summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* changed the Firewall to be a proper subscriberFabien Potencier2012-11-061-1/+8
|
* changed the remember-me listener to be a proper subscriberFabien Potencier2012-11-061-1/+8
|
* merged branch fabpot/401-status-code (PR #5882)Fabien Potencier2012-11-064-7/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Commits ------- e193590 [Security] removed the 401 error custom status message Discussion ---------- [Security] removed the 401 error custom status message see fabpot/Silex#496 --------------------------------------------------------------------------- by pborreli at 2012-10-31T17:29:24Z @fabpot please fix the test suite, if you don't know how to do it, read http://symfony.com/doc/current/contributing/code/tests.html, thx :smile_cat:
| * [Security] removed the 401 error custom status messageFabien Potencier2012-11-064-7/+2
| |
* | removed unused use statementsFabien Potencier2012-11-042-2/+0
|/
* merged branch acasademont/tweak_userform_security_listener (PR #5824)Fabien Potencier2012-10-281-11/+8
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Commits ------- 3e58893 [Security] Tweak UsernamePasswordFormAuthenticationListener Discussion ---------- [Security] Tweak UsernamePasswordFormAuthenticationListener Bug fix: no Feature addition: no Backwards compatibility break: no Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/acasademont/symfony.png)](http://travis-ci.org/acasademont/symfony) Fixes the following tickets: - Todo: - License of the code: MIT Documentation PR: - Improvements: - Do not check twice for the ```only_post``` condition. The condition in the ```attemptAuthentication``` method is useless as this method will never be called if the previous ```requiresAuthentication``` call returns false. - If the expected request is ```only_post```, check only the POST variables for the username and password parameters. Otherwise, query params and attributes are checked before. - Use POST instead of post for correctness
| * [Security] Tweak UsernamePasswordFormAuthenticationListenerAlbert Casademont2012-10-231-11/+8
| | | | | | | | | | - Do not check twice for the only_post condition - If the expected request is only_post, check only the post variables for the username and password parameters
* | [Security] fixed tests when OpenSSL is not installedFabien Potencier2012-10-282-5/+2
| |
* | fixed tests when OpenSsl is not enabled in PHP, renamed a missnamed test, ↵Fabien Potencier2012-10-283-3/+48
| | | | | | | | added missing license doc blocks
* | fixed CSFabien Potencier2012-10-284-18/+18
| |
* | added a SecureRandomInterfaceFabien Potencier2012-10-283-7/+35
| |
* | rename String to StringUtilsFabien Potencier2012-10-283-6/+6
| |
* | moved the secure random dep for remember me as a constructor argumentFabien Potencier2012-10-282-5/+14
| |
* | renamed Prng to SecureRandomFabien Potencier2012-10-285-43/+42
| |
* | simplified the Prng codeFabien Potencier2012-10-283-54/+30
| |
* | moved the secure random class from JMSSecurityExtraBundle to Symfony (closes ↵Fabien Potencier2012-10-289-36/+401
| | | | | | | | #3595)
* | Merge branch '2.1'Fabien Potencier2012-10-248-16/+12
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: added missing use statment (closes #5825) Code cleanup [WebProfilerBundle] Fixed the use of nested macros Removed unused use statements. Nsdocblocks [ConfigDumpReference] avoid notice for variable nodes fixed fallback locale UniqueValidatorTest, Change message on assertions Documented removed _form_is_choice_group function Conflicts: src/Symfony/Bundle/FrameworkBundle/Command/ConfigDumpReferenceCommand.php src/Symfony/Bundle/WebProfilerBundle/Profiler/TemplateManager.php
| * Code cleanupv2.1.3Mario A. Alvarez Garcia2012-10-224-4/+0
| |
| * NsdocblocksDrak2012-10-204-12/+12
| |
* | Merge branch '2.1'Fabien Potencier2012-10-181-1/+1
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: (28 commits) Delete use of CreationExeption [Form] Fixed error message in PropertyPath to not advice to use a non-existing feature [Form] Fixed creation of multiple money fields with different currencies [Form] Fixed setting the "data" option to an object in "choice" and "entity" type Fixed Serbian plural translations. Fixed IPv6 Check in RequestMatcher Fix typo change what I think is a typo [Console] Fix error when mode is not in PATH [WebProfilerBundle] fixed macro usage (to be forward compatible with Twig 2.x) Change monolog require-dev to use the branch alias instead of dev-master [FrameworkBundle] partially reverted previous merge [2.1] Added missing error return codes in commands Made the router lazy when setting the context [WebProfilerBundle] fixed typos Fix incorrect variable in FileProfilerStorage UnitTest fix UnitTest fix added a unit test fixed #5384 ...
