summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* | | | ensured that an exception is always converted to an error response (and that ↵Fabien Potencier2012-07-131-1/+0
| | | | | | | | | | | | | | | | we keep the HTTP status code and headers)
* | | | [Security] made sure that we always replace the security access denied ↵Fabien Potencier2012-07-131-4/+2
| | | | | | | | | | | | | | | | exception to an HTTP one
* | | | merged branch asm89/fix-default-auth-successhandler-extension (PR #4865)Fabien Potencier2012-07-121-6/+24
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 5e6c06f [Security] Remove hard dependency on $providerKey for default auth success handler Discussion ---------- [Security] Remove hard dependency on $providerKey for default auth success handler Bug fix: yes? Feature addition: yes? Backwards compatibility break: no Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=fix-default-auth-successhandler-extension)](http://travis-ci.org/asm89/symfony) License of the code: MIT In 8ffaafa86741a03ecb2f91e3d67802f4c6baf36b a hard dependency was introduced between the default authentication success handling code and the active firewall. This makes sense. However, for people implementing their own success handler this makes it impossible to extend the default class as the `$providerKey` is set in the extension of the security bundle. This PR makes the dependency a soft one so people can extend the class and use the default definition as a parent for their own service. However it is the responsibility of the developers to set the appropriate `$providerKey` if they want to use the target url saved in the session. Imo this is the right way as the developer should also set the appropriate options for the parent class in the overriding constructor. --------------------------------------------------------------------------- by stof at 2012-07-11T19:01:12Z @asm89 this PR need to be rebased according to github --------------------------------------------------------------------------- by asm89 at 2012-07-11T19:13:09Z @stof Done :) --------------------------------------------------------------------------- by asm89 at 2012-07-12T10:07:53Z @fabpot Done.
| * | | | [Security] Remove hard dependency on $providerKey for default auth success ↵Alexander2012-07-121-6/+24
| | | | | | | | | | | | | | | | | | | | handler
* | | | | added missing dotChristian Raue2012-07-121-1/+1
|/ / / /
* | | | merged branch asm89/refactor-authentication-success-handling (PR #4599)Fabien Potencier2012-07-097-79/+201
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- bb138da [Security] Fix regression after rebase. Target url should be firewall dependent eb19f2c [Security] Add note to CHANGELOG about refactored authentication failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock f9d5606 [Security] Update AuthenticationFailureHandlerInterface docblock. Never return null 915704c [Security] Move default authentication failure handling strategy to seperate class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler c6aa392 [Security] Move default authentication success handling strategy to seperate class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test Discussion ---------- [Security] Refactor authentication success handling Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=refactor-authentication-success-handling)](http://travis-ci.org/asm89/symfony) License of the code: MIT This PR extracts the default authentication success handling to its own class as discussed in #4553. In the end the PR will basically revert #3183 (as suggested by @schmittjoh) and fix point one of #838. There are a few noticeable changes in this PR: - This implementation changes the constructor signature of the `AbstractAuthentictionListener` and `UsernamePasswordFormAuthenticationListener` by making the `AuthenticationSuccessHandler` mandatory (BC break). If this WIP is approved I will refactor the failure handling logic too and then this will also move one place in the constructor - This PR reverts the change of making the returning of a `Response` optional in the `AuthenticationSuccessHandlerInterface`. Developers can now extend the default behavior themselves @schmittjoh Any suggestions? Or a +1 to do the failure logic too? --------------------------------------------------------------------------- by schmittjoh at 2012-06-17T23:53:07Z +1 from me @fabpot, what so you think? --------------------------------------------------------------------------- by fabpot at 2012-06-19T08:15:48Z Can you add a note in the CHANGELOG? Thanks. --------------------------------------------------------------------------- by asm89 at 2012-06-19T10:22:20Z I will, but I'll first do the same for the failure logic. --------------------------------------------------------------------------- by travisbot at 2012-06-21T08:03:14Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1671555) (merged 17c8f66f into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-21T08:45:38Z :+1: thank you @stof. I think this is good to go now. --------------------------------------------------------------------------- by travisbot at 2012-06-21T08:50:28Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1671817) (merged 8982c769 into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-21T14:23:58Z @schmittjoh @fabpot The `LogoutListener` currently throws an exception when the successhandler doesn't return a `Response` ([link](https://github.com/symfony/symfony/blob/9e9519913d2c5e2bef96070bcb9106e1e389c3bd/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php#L101)). Should this code check for this too? --------------------------------------------------------------------------- by schmittjoh at 2012-06-21T14:26:49Z Yes, this code was removed, but needs to be re-added here as well. --------------------------------------------------------------------------- by travisbot at 2012-06-21T15:08:59Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1674437) (merged 5afa240d into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-26T06:01:02Z @fabpot Can you make a final decision on this? If you decide on point 3, this code can be merged. I agree with the arguments of @stof about the option handling and it 'only' being a BC break for direct users of the security component. I even think these direct users should be really careful anyway, since the behavior of the success and failurehandlers now change back to how they acted in 2.0. Now I am thinking about it, can't the optional parameters of this class move to setters anyway? That will make it cleaner to extend. --------------------------------------------------------------------------- by asm89 at 2012-06-28T10:29:50Z ping @fabpot --------------------------------------------------------------------------- by fabpot at 2012-06-28T17:23:02Z I'm ok with option 1 (the BC break). After doing the last changes, can you squash your commits before I merge? Thanks. --------------------------------------------------------------------------- by asm89 at 2012-07-06T21:59:54Z @fabpot I rebased the PR, added the authors and also ported the fix that was done in 8ffaafa86741a03ecb2f91e3d67802f4c6baf36b to be contained in the default success handler. I also squashed all the CS and 'small blabla fix' commits. Is it ok now? Edit: travisbot will probably say that the tests in this PR fail, but that is because current master fails on form things --------------------------------------------------------------------------- by asm89 at 2012-07-08T18:53:05Z I rebased the PR, tests are green now: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=refactor-authentication-success-handling)](http://travis-ci.org/asm89/symfony).
| * | | | [Security] Fix regression after rebase. Target url should be firewall dependentAlexander2012-07-082-5/+8
| | | | |
| * | | | [Security] Add note to CHANGELOG about refactored authentication ↵Alexander2012-07-084-36/+31
| | | | | | | | | | | | | | | | | | | | failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock
| * | | | [Security] Update AuthenticationFailureHandlerInterface docblock. Never ↵Alexander2012-07-081-1/+1
| | | | | | | | | | | | | | | | | | | | return null
| * | | | [Security] Move default authentication failure handling strategy to seperate ↵Alexander2012-07-084-35/+116
| | | | | | | | | | | | | | | | | | | | class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler
| * | | | [Security] Move default authentication success handling strategy to seperate ↵Alexander2012-07-084-47/+90
| | |_|/ | |/| | | | | | | | | | class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test
* | | | fixed CSFabien Potencier2012-07-0958-150/+143
|/ / /
* | | [Security] Fix typo in docblockAdrien Brault2012-07-071-1/+1
|/ /
* | [Security] fixed automatic registration of the response listener when ↵Fabien Potencier2012-07-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | creating the listener This is not a problem with Symfony, but when using the component standalone (Silex for instance), the context listener might be instantiated even if the firewall does not need to be fired. In that case, the handle() method is not called, but the response listener is called, which means that en empty token is stored in the session. For Silex, it means that when authenticated, if you visit a 404 page, you would be disconnected automatically.
* | [Security] updated CHANGELOGFabien Potencier2012-07-021-0/+1
| |
* | merged branch uwej711/security_target_path_master (PR #4409)Fabien Potencier2012-07-022-4/+6
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 8ffaafa Make the session entry for the target url firewall dependent. Discussion ---------- [Security] Make the session entry for the target url firewall dependent. Bug fix: yes Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Fixes the following tickets: License of the code: MIT If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url, which will lead me to the admin login form again. --------------------------------------------------------------------------- by travisbot at 2012-05-25T09:33:44Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1431566) (merged 8ffaafa8 into 45849ce3). --------------------------------------------------------------------------- by uwej711 at 2012-06-09T08:05:54Z Doesn't this make sense or did this slip through? Or is there something missing?
| * | Make the session entry for the target url firewall dependent.Uwe Jäger2012-05-252-4/+6
| | | | | | | | | | | | | | | | | | | | | If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url. This is not what you usually want to happen.
