summaryrefslogtreecommitdiffstats
path: root/Http
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '2.3'Fabien Potencier2013-10-011-1/+0
|\ | | | | | | | | | | | | | | | | | | | | * 2.3: Fix: duplicate usage of Symfony\Component\HttpFoundation\Response [Form] add support for Length and Range constraint in order to replace MaxLength, MinLength, Max and Min constraints in next release (2.3) Revert "merged branch Tobion/flattenexception (PR #9111)" [Form] check the required output timezone against the actual timezone of the input datetime object, rather than the expected timezone supplied Conflicts: src/Symfony/Component/HttpKernel/EventListener/ExceptionListener.php
| * Merge branch '2.2' into 2.3Fabien Potencier2013-10-011-1/+0
| |\ | | | | | | | | | | | | * 2.2: Fix: duplicate usage of Symfony\Component\HttpFoundation\Response
| | * Fix: duplicate usage of Symfony\Component\HttpFoundation\Responsesimpson2013-10-011-1/+0
| | |
* | | feature#8957 [HttpFoundation] added a way to override the Request class (fabpot)Fabien Potencier2013-10-011-1/+1
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [HttpFoundation] added a way to override the Request class | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #7461, #7453 | License | MIT | Doc PR | symfony/symfony-docs#3021 This is an alternative implementation for #7461. I've also reverted #7381 and #7390 as these changes are not needed anymore. Todo: - [ ] add some tests Commits ------- 464439d [HttpFoundation] added a way to override the Request class
| * | | [HttpFoundation] added a way to override the Request classFabien Potencier2013-09-301-1/+1
| | | |
* | | | feature#6554 [Security] Added Security\Csrf sub-component with better token ↵Fabien Potencier2013-09-304-25/+27
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | generation (bschussek) This PR was merged into the master branch. Discussion ---------- [Security] Added Security\Csrf sub-component with better token generation | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | TODO **Update September 27, 2013** This PR simplifies the CSRF mechanism to generate completely random tokens. A random token is generated once per ~~intention~~ token ID and then stored in the session. Tokens are valid until the session expires. Since the CSRF token generator depends on `StringUtils` and `SecureRandom` from Security\Core, and since Security\Http currently depends on the Form component for token generation, I decided to add a new Security\Csrf sub-component that contains the improved CSRF token generator. Consequences: * Security\Http now depends on Security\Csrf instead of Form * Form now optionally depends on Security\Csrf * The configuration for the "security.secure_random" service and the "security.csrf.*" services was moved to FrameworkBundle to guarantee BC In the new Security\Csrf sub-component, I tried to improve the naming where I could do so without breaking BC: * CSRF "providers" are now called "token generators" * CSRF "intentions" are now called "token IDs", because that's really what they are ##### TODO - [ ] The documentation needs to be checked for references to the configuration of the application secret. Remarks that the secret is used for CSRF protection need to be removed. - [ ] Add aliases "csrf_token_generator" and "csrf_token_id" for "csrf_provider" and "intention" in the SecurityBundle configuration - [x] Make sure `SecureRandom` never blocks for `CsrfTokenGenerator` Commits ------- 7f02304 [Security] Added missing PHPDoc tag 2e04e32 Updated Composer dependencies to require the Security\Csrf component where necessary bf85e83 [FrameworkBundle][SecurityBundle] Added service configuration for the new Security CSRF sub-component 2048cf6 [Form] Deprecated the CSRF implementation and added an optional dependency to the Security CSRF sub-component instead 85d4959 [Security] Changed Security HTTP sub-component to depend on CSRF sub-component instead of Form 1bf1640 [Security] Added CSRF sub-component
| * | | | Updated Composer dependencies to require the Security\Csrf component where ↵Bernhard Schussek2013-09-301-0/+1
| | | | | | | | | | | | | | | | | | | | necessary
| * | | | [Security] Changed Security HTTP sub-component to depend on CSRF ↵Bernhard Schussek2013-09-274-25/+26
| | | | | | | | | | | | | | | | | | | | sub-component instead of Form
* | | | | Merge branch '2.3'Fabien Potencier2013-09-2918-12/+84
|\ \ \ \ \ | |/ / / / |/| | / / | | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed Client when using the terminable event Fix problem with Windows file links (backslash in JavaScript string) [Security] fixed wrong phpdoc [DependencyInjection] Prevented inlining of lazy loaded private service definitions. [Routing] removed extra argument [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted). Added doc comments Conflicts: src/Symfony/Component/Routing/Router.php src/Symfony/Component/Security/Http/Firewall.php