| * change what I think is a typoGrégoire Paris2012-10-161-1/+1
| |
* | [Security] Added Pbkdf2PasswordEncoderSebastiaan Stok2012-10-083-0/+147
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [Security] changed default iterations of Pbkdf2PasswordEncoder to 1000 instead of 5000 [Security] Improved description of PBKDF2 encoder [SecurityBundle] added PBKDF2 PasswordEncoder updated CHANGELOG.md [Security] Use the build-in hash_pbkdf2() when available [SecurityBundle] added information about hash_algorithm for configuration [Security] always check algorithm and fixed CS
* | Merge branch '2.1'Fabien Potencier2012-10-061-0/+2
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: fixed CS added doc comments added doc comments [Validator] Updated swedish translation Update src/Symfony/Component/Validator/Resources/translations/validators.de.xlf [2.1] Exclude tests from zips via gitattributes [HttpKernel][Translator] Fixed type-hints Updated lithuanian validation translation [DomCrawler] Allows using multiselect through Form::setValues(). [Translation] forced the catalogue to be regenerated when a resource is added (closes symfony/Translation#1) Unit test for patched method OptionsResolver::validateOptionValues(). validateOptionValues throw a notice if an allowed value is set and the corresponding option isn't. [Form] Hardened code of ViolationMapper against errors [HttpFoundation] Fixed #5611 - Request::splitHttpAcceptHeader incorrect result order. [Form] Fixed negative index access in PropertyPathBuilder Update src/Symfony/Component/Validator/Resources/translations/validators.ro.xlf Conflicts: src/Symfony/Component/DomCrawler/Form.php src/Symfony/Component/Process/Process.php
| * [2.1] Exclude tests from zips via gitattributesIgor Wiedler2012-10-041-0/+2
| |
* | Merge branch '2.1'Fabien Potencier2012-10-021-1/+1
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | * 2.1: [2.1] Fix SessionHandlerInterface autoloading Remove executable bit from HttpKernel/DependencyInjection/ConfigurableExtension.php [2.0][http-foundation] Fix Response::getDate method [DoctrineBridge] Require class option for DoctrineType [HttpFoundation] fixed the path to the SensioHandlerInterface class in composer.json Support the new Microsoft URL Rewrite Module for IIS 7.0. @see http://framework.zend.com/issues/browse/ZF-4491 @see http://framework.zend.com/code/revision.php?repname=Zend+Framework&rev=24842 fixed undefined variable hasColorSupport does not take an argument Improve FilterResponseEvent docblocks Response ref
| * Merge branch '2.0' into 2.1Fabien Potencier2012-10-021-1/+1
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.0: [2.0][http-foundation] Fix Response::getDate method Support the new Microsoft URL Rewrite Module for IIS 7.0. @see http://framework.zend.com/issues/browse/ZF-4491 @see http://framework.zend.com/code/revision.php?repname=Zend+Framework&rev=24842 fixed undefined variable hasColorSupport does not take an argument Improve FilterResponseEvent docblocks Response ref Conflicts: tests/Symfony/Tests/Component/HttpFoundation/ResponseTest.php
| | * fixed undefined variablev2.0.18James Michael DuPont2012-09-281-1/+1
| | |
| | * avoid fatal error on invalid sessionv2.0.17Kris Wallsmith2012-08-071-8/+15
| | |
* | | Optimize autoload prefix in composer.jsonFilippo Tessarotto2012-09-281-1/+1
| | | | | | | | | | | | | | | | | | By having more specific autoload prefixes it is possible to reduce the number of stat calls made. Also it prevents conflicts with similar namespaces.