* | | fixed phpdocFabien Potencier2012-06-261-1/+4
| | |
* | | [Security] simplified some codeFabien Potencier2012-06-261-16/+21
| | |
* | | [Security] changed the HttpUtils constructor to tak both a UrlGenerator and ↵Fabien Potencier2012-06-263-32/+37
| | | | | | | | | | | | a UrlMatcher instead of a Router (to make it useable by Silex)
* | | merged 2.0Fabien Potencier2012-06-204-31/+69
|\ \ \ | | |/ | |/|
| * | merged branch Maks3w/patch-4 (PR #4616)Fabien Potencier2012-06-201-1/+1
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- fa050b7 [Security] Change return value in DocBlock Discussion ---------- [Security] Change return value in DocBlock Change the return value for avoid confusions. ```php if (!$user instanceof UserInterface) { throw new AuthenticationServiceException('retrieveUser() must return a UserInterface.'); } ``` [UserAuthenticationProvider.php#L67](https://github.com/symfony/symfony/tree/2.0/src/Symfony/Component/Security/Core/Authentication/Provider/UserAuthenticationProvider.php#L67) --------------------------------------------------------------------------- by travisbot at 2012-06-19T21:03:07Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1659148) (merged fa050b77 into e78a7bae).
| | * | [Security] Change return value in DocBlockMaks2012-06-191-1/+1
| | | | | | | | | | | | Change the return value for avoid confusions.
| * | | [Security] Allow "0" as a passwordVictor Berchet2012-06-201-1/+1
| |/ /
| * | tweaked the previous commitFabien Potencier2012-06-161-1/+1
| | |
| * | [Security] Only redirect to urls called with http method GETUwe Jäger2012-06-141-1/+1
| | |
| * | changed getName() to name on all Reflection* object calls (fixes #4555, refs ↵Fabien Potencier2012-06-121-1/+1
| | | | | | | | | | | | https://bugs.php.net/bug.php?id=61384)
* | | [Security] fixed exception message in EncoderFactoryDouglas Greenshields2012-06-201-1/+1
| | |
* | | [Security] removed test that fail on PHP 5.3.3Fabien Potencier2012-06-181-4/+0
| | |
* | | [Security] fixed some unit tests for PHP 5.3.3 (see ↵Fabien Potencier2012-06-181-4/+17
| | | | | | | | | | | | https://bugs.php.net/bug.php?id=53727)
* | | [Security] Fix retrieval of encoder when configured for concrete classesAlexander2012-06-181-1/+1
| | |
* | | [Security] Add failing testcases for EncoderFactoryAlexander2012-06-181-0/+23
| | |
* | | [Security] allowed class names to be passed as an argument to ↵Fabien Potencier2012-06-184-6/+28
| | | | | | | | | | | | EncoderFactoryInterface::getEncoder()
* | | changed getName() to name on all Reflection* object calls (fixes #4555, refs ↵Fabien Potencier2012-06-121-1/+1
| | | | | | | | | | | | https://bugs.php.net/bug.php?id=61384)
* | | moved the UserPassword validator from the security bundle to the security ↵Fabien Potencier2012-06-103-0/+75
| | | | | | | | | | | | component to make it reusable outside the full-stack framework
* | | [Security] Check post_only option and request methodHenrik Bjørnskov2012-06-091-0/+12
| |/ |/|
* | merged 2.0Fabien Potencier2012-05-211-2/+2
|\ \ | |/
| * merged branch kepten/ticket_1813 (PR #3551)v2.0.15Fabien Potencier2012-05-211-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache Discussion ---------- [HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] --------------------------------------------------------------------------- by stof at 2012-03-10T17:34:26Z you should also add a unit test for this --------------------------------------------------------------------------- by kepten at 2012-03-11T15:34:04Z Thanks for the feedback, I committed the changes. --------------------------------------------------------------------------- by stof at 2012-04-04T01:59:53Z @fabpot could you review it ? --------------------------------------------------------------------------- by fabpot at 2012-04-04T07:15:34Z My comments: * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers. * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs). * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed). --------------------------------------------------------------------------- by danielholmes at 2012-04-14T13:27:09Z A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this: ``` <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] </IfModule> ``` NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening --------------------------------------------------------------------------- by towards at 2012-04-20T16:12:49Z @kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI --------------------------------------------------------------------------- by kepten at 2012-04-20T16:15:57Z ok, so is my PR is useless or should I still fix problems? --------------------------------------------------------------------------- by towards at 2012-04-20T16:20:26Z your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes --------------------------------------------------------------------------- by vicb at 2012-04-20T16:20:36Z I have been working with @towards: your PR is useful, please implement his comments and squash your PR. --------------------------------------------------------------------------- by kepten at 2012-04-20T16:59:07Z never squashed before, is it okay now? :) --------------------------------------------------------------------------- by stof at 2012-04-20T17:21:07Z it is --------------------------------------------------------------------------- by vicb at 2012-05-20T19:57:51Z @fabpot this should be ready to be merged