| * | | Merge branch '2.2' into 2.3Fabien Potencier2013-09-2918-12/+84
| |\ \ \ | | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: fixed Client when using the terminable event Fix problem with Windows file links (backslash in JavaScript string) [Security] fixed wrong phpdoc [Routing] removed extra argument [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted). Added doc comments Conflicts: src/Symfony/Component/HttpFoundation/Request.php
| | * | [Security] fixed wrong phpdocFabien Potencier2013-09-271-3/+1
| | | |
| | * | Added doc commentsPiotr Antosik2013-09-1918-10/+84
| | | |
* | | | Merge branch '2.3'Fabien Potencier2013-09-222-5/+2
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [Locale] added support for the position argument to NumberFormatter::parse() [Locale] added some more stubs for the number formatter [Yaml] fixed typo [Yaml] fixed a test on PHP < 5.4 [DomCrawler]Crawler guess charset from html fixed PHP 5.3 compatibility [Yaml] reverted previous merge partially (refs #8897) [Security] remove unused logger [Security] fix typo [Yaml] Fixed filename in the ParseException message
| * | | Merge branch '2.2' into 2.3Fabien Potencier2013-09-222-5/+2
| |\ \ \ | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [Locale] added support for the position argument to NumberFormatter::parse() [Locale] added some more stubs for the number formatter [Yaml] fixed typo [Yaml] fixed a test on PHP < 5.4 [DomCrawler]Crawler guess charset from html fixed PHP 5.3 compatibility [Yaml] reverted previous merge partially (refs #8897) [Security] remove unused logger [Security] fix typo [Yaml] Fixed filename in the ParseException message Conflicts: src/Symfony/Component/Console/Input/InputDefinition.php src/Symfony/Component/Locale/Stub/StubNumberFormatter.php src/Symfony/Component/Locale/Tests/Stub/StubNumberFormatterTest.php
| | * | merged branch Tobion/security-fix-typo (PR #9069)v2.2.8v2.2.7Fabien Potencier2013-09-192-5/+2
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the 2.2 branch. Discussion ---------- [Security] fix typo and remove unused logger | Q | A | ------------- | --- | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | License | MIT Commits ------- a33cc51 [Security] remove unused logger 62de9c1 [Security] fix typo
| | | * | [Security] remove unused loggerTobias Schultze2013-09-181-4/+1
| | | | |
| | | * | [Security] fix typoTobias Schultze2013-09-181-1/+1
| | | | |
* | | | | merged branch fabpot/expression-engine (PR #8913)Fabien Potencier2013-09-191-3/+3
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- New Component: Expression Language | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #8850, #7352 | License | MIT | Doc PR | not yet TODO: - [ ] write documentation - [x] add tests for the new component - [x] implement expression support for access rules in the security component - [x] find a better character/convention for expressions in the YAML format - [x] check the performance of the evaluation mode - [x] better error messages in the evaluation mode - [x] add support in the Routing - [x] add support in the Validator The ExpressionLanguage component provides an engine that can compile and evaluate expressions. An expression is a one-liner that returns a value (mostly, but not limited to, Booleans). It is a strip-down version of Twig (only the expression part of it is implemented.) Like Twig, the expression is lexed, parsed, and compiled/evaluated. So, it is immune to external injections by design. If we compare it to Twig, here are the main big differences: * only support for Twig expressions * no ambiguity for calls (foo.bar is only valid for properties, foo['bar'] is only valid for array calls, and foo.bar() is required for method calls) * no support for naming conventions in method calls (if the method is named getFoo(), you must use getFoo() and not foo()) * no notion of a line for errors, but a cursor (we are mostly talking about one-liners here) * removed everything specific to the templating engine (like output escaping or filters) * no support for named arguments in method calls * only one extension point with functions (no possibility to define new operators, ...) * and probably even more I don't remember right now * there is no need for a runtime environment, the compiled PHP string is self-sufficient An open question is whether we keep the difference betweens arrays and hashes. The other big difference with Twig is that it can work in two modes (possible because of the restrictions described above): * compilation: the expression is compiled to PHP and is self-sufficient * evaluation: the expression is evaluated without being compiled to PHP (the node tree produced by the parser can be serialized and evaluated afterwards -- so it can be saved on disk or in a database to speed up things when needed) Let's see a simple example: ```php $language = new ExpressionLanguage(); echo $language->evaluate('1 + 1'); // will echo 2 echo $language->compile('1 + 2'); // will echo "(1 + 2)" ``` The language supports: * all basic math operators (with precedence rules): * unary: not, !, -, + * binary: or, ||, and, &&, b-or, b-xor, b-and, ==, ===, !