* | | Update ↵nervo2012-09-231-1/+1
| | | | | | | | | | | | | | | src/Symfony/Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php Better consistency in request method checking (See L.58)
* | | replaced self.version/2.1.* by 2.2.* in composer.json filesFabien Potencier2012-09-101-5/+5
| | |
* | | merged 2.1Fabien Potencier2012-09-101-5/+5
|\ \ \ | |/ /
| * | replaced self.version by 2.1.* in composer.json filesv2.1.2v2.1.1Fabien Potencier2012-09-101-5/+5
| | |
* | | udpated composer.json to 2.2Fabien Potencier2012-09-061-7/+7
|/ /
* | merged branch beberlei/RevertDbalAcl (PR #5253)v2.1.0Fabien Potencier2012-09-041-12/+12
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 1b5ad17 Revert "Removed MySQL-exclusive usage of unsigned integer from table creation" Discussion ---------- [Security][DBAL] Revert MySQL unsigned removal Revert "Removed MySQL-exclusive usage of unsigned integer from table creation" This reverts commit 57694aaa94ec0118f516e8962be2f018c36d2011. The problem is underlying in Doctrine DBAL change tracking and should either be fixed or ignored there. I opened a ticket on Doctrine Jira http://doctrine-project.org/jira/browse/DBAL-322 --------------------------------------------------------------------------- by fabpot at 2012-08-14T06:40:47Z I will merge this PR after we have a release of DBAL that includes the fix for DBAL-322. --------------------------------------------------------------------------- by acasademont at 2012-08-20T08:01:48Z This was already fixed 2 weeks ago in doctrine/dbal#183 so i guess this can be closed --------------------------------------------------------------------------- by acasademont at 2012-08-20T08:02:06Z merged i mean
| * | Revert "Removed MySQL-exclusive usage of unsigned integer from table creation"Benjamin Eberlei2012-08-141-12/+12
| | | | | | | | | | | | | | | | | | | | | This reverts commit 57694aaa94ec0118f516e8962be2f018c36d2011. The problem is underlying in Doctrine DBAL change tracking and should either be fixed or ignored there.
* | | [Security] fixed typo in a testFabien Potencier2012-08-311-1/+1
| | |
* | | Move remember me ResponseListener from security bundle into security componentDerManoMann2012-08-301-0/+33
| | | | | | | | | | | | This move allows to implement the remember me feature in Silex without having to reference the security bundle.
* | | Add minimum-stability (dev) in each componentWilliam DURAND2012-08-221-0/+1
|/ /
* | Removed MySQL-exclusive usage of unsigned integer from table creationdaFish2012-08-131-12/+12
| |
* | merged 2.0Fabien Potencier2012-08-102-8/+58
| |
* | Fixed typosPascal Borreli2012-07-285-6/+6
| |
* | [Security] tweaked previous mergeFabien Potencier2012-07-261-10/+4
| |
* | [Security] add docblocks to InteractiveLoginEventJonathan Ingram2012-07-261-0/+22
| | | | | | Close #5053 (was easier to just create a new PR).
* | [Security] Fixed use_referer option not working properly when login_path is ↵Albert Casademont2012-07-241-1/+1
| | | | | | | | | | | | | | | | | | | | a route name When use_referer is set to true and the request comes from the login page, the user should not be redirected to the login form again (the referer) but to the default_target_path. The problem arises when our login_path option is not a path but a route name, as the ```getUriForPath()``` method is not made to create routes from route names.