| | * [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI ↵kepten2012-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L]
* | | Changed composer constraint to allow Doctrine 2.3 tooChristophe Coevoet2012-05-201-3/+4
| | |
* | | merged 2.0Fabien Potencier2012-05-201-2/+1
|\ \ \ | |/ /
* | | merged 2.0Fabien Potencier2012-05-191-1/+0
|\ \ \ | |/ /
| * | fixed CSFabien Potencier2012-05-1814-64/+64
| | |
| * | fixed phpdoc @param alignmentv2.0.14Fabien Potencier2012-05-1511-26/+26
| | |
* | | fixed CSFabien Potencier2012-05-1816-67/+67
| | |
* | | fixed phpdoc @param alignmentFabien Potencier2012-05-1512-28/+28
| | |
* | | merged 2.0Fabien Potencier2012-05-112-1/+10
|\ \ \ | |/ /
| * | [Security] fixed phpdoc.Hugo Hamon2012-05-011-1/+1
| | |
| * | [Security] added some missing phpdoc for AbstractToken::setUser() and ↵Hugo Hamon2012-05-012-1/+10
| | | | | | | | | | | | UsernamePasswordToken::__construct() methods.
| * | use SecurityContextInterface instead of SecurityContextv2.0.13Pierre Minnieur2012-03-092-5/+5
| |/
* | updated minimum PHP version to 5.3.3Fabien Potencier2012-05-071-1/+1
| | | | | | | | | | 5.3.3 has some interesting fixes and this is the version used by Redhat 6 and Debian 6
* | merged branch shieldo/fix_exception_message (PR #4173)Fabien Potencier2012-05-012-2/+2
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 69e0451 [Security] fixed English grammar in exception message Discussion ---------- [Security] fixed English grammar in exception message
| * | [Security] fixed English grammar in exception messageDouglas Greenshields2012-05-012-2/+2
| | |
* | | merged branch willdurand/fix-components (PR #4155)Fabien Potencier2012-05-015-41/+20
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- c195957 [Components] Tests/Autoloading fixes Discussion ---------- Fix components See #4141 ---- This PR: * configures each component to use composer to manage "dev" dependencies instead of env variables; * adds phpunit configuration file on Filesystem component; * fixes READMEs. It's mergeable without any problems, but I would recommend to wait a fix in Composer in order to use `self.version` in `require`/`require-dev` sections. Note: I kept `suggest` sections because it makes sense but this PR doesn't aim to provide useful explanations for each entry. It could be another PR, not that one. --------------------------------------------------------------------------- by willdurand at 2012-04-30T20:43:13Z @fabpot I reviewed each component, one by one. Now `phpunit` always works, even if tests are skipped. A simple `composer install --dev` allows to run the complete test suite. Each commit is well separated from the others. I guess, everything is ok now. --------------------------------------------------------------------------- by Tobion at 2012-04-30T20:47:00Z Please squash, as it makes no sense to have the same commit for each component. --------------------------------------------------------------------------- by fabpot at 2012-05-01T14:26:11Z Can you squash your commits before I merge? Thanks. --------------------------------------------------------------------------- by willdurand at 2012-05-01T14:29:38Z done --------------------------------------------------------------------------- by fabpot at 2012-05-01T15:48:25Z It does not seem that the commits are squashed. --------------------------------------------------------------------------- by willdurand at 2012-05-01T15:54:08Z done
| * | [Components] Tests/Autoloading fixesWilliam DURAND2012-05-015-41/+20
| | | | | | | | | | | | | | | | | | | | | | | | * Switched to Composer to manage "dev" dependencies * Fixed READMEs * Excluded vendor in phpunit.xml.dist files * Fixed message in bootstrap.php files * Added autoloader for the component itself
* | | fixed CSFabien Potencier2012-05-012-12/+12
| | |
* | | Revert "merged branch Seldaek/master (PR #4133)"Fabien Potencier2012-04-271-1/+1
| | | | | | | | | | | | | | | This reverts commit 00e7a94a8c761a3e10c388e4d06cb3ce4cd04ad7, reversing changes made to a01dec00f4e8de357cce5fdf121ac98729f7f8ff.