=, !==, <, >, >=, <=, not in, in, .., +, -, ~, *, /, %, ** * all literals supported by Twig: strings, numbers, arrays (`[1, 2]`), hashes (`{a: "b"}`), Booleans, and null. * simple variables (`foo`), array accesses (`foo[1]`), property accesses (`foo.bar`), and method calls (`foo.bar(1, 2)`). * the ternary operator: `true ? true : false` (and all the shortcuts implemented in Twig). * function calls (`constant('FOO')` -- `constant` is the only built-in functions). * and of course, any combination of the above. The compilation is better for performances as the end result is just a plain PHP string without any runtime. For the evaluation, we need to tokenize, parse, and evaluate the nodes on the fly. This can be optimized by using a `ParsedExpression` or a `SerializedParsedExpression` instead: ```php $nodes = $language->parse($expr, $names); $expression = new SerializedParsedExpression($expr, serialize($nodes)); // You can now store the expression in a DB for later reuse // a SerializedParsedExpression can be evaluated like any other expressions, // but under the hood, the lexer and the parser won't be used at all, so it''s much faster. $language->evaluate($expression); ``` That's all folks! I can see many use cases for this new component, and we have two use cases in Symfony that we can implement right away. ## Using Expressions in the Service Container The first one is expression support in the service container (it would replace #8850) -- anywhere you can pass an argument in the service container, you can use an expression: ```php $c->register('foo', 'Foo')->addArgument(new Expression('bar.getvalue()')); ``` You have access to the service container via `this`: container.get("bar").getvalue(container.getParameter("value")) The implementation comes with two functions that simplifies expressions (`service()` to get a service, and `parameter` to get a parameter value). The previous example can be simplified to: service("bar").getvalue(parameter("value")) Here is how to use it in XML: ```xml <parameters> <parameter key="value">foobar</parameter> </parameters> <services> <service id="foo" class="Foo"> <argument type="expression">service('bar').getvalue(parameter('value'))</argument> </service> <service id="bar" class="Bar" /> </services> ``` and in YAML (I chose the syntax randomly ;)): ```yaml parameters: value: foobar services: bar: class: Bar foo: class: Foo arguments: [@=service("bar").getvalue(parameter("value"))] ``` When using the container builder, Symfony uses the evaluator, but with the PHP dumper, the compiler is used, and there is no overhead as the expression engine is not needed at runtime. The expression above would be compiled to: ```php $this->get("bar")->getvalue($this->getParameter("value")) ``` ## Using Expression for Security Access Control Rules The second use case in Symfony is for access rules. As we all know, the way to configure the security access control rules is confusing, which might lead to insecure applications (see http://symfony.com/blog/security-access-control-documentation-issue for more information). Here is how the new `allow_if` works: ```yaml access_control: - { path: ^/_internal/secure, allow_if: "'127.0.0.1' == request.getClientIp() or has_role('ROLE_ADMIN')" } ``` This one restricts the URLs starting with `/_internal/secure` to people browsing from the localhost. Here, `request` is the current Request instance. In the expression, there is access to the following variables: * `request` * `token` * `user` And to the following functions: * `is_anonymous` * `is_authenticated` * `is_fully_authenticated` * `is_rememberme` * `has_role` You can also use expressions in Twig, which works well with the `is_granted` function: ```jinja {% if is_granted(expression('has_role("FOO")')) %} ... {% endif %} ``` ## Using Expressions in the Routing Out of the box, Symfony can only match an incoming request based on some pre-determined variables (like the path info, the method, the scheme, ...). But some people want to be able to match on more complex logic, based on other information of the Request object. That's why we introduced `RequestMatcherInterface` recently (but we no default implementation in Symfony itself). The first change I've made (not related to expression support) is implement this interface for the default `UrlMatcher`. It was simple enough. Then, I've added a new `condition` configuration