* | merged 2.0Fabien Potencier2012-07-231-0/+1
|\ \ | |/
| * Added missing propertyGrégoire Pineau2012-07-231-0/+1
| |
| * fixed CS (mainly method signatures)v2.0.16Fabien Potencier2012-07-0953-144/+142
| |
* | merged branch KaipiYann/Fix-DocBlock-attemptAuthentication (PR #4996)Fabien Potencier2012-07-211-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 134cc84 [Security] Fix DocBlock of attemptAuthentication Discussion ---------- [Security] Fix DocBlock of attemptAuthentication Bug fix: no Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: Todo: - License of the code: MIT Documentation PR: -
| * | [Security] Fix DocBlock of attemptAuthenticationKaipi Yann2012-07-201-1/+1
| | | | | | | | | | | | Add Response as possible return type of the method because the method AbstractAuthenticationListener::handle() test if $returnValue is an instance of Response (line 148).
* | | Revert "merged branch stof/serializable_role (PR #4925)"Fabien Potencier2012-07-153-36/+1
| | | | | | | | | | | | | | | This reverts commit b0750f6dcd1e6f8b1be2c1e6604d4cbb785c9a8e, reversing changes made to d09bfe7552148d1d36b65487dfcbd378830b55a0.
* | | merged branch stof/serializable_role (PR #4925)Fabien Potencier2012-07-153-1/+36
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 1f2f866 fixed the serialization of the SwitchUserRole b55930a [Security] Implemented the Serializable interface in the Role class Discussion ---------- [Security] Implemented the Serializable interface in the Role class The Role class is serialized in the session for each role of the user. Implementing the Serializable interface allows to reduce the size of the data.
| * | | fixed the serialization of the SwitchUserRoleChristophe Coevoet2012-07-141-0/+18
| | | |
| * | | [Security] Implemented the Serializable interface in the Role classChristophe Coevoet2012-07-142-1/+18
| | | |
* | | | Revert "raised the minimum version of PHP to 5.3.4 (closes #3856)"Fabien Potencier2012-07-151-1/+1
| | | | | | | | | | | | | | | | This reverts commit 2dcc44897ef1ceec2721bbf616c4744131340657.
* | | | [Security] Add note to changelog about BC breakAlexander2012-07-141-0/+2
| | | |
* | | | [Security] Extract default logout success handling logicAlexander2012-07-143-16/+59
|/ / /
* | | raised the minimum version of PHP to 5.3.4 (closes #3856)Fabien Potencier2012-07-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | We've raised the minimum version of PHP because of a PHP bug before 5.3.4: https://bugs.php.net/bug.php?id=52083 https://bugs.php.net/bug.php?id=50027
* | | ensured that an exception is always converted to an error response (and that ↵Fabien Potencier2012-07-131-1/+0
| | | | | | | | | | | | we keep the HTTP status code and headers)
* | | [Security] made sure that we always replace the security access denied ↵Fabien Potencier2012-07-131-4/+2
| | | | | | | | | | | | exception to an HTTP one
* | | merged branch asm89/fix-default-auth-successhandler-extension (PR #4865)Fabien Potencier2012-07-121-6/+24
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 5e6c06f [Security] Remove hard dependency on $providerKey for default auth success handler Discussion ---------- [Security] Remove hard dependency on $providerKey for default auth success handler Bug fix: yes? Feature addition: yes? Backwards compatibility break: no Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=fix-default-auth-successhandler-extension)](http://travis-ci.org/asm89/symfony) License of the code: MIT In 8ffaafa86741a03ecb2f91e3d67802f4c6baf36b a hard dependency was introduced between the default authentication success handling code and the active firewall. This makes sense. However, for people implementing their own success handler this makes it impossible to extend the default class as the `$providerKey` is set in the extension of the security bundle. This PR makes the dependency a soft one so people can extend the class and use the default definition as a parent for their own service. However it is the responsibility of the developers to set the appropriate `$providerKey` if they want to use the target url saved in the session. Imo this is the right way as the developer should also set the appropriate options for the parent class in the overriding constructor. --------------------------------------------------------------------------- by stof at 2012-07-11T19:01:12Z @asm89 this PR need to be rebased according to github --------------------------------------------------------------------------- by asm89 at 2012-07-11T19:13:09Z @stof Done :) --------------------------------------------------------------------------- by asm89 at 2012-07-12T10:07:53Z @fabpot Done.