* | | Update branch aliasesJordi Boggiano2012-04-271-1/+1
| | |
* | | [Security] added CHANGELOGFabien Potencier2012-04-261-0/+19
|/ /
* | [Security][ACL] Fixed ObjectIdentity::fromDomainObject and ↵Jordan Alliot2012-04-126-68/+200
| | | | | | | | | | | | | | UserSecurityIdentity::from(Account|Token) when working with proxies Backported ClassUtils class from Doctrine Common 2.2 Fixes #2611, #2056, #2048, #2035
* | fixed CS (missing or misplaced license blocks)Eriksen Costa2012-04-0220-50/+149
| |
* | updated license blocksEriksen Costa2012-03-3127-81/+81
| |
* | [PhpUnit] Fix the path to the boostrap files in the componentsVictor Berchet2012-03-301-1/+1
| |
* | moved component and bridge unit tests to the src/ directoryFabien Potencier2012-03-2969-4/+8774
| | | | | | | | This is the first step to make each Symfony Component and Bridge self-contained.
* | fixed CSFabien Potencier2012-03-231-2/+2
| |
* | [Security] Log file/line that triggered the AccessDeniedExceptionJordi Boggiano2012-03-231-2/+2
| |
* | [SecurityBundle] Allow switching to the user that is already impersonated ↵Andreas Hucks2012-03-151-6/+10
| | | | | | | | | | | | | | | | | | | | (fix #2554) Disabled exception when switching to the user that is already impersonated, exception is now only thrown when trying to switch to a new user. Added an Excption exception when switching fails because target user does not exist. Added funtional tests for switching users.
* | fixed CSFabien Potencier2012-03-111-11/+10
| |
* | [SecurityBundle] Improve the init:acl commandVictor Berchet2012-03-111-3/+6
| |
* | [Security]replaced acl:init command with postGenerateSchema listenerJohannes M. Schmitt2012-03-111-0/+16
| |
* | merged branch Engerim/patch-1 (PR #3538)Fabien Potencier2012-03-111-3/+3
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 3fd9003 Update src/Symfony/Component/Security/Acl/Permission/MaskBuilder.php Discussion ---------- Changed return Tags from PermissionBuilder to MaskBuilder
| * | Update src/Symfony/Component/Security/Acl/Permission/MaskBuilder.phpAlexander Miehe2012-03-091-3/+3
| | |
* | | [Security] Regenerated the ACL SQL schema with the latest Doctrine versionChristophe Coevoet2012-03-117-44/+65
|/ /
* | fixed docblockPierre Minnieur2012-03-071-1/+1
| |
* | use SecurityContextInterface instead of SecurityContextPierre Minnieur2012-03-071-2/+2
| |
* | use SecurityContextInterface instead of SecurityContextPierre Minnieur2012-03-061-2/+2
| |
* | merged branch jmikola/logout-csrf (PR #3007)Fabien Potencier2012-03-053-15/+68
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 49a8654 [Security] Use LogoutException for invalid CSRF token in LogoutListener a96105e [SecurityBundle] Use assertCount() in tests 4837407 [SecurityBundle] Fix execution of functional tests with different names 66722b3 [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens aaaa040 [Security] Allow LogoutListener to validate CSRF tokens b1f545b [Security] Refactor LogoutListener constructor to take options c48c775 [SecurityBundle] Add functional test for form login with CSRF token Discussion ---------- [Security] Implement support for CSRF tokens in logout URL's ``` Bug fix: no Feature addition: yes Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: - Todo: - ``` [![Build Status](https://secure.travis-ci.org/jmikola/symfony.png?branch=logout-csrf)](http://travis-ci.org/jmikola/symfony) This derived from #3006 but properly targeting on the master branch. This exposes new configuration options to the logout listener to enable CSRF protection, as already exists for the form login listener. The individual commits and their extended messages should suffice for explaining the logical changes of the PR. In addition to changing LogoutListener, I also created a templating helper to generate logout URL's, which includes a CSRF token if necessary. This may or may not using routing, depending on how the listener is configured since both route names or hard-coded paths are valid options. Additionally, I added unit tests for LogoutListener and functional tests for both CSRF-enabled form logins and the new logout listener work. Kudo's to @henrikbjorn for taking the time to document CSRF validation for form login listeners (see [here](http://henrik.bjrnskov.dk/symfony2-cross-site-request-forgery/)). The [Logout CSRF Protection](http://www.yiiframework.com/wiki/190/logout-csrf-protection/) article on the Yii Framework wiki was also helpful in drafting this. --------------------------------------------------------------------------- by jmikola at 2011-12-31T07:50:31Z Odd that Travis CI reported a build failure for PHP 5.3.2, but both 5.3 and 5.4 passed: http://travis-ci.org/#!