFoundation | ||
| HttpKernel | ||
| Intl | ||
| Locale | ||
| OptionsResolver | ||
| Process | ||
| PropertyAccess | ||
| Routing | ||
| Security | ||
| Serializer | ||
| Stopwatch | ||
| Templating | ||
| Translation | ||
| Validator | ||
| VarDumper | ||
| Yaml | ||