| * | | [Security] Remove hard dependency on $providerKey for default auth success ↵Alexander2012-07-121-6/+24
| | | | | | | | | | | | | | | | handler
* | | | added missing dotChristian Raue2012-07-121-1/+1
|/ / /
* | | merged branch asm89/refactor-authentication-success-handling (PR #4599)Fabien Potencier2012-07-097-79/+201
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- bb138da [Security] Fix regression after rebase. Target url should be firewall dependent eb19f2c [Security] Add note to CHANGELOG about refactored authentication failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock f9d5606 [Security] Update AuthenticationFailureHandlerInterface docblock. Never return null 915704c [Security] Move default authentication failure handling strategy to seperate class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler c6aa392 [Security] Move default authentication success handling strategy to seperate class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test Discussion ---------- [Security] Refactor authentication success handling Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=refactor-authentication-success-handling)](http://travis-ci.org/asm89/symfony) License of the code: MIT This PR extracts the default authentication success handling to its own class as discussed in #4553. In the end the PR will basically revert #3183 (as suggested by @schmittjoh) and fix point one of #838. There are a few noticeable changes in this PR: - This implementation changes the constructor signature of the `AbstractAuthentictionListener` and `UsernamePasswordFormAuthenticationListener` by making the `AuthenticationSuccessHandler` mandatory (BC break). If this WIP is approved I will refactor the failure handling logic too and then this will also move one place in the constructor - This PR reverts the change of making the returning of a `Response` optional in the `AuthenticationSuccessHandlerInterface`. Developers can now extend the default behavior themselves @schmittjoh Any suggestions? Or a +1 to do the failure logic too? --------------------------------------------------------------------------- by schmittjoh at 2012-06-17T23:53:07Z +1 from me @fabpot, what so you think? --------------------------------------------------------------------------- by fabpot at 2012-06-19T08:15:48Z Can you add a note in the CHANGELOG? Thanks. --------------------------------------------------------------------------- by asm89 at 2012-06-19T10:22:20Z I will, but I'll first do the same for the failure logic. --------------------------------------------------------------------------- by travisbot at 2012-06-21T08:03:14Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1671555) (merged 17c8f66f into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-21T08:45:38Z :+1: thank you @stof. I think this is good to go now. --------------------------------------------------------------------------- by travisbot at 2012-06-21T08:50:28Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1671817) (merged 8982c769 into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-21T14:23:58Z @schmittjoh @fabpot The `LogoutListener` currently throws an exception when the successhandler doesn't return a `Response` ([link](https://github.com/symfony/symfony/blob/9e9519913d2c5e2bef96070bcb9106e1e389c3bd/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php#L101)). Should this code check for this too? --------------------------------------------------------------------------- by schmittjoh at 2012-06-21T14:26:49Z Yes, this code was removed, but needs to be re-added here as well. --------------------------------------------------------------------------- by travisbot at 2012-06-21T15:08:59Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1674437) (merged 5afa240d into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-26T06:01:02Z @fabpot Can you make a final decision on this? If you decide on point 3, this code can be merged. I agree with the arguments of @stof about the option handling and it 'only' being a BC break for direct users of the security component. I even think these direct users should be really careful anyway, since the behavior of the success and failurehandlers now change back to how they acted in 2.0. Now I am thinking about it, can't the optional parameters of this class move to setters anyway? That will make it cleaner to extend. --------------------------------------------------------------------------- by asm89 at 2012-06-28T10:29:50Z ping @fabpot --------------------------------------------------------------------------- by fabpot at 2012-06-28T17:23:02Z I'm ok with option 1 (the BC break). After doing the last changes, can you squash your commits before I merge? Thanks. --------------------------------------------------------------------------- by asm89 at 2012-07-06T21:59:54Z @fabpot I rebased the PR, added the authors and also ported the fix that was done in 8ffaafa86741a03ecb2f91e3d67802f4c6baf36b to be contained in the default success handler. I also squashed all the CS and 'small blabla fix' commits. Is it ok now? Edit: travisbot will probably say that the tests in this PR fail, but that is because current master fails on form things --------------------------------------------------------------------------- by asm89 at 2012-07-08T18:53:05Z I rebased the PR, tests are green now: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=refactor-authentication-success-handling)](http://travis-ci.org/asm89/symfony).