for Route objects, which allow you to add any valid expression. An expression has access to the `request` and to the routing `context`. Here is how one would configure it in a YAML file: ```yaml hello: path: /hello/{name} condition: "context.getMethod() in ['GET', 'HEAD'] and request.headers.get('User-Agent') =~ '/firefox/i'" ``` Why do I keep the context as all the data are also available in the request? Because you can also use the condition without using the RequestMatcherInterface, in which case, you don't have access to the request. So, the previous example is equivalent to: ```yaml hello: path: /hello/{name} condition: "request.getMethod() in ['GET', 'HEAD'] and request.headers.get('User-Agent') =~ '/firefox/i'" ``` When using the PHP dumper, there is no overhead as the condition is compiled. Here is how it looks like: ```php // hello if (0 === strpos($pathinfo, '/hello') && preg_match('#^/hello/(?P<name>[^/]++)$#s', $pathinfo, $matches) && (in_array($context->getMethod(), array(0 => "GET", 1 => "HEAD")) && preg_match("/firefox/i", $request->headers->get("User-Agent")))) { return $this->mergeDefaults(array_replace($matches, array('_route' => 'hello')), array ()); } ``` Be warned that conditions are not taken into account when generating a URL. ## Using Expressions in the Validator There is a new Expression constraint that you can put on a class. The expression is then evaluated for validation: ```php use Symfony\Component\Validator\Constraints as Assert; /** * @Assert\Condition(condition="this.getFoo() == 'fo'", message="Not good!") */ class Obj { public function getFoo() { return 'foo'; } } ``` In the expression, you get access to the current object via the `this` variable. ## Dynamic annotations The expression language component is also very useful in annotations. the SensoLabs FrameworkExtraBundle leverages this possibility to implement HTTP validation caching in the `@Cache` annotation and to add a new `@Security` annotation (see sensiolabs/SensioFrameworkExtraBundle#238.) Commits ------- d4ebbfd [Validator] Renamed Condition to Expression and added possibility to set it onto properties a3b3a78 [Validator] added a constraint that runs an expression 1bcfb40 added optimized versions of expressions 984bd38 mades things more consistent for the end user d477f15 [Routing] added support for expression conditions in routes 86ac8d7 [ExpressionLanguage] improved performance e369d14 added a Twig extension to create Expression instances 38b7fde added support for expression in control access rules 2777ac7 [HttpFoundation] added ExpressionRequestMatcher c25abd9 [DependencyInjection] added support for expressions in the service container 3a41781 [ExpressionLanguage] added support for regexes 9d98fa2 [ExpressionLanguage] added the component
| * | | | | added support for expression in control access rulesFabien Potencier2013-09-191-3/+3
| | |_|_|/ | |/| | |
* | | | | merged branch nicolas-bastien/remove_unsued_statement (PR #9075)Fabien Potencier2013-09-192-9/+0
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [Security] Remove unused use statement Commits ------- 6981669 Remove unused use statement
| * | | | | Remove unused use statementNicolas Bastien2013-09-192-9/+0
| | | | | |
* | | | | | Merge branch '2.3'Fabien Potencier2013-09-198-1/+7
|\ \ \ \ \ \ | |/ / / / / |/| | / / / | | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed phpdoc Fix some annotates [FrameworkBundle] made sure that the debug event dispatcher is used everywhere [HttpKernel] remove unneeded strtoupper updated the composer install command to reflect changes in Composer Conflicts: src/Symfony/Component/Serializer/Encoder/XmlEncoder.php
| * | | | Merge branch '2.2' into 2.3Fabien Potencier2013-09-197-0/+7
| |\ \ \ \ | | | |/ / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Fix some annotates [FrameworkBundle] made sure that the debug event dispatcher is used everywhere [HttpKernel] remove unneeded strtoupper updated the composer install command to reflect changes in Composer Conflicts: src/Symfony/Component/Console/Application.php src/Symfony/Component/Console/Command/Command.php src/Symfony/Component/Console/Input/InputDefinition.php src/Symfony/Component/CssSelector/Node/CombinedSelectorNode.php src/Symfony/Component/Form/Form.php src/Symfony/Component/HttpKernel/Debug/ErrorHandler.php src/Symfony/Component/HttpKernel/DependencyInjection/RegisterListenersPass.php src/Symfony/Component/HttpKernel/Tests/DependencyInjection/RegisterListenersPassTest.php src/Symfony/Component/Locale/Locale.php src/Symfony/Component/Locale/README.md src/Symfony/Component/Locale/Stub/DateFormat/FullTransformer.php
| | * | | Fix some annotatesbronze1man2013-09-197-0/+7
| | | |/ | | |/|
* | | | [Security] fixed README filesFabien Potencier2013-09-181-2/+2
| | | |