/jmikola/symfony/builds/463356 My local machine passes as well. --------------------------------------------------------------------------- by jmikola at 2012-02-06T20:05:30Z @schmittjoh: Please let me know your thoughts on the last commit. I think it would be overkill to add support for another handler service and/or error page just for logout exceptions. Perhaps as an alternative, we might just want to consider an invalid CSRF token on logout imply a false return value for `LogoutListener::requiresLogout()`. That would sacrifice the ability to handle the error separately (which a 403 response allows us), although we could still add logging (currently done in ExceptionListener). --------------------------------------------------------------------------- by jmikola at 2012-02-13T17:41:33Z @schmittjoh: ping --------------------------------------------------------------------------- by fabpot at 2012-02-14T23:36:22Z @jmikola: Instead of merging symfony/master, can you rebase? --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:00:49Z Will do. --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:05:48Z ``` [avocado: symfony] logout-csrf (+9/-216) $ git rebase master First, rewinding head to replay your work on top of it... Applying: [SecurityBundle] Add functional test for form login with CSRF token Applying: [Security] Refactor LogoutListener constructor to take options Applying: [Security] Allow LogoutListener to validate CSRF tokens Applying: [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens Applying: [SecurityBundle] Fix execution of functional tests with different names Applying: [SecurityBundle] Use assertCount() in tests Using index info to reconstruct a base tree... Falling back to patching base and 3-way merge... Applying: [Security] Use LogoutException for invalid CSRF token in LogoutListener [avocado: symfony] logout-csrf (+7) $ git st # On branch logout-csrf # Your branch and 'origin/logout-csrf' have diverged, # and have 223 and 9 different commit(s) each, respectively. # nothing to commit (working directory clean) [avocado: symfony] logout-csrf (+7) $ ``` After rebasing, my merge commits disappeared. Is this normal? --------------------------------------------------------------------------- by stof at 2012-02-15T00:15:07Z Are you sure they disappeared ? Diverging from the remote branch is logical (you rewrote the history and so changed the commit id) but are you sure it does not have the commits on top of master ? Try ``git log master..logout-scrf`` If your commut are there, you simply need to force the push for the logout-csrf branch (take care to push only this branch during the force push to avoid messing all others as git won't warn you when asking to force) --------------------------------------------------------------------------- by stof at 2012-02-15T00:17:09Z ah sorry, you talked only about the merge commit. Yeah it is normal. When reapplying your commits on top of master, the merge commit are not kept as you are reapplying the changes linearly on top of the other branch (and deleting the merge commit was the reason why @fabpot asked you to rebase instead of merging btw) --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:18:00Z The merge commits are not present in `git log master..logout-csrf`. Perhaps it used those merge commits when rebasing, as there were definitely conflicts resolved when I originally merged in symfony/master (@fabpot had made his own changes to LogoutListener). I'll force-push the changes to my PR brange. IIRC, GitHub is smart enough to preserve inline diff comments, provided they were made through the PR and not on the original commits. --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:19:38Z That worked well. In the future, I think I'll stick to merging upstream in and then rebasing afterwards. Resolving conflicts is much easier during a merge than interactive rebase. --------------------------------------------------------------------------- by jmikola at 2012-02-23T18:46:13Z @fabpot @schmittjoh: Is there anything else I can do for this PR? I believe the exception was the only outstanding question (see: [this comment](https://github.com/symfony/symfony/pull/3007#issuecomment-3835716)).
| * | [Security] Use LogoutException for invalid CSRF token in LogoutListenerJeremy Mikola2012-02-143-2/+36
| | | | | | | | | | | | | | | | | | On the advice of @schmittjoh, this commit adds a LogoutException class for use by LogoutListener if the CSRF token is invalid. The handling in the Security component's ExceptionListener is modeled after AccessDeniedException, which gets wrapped in an AccessDeniedHttpException in the absence of handler service or error page (I didn't think it was appropriate to re-use those for LogoutException).