| * | | [Security] Fix regression after rebase. Target url should be firewall dependentAlexander2012-07-082-5/+8
| | | |
| * | | [Security] Add note to CHANGELOG about refactored authentication ↵Alexander2012-07-084-36/+31
| | | | | | | | | | | | | | | | failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock
| * | | [Security] Update AuthenticationFailureHandlerInterface docblock. Never ↵Alexander2012-07-081-1/+1
| | | | | | | | | | | | | | | | return null
| * | | [Security] Move default authentication failure handling strategy to seperate ↵Alexander2012-07-084-35/+116
| | | | | | | | | | | | | | | | class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler
| * | | [Security] Move default authentication success handling strategy to seperate ↵Alexander2012-07-084-47/+90
| | | | | | | | | | | | | | | | class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test
* | | | fixed CSFabien Potencier2012-07-0958-150/+143
|/ / /
* | | [Security] Fix typo in docblockAdrien Brault2012-07-071-1/+1
|/ /
* | [Security] fixed automatic registration of the response listener when ↵Fabien Potencier2012-07-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | creating the listener This is not a problem with Symfony, but when using the component standalone (Silex for instance), the context listener might be instantiated even if the firewall does not need to be fired. In that case, the handle() method is not called, but the response listener is called, which means that en empty token is stored in the session. For Silex, it means that when authenticated, if you visit a 404 page, you would be disconnected automatically.
* | [Security] updated CHANGELOGFabien Potencier2012-07-021-0/+1
| |
* | merged branch uwej711/security_target_path_master (PR #4409)Fabien Potencier2012-07-022-4/+6
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 8ffaafa Make the session entry for the target url firewall dependent. Discussion ---------- [Security] Make the session entry for the target url firewall dependent. Bug fix: yes Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Fixes the following tickets: License of the code: MIT If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url, which will lead me to the admin login form again. --------------------------------------------------------------------------- by travisbot at 2012-05-25T09:33:44Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1431566) (merged 8ffaafa8 into 45849ce3). --------------------------------------------------------------------------- by uwej711 at 2012-06-09T08:05:54Z Doesn't this make sense or did this slip through? Or is there something missing?
| * | Make the session entry for the target url firewall dependent.Uwe Jäger2012-05-252-4/+6
| | | | | | | | | | | | | | | | | | | | | If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url. This is not what you usually want to happen.
* | | fixed phpdocFabien Potencier2012-06-261-1/+4
| | |
* | | [Security] simplified some codeFabien Potencier2012-06-261-16/+21
| | |
* | | [Security] changed the HttpUtils constructor to tak both a UrlGenerator and ↵Fabien Potencier2012-06-263-32/+37
| | | | | | | | | | | | a UrlMatcher instead of a Router (to make it useable by Silex)
* | | merged 2.0Fabien Potencier2012-06-204-31/+69
|\ \ \ | | |/ | |/|
| * | merged branch Maks3w/patch-4 (PR #4616)Fabien Potencier2012-06-201-1/+1
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- fa050b7 [Security] Change return value in DocBlock Discussion ---------- [Security] Change return value in DocBlock Change the return value for avoid confusions. ```php if (!$user instanceof UserInterface) { throw new AuthenticationServiceException('retrieveUser() must return a UserInterface.'); } ``` [UserAuthenticationProvider.php#L67](https://github.com/symfony/symfony/tree/2.0/src/Symfony/Component/Security/Core/Authentication/Provider/UserAuthenticationProvider.php#L67) --------------------------------------------------------------------------- by travisbot at 2012-06-19T21:03:07Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1659148) (merged fa050b77 into e78a7bae).
| | * | [Security] Change return value in DocBlockMaks2012-06-191-1/+1
| | | | | | | | | | | | Change the return value for avoid confusions.
