This PR was merged into the 2.7 branch.
Discussion
----------
[Security] Fail gracefully if the security token cannot be unserialized from the session
| Q | A
| ------------- | ---
| Branch? | 2.7
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
If the security token in the session can't be unserialized, an `E_NOTICE` is issued. This prevents it (and provides a better log message if it's not even a `__PHP_Incomplete_Class`).
This is similar to #24731, but I saw it triggered when changing OAuth library (https://github.com/elifesciences/journal/pull/824), so the token class itself no longer exists. (I want to avoid having to manually invalidate all sessions, as not all sessions use that token class.)
Commits
-------
|
||
---|---|---|
.. | ||
Asset | ||
BrowserKit | ||
ClassLoader | ||
Config | ||
Console | ||
CssSelector | ||
Debug | ||
DependencyInjection | ||
DomCrawler | ||
EventDispatcher | ||
ExpressionLanguage | ||
Filesystem | ||
Finder | ||
Form | ||
HttpFoundation | ||
HttpKernel | ||
Intl | ||
Locale | ||
OptionsResolver | ||
Process | ||
PropertyAccess | ||
Routing | ||
Security | ||
Serializer | ||
Stopwatch | ||
Templating | ||
Translation | ||
Validator | ||
VarDumper | ||
Yaml |