| * | [Security] Allow LogoutListener to validate CSRF tokensJeremy Mikola2012-02-141-10/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds several new options to the logout listener, modeled after the form_login listener: * csrf_parameter * intention * csrf_provider The "csrf_parameter" and "intention" have default values if omitted. By default, "csrf_provider" is empty and CSRF validation is disabled in LogoutListener (preserving BC). If a service ID is given for "csrf_provider", CSRF validation will be enabled. Invalid tokens will result in an InvalidCsrfTokenException being thrown before any logout handlers are invoked.
| * | [Security] Refactor LogoutListener constructor to take optionsJeremy Mikola2012-02-141-9/+9
| | | | | | | | | | | | This will facilitate adding additional options for CSRF protection. Additionally, a unit test for existing behavior was added.
* | | [Security] added support for the remember_me parameter in the query (closes ↵Fabien Potencier2012-03-021-1/+1
| | | | | | | | | | | | #3460)
* | | Removed version fieldJordi Boggiano2012-02-271-1/+0
| | |
* | | Add branch-alias for composerJordi Boggiano2012-02-251-1/+6
| | |
* | | merged 2.0Fabien Potencier2012-02-221-1/+1
|\ \ \ | | |/ | |/|
| * | Updated LICENSE files copyrightv2.0.12marc.weistroff2012-02-221-1/+1
| | |
* | | [Security] added AccessMapInterfaceKris Wallsmith2012-02-154-5/+38
| |/ |/|
* | allow unsetting parentAcl on MutableAclInterfaceToni Uebernickel2012-01-302-4/+5
| |
* | Authentication(Success|Failure)Handler can now return nullOlivier Dolbeau2012-01-243-4/+8
| |
* | merged branch gustavopiltcher/master (PR #2858)Fabien Potencier2012-01-221-3/+5
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 4a797df Oracle issues 81d73bb Oracle issues 2316b21 Oracle issues 315bfc4 just update b20b15b Oracle 10 issues Discussion ---------- Oracle issues updated with some adjustments required by stof --------------------------------------------------------------------------- by fabpot at 2011-12-13T07:24:12Z @schmittjoh: Can you have a look at this PR? --------------------------------------------------------------------------- by fabpot at 2011-12-24T08:19:37Z Can you squash your commit before I merge your PR? Thanks.
| * | Oracle issuesGustavo Piltcher2011-12-231-1/+1
| | | | | | | | | | | | minor modifications
| * | Oracle issuesGustavo Piltcher2011-12-131-3/+4
| | | | | | | | | | | | minor changes on code
| * | Oracle issuesGustavo Piltcher2011-12-011-1/+1
| | |
| * | just updateGustavo Piltcher2011-12-011-12/+1
| | |
| * | Oracle 10 issuesGustavo Piltcher2011-11-231-4/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I've changed Schema.php to not use Restrict on delete/update since oracle report it as missing keyword. Both restrict and no action on oracle seems to be redundant and used by default. So the output query can't use it. I've also changed Schema construct to accept a SchemaConfig parameter. InitAcl was changed to pass on new Schema a SchemaConfig generated by SchemaManager, I did that because acl command was generating names with more than 30 characters and Oracle doesn't accept, this seems to solve the problem and init:acl works properly.
* | | merged 2.0Fabien Potencier2012-01-171-1/+1
|\ \ \ | | |/ | |/|
| * | fixed CSv2.0.10Fabien Potencier2012-01-171-1/+1
| | |
| * | fix expected return type of MutableAclProviderToni Uebernickel2012-01-161-1/+1
| | |
* | | add missing class var; add phpdocsGordon Franke2012-01-162-0/+6
| | |
* | | Add some more tests, and enforce boolean return value of interface ↵Dariusz Górecki2012-01-101-1/+1
| | | | | | | | | | | | implementations.
* | | When method name is `hasUserChanged` the return boolean should be true (to ↵Dariusz Górecki2012-01-101-11/+11
| | | | | | | | | | | | match question semantics) and false when user has not changed, this commits inverts return statements.
generated by cgit v1.1 at 2025-05-24 23:22:44 +0000