| * | | [Security] Allow "0" as a passwordVictor Berchet2012-06-201-1/+1
| |/ /
| * | tweaked the previous commitFabien Potencier2012-06-161-1/+1
| | |
| * | [Security] Only redirect to urls called with http method GETUwe Jäger2012-06-141-1/+1
| | |
| * | changed getName() to name on all Reflection* object calls (fixes #4555, refs ↵Fabien Potencier2012-06-121-1/+1
| | | | | | | | | | | | https://bugs.php.net/bug.php?id=61384)
* | | [Security] fixed exception message in EncoderFactoryDouglas Greenshields2012-06-201-1/+1
| | |
* | | [Security] removed test that fail on PHP 5.3.3Fabien Potencier2012-06-181-4/+0
| | |
* | | [Security] fixed some unit tests for PHP 5.3.3 (see ↵Fabien Potencier2012-06-181-4/+17
| | | | | | | | | | | | https://bugs.php.net/bug.php?id=53727)
* | | [Security] Fix retrieval of encoder when configured for concrete classesAlexander2012-06-181-1/+1
| | |
* | | [Security] Add failing testcases for EncoderFactoryAlexander2012-06-181-0/+23
| | |
* | | [Security] allowed class names to be passed as an argument to ↵Fabien Potencier2012-06-184-6/+28
| | | | | | | | | | | | EncoderFactoryInterface::getEncoder()
* | | changed getName() to name on all Reflection* object calls (fixes #4555, refs ↵Fabien Potencier2012-06-121-1/+1
| | | | | | | | | | | | https://bugs.php.net/bug.php?id=61384)
* | | moved the UserPassword validator from the security bundle to the security ↵Fabien Potencier2012-06-103-0/+75
| | | | | | | | | | | | component to make it reusable outside the full-stack framework
* | | [Security] Check post_only option and request methodHenrik Bjørnskov2012-06-091-0/+12
| |/ |/|
* | merged 2.0Fabien Potencier2012-05-211-2/+2
|\ \ | |/
| * merged branch kepten/ticket_1813 (PR #3551)v2.0.15Fabien Potencier2012-05-211-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache Discussion ---------- [HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] --------------------------------------------------------------------------- by stof at 2012-03-10T17:34:26Z you should also add a unit test for this --------------------------------------------------------------------------- by kepten at 2012-03-11T15:34:04Z Thanks for the feedback, I committed the changes. --------------------------------------------------------------------------- by stof at 2012-04-04T01:59:53Z @fabpot could you review it ? --------------------------------------------------------------------------- by fabpot at 2012-04-04T07:15:34Z My comments: * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers. * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs). * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed). --------------------------------------------------------------------------- by danielholmes at 2012-04-14T13:27:09Z A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this: ``` <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] </IfModule> ``` NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening --------------------------------------------------------------------------- by towards at 2012-04-20T16:12:49Z @kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI --------------------------------------------------------------------------- by kepten at 2012-04-20T16:15:57Z ok, so is my PR is useless or should I still fix problems? --------------------------------------------------------------------------- by towards at 2012-04-20T16:20:26Z your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes --------------------------------------------------------------------------- by vicb at 2012-04-20T16:20:36Z I have been working with @towards: your PR is useful, please implement his comments and squash your PR. --------------------------------------------------------------------------- by kepten at 2012-04-20T16:59:07Z never squashed before, is it okay now? :) --------------------------------------------------------------------------- by stof at 2012-04-20T17:21:07Z it is --------------------------------------------------------------------------- by vicb at 2012-05-20T19:57:51Z @fabpot this should be ready to be merged
| | * [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI ↵kepten2012-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L]
* | | Changed composer constraint to allow Doctrine 2.3 tooChristophe Coevoet2012-05-201-3/+4
| | |
* | | merged 2.0Fabien Potencier2012-05-201-2/+1
|\ \ \ | |/ /
* | | merged 2.0Fabien Potencier2012-05-191-1/+0
|\ \ \ | |/ /
generated by cgit v1.1 at 2025-06-01 06:27:09 +0000