* | | | [Security] Split the component into 3 sub-components Core, ACL, HTTPBernhard Schussek2013-09-1834-0/+4502
| | | |
* | | | [Security] made sure that the exception listener is always removed from the ↵Fabien Potencier2013-09-082-5/+28
| |_|/ |/| | | | | | | | event dispatcher at the end of the request
* | | Merge branch '2.3'Fabien Potencier2013-09-062-1/+7
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Fixing singular form for kisses, accesses and addresses. fixed some circular references [Security] fixed a leak in ExceptionListener [Security] fixed a leak in the ContextListener Ignore posix_istatty warnings removed unused variable [Form] fix iterator typehint typos Button missing getErrorsAsString() fixes #8084 Debug: Not calling undefined method anymore. If the form contained a submit button the call would fail and the debug of the form wasn't possible. Now it will work in all cases. This fixes #8084 Use isset() instead of array_key_exists() in DIC Fixed annotation [BrowserKit] fixed method/files/content when redirecting a request [BrowserKit] removed some headers when redirecting a request [BrowserKit] fixed headers when redirecting if history is set to false (refs #8697) [HttpKernel] fixed route parameters storage in the Request data collector (closes #8867) [BrowserKit] Pass headers when `followRedirect()` is called Return BC compatibility for `@Route` parameters and default values Conflicts: src/Symfony/Component/Security/Http/Firewall/ContextListener.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-09-062-1/+7
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Fixing singular form for kisses, accesses and addresses. fixed some circular references [Security] fixed a leak in ExceptionListener [Security] fixed a leak in the ContextListener Ignore posix_istatty warnings typos [HttpKernel] fixed route parameters storage in the Request data collector (closes #8867) Return BC compatibility for `@Route` parameters and default values Conflicts: src/Symfony/Bundle/FrameworkBundle/Templating/Helper/FormHelper.php src/Symfony/Component/Console/Application.php
| | * [Security] fixed a leak in ExceptionListenerFabien Potencier2013-09-061-0/+4
| | |
| | * [Security] fixed a leak in the ContextListenerFabien Potencier2013-09-061-1/+3
| | |
* | | Merge branch '2.3'Fabien Potencier2013-08-301-2/+2
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [Security] fixed some phpdoc Fixed PHPDoc Blocks optimized circular reference checker fixed misleading doc block [HttpKernel] changed fragment URLs to be relative by default (closes #8458) Conflicts: src/Symfony/Component/HttpKernel/Fragment/RoutableFragmentRenderer.php src/Symfony/Component/HttpKernel/Tests/Fragment/RoutableFragmentRendererTest.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-08-301-2/+2
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | * 2.2: [Security] fixed some phpdoc Fixed PHPDoc Blocks optimized circular reference checker [HttpKernel] changed fragment URLs to be relative by default (closes #8458)
| | * [Security] fixed some phpdocFabien Potencier2013-08-301-2/+2
| | |
* | | merged branch vierbergenlars/patch-1 (PR #8854)Fabien Potencier2013-08-301-1/+3
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [Security] Keep other query string parameters when switching users | Q | A | ---------------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | n/a | Doc PR | n/a When switching users, the whole query string gets dropped when redirecting after the switch. I think only the switch user parameter should be dropped from the query string. Commits ------- 0a338f5 [Security] Keep other query string parameters when switching users
| * | | [Security] Keep other query string parameters when switching usersLars Vierbergen2013-08-271-1/+3
| | | |
* | | | Merge branch '2.3'Fabien Potencier2013-08-291-4/+6
|\ \ \ \ | |/ / / |/| / / | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Clear lazy loading initializer after the service is successfully initialized [FrameworkBundle] added support for double-quoted strings in the extractor (closes #8797) [SecurityBundle] Move format-dependent tests from SecurityExtensionTest bumped Symfony version to 2.3.5-DEV updated VERSION for 2.3.4 updated CHANGELOG for 2.3.4 bumped Symfony version to 2.2.7 updated VERSION for 2.2.6 update CONTRIBUTORS for 2.2.6 updated CHANGELOG for 2.2.6 clearToken exception is thrown at wrong place. fix typo in test skipped message [Form] Fixed Form::all() signature for PHP 5.3.3 [Form] Fixed Form::all() signature for PHP 5.3.3 [Locale] Fixed: Locale::setDefault() throws no exception when "en" is passed [Locale] Fixed: StubLocale::setDefault() throws no exception when "en" is passed [Translation] Grammar fix [Yaml] fixed embedded folded string parsing [Validator] fixed Boolean handling in XML constraint mappings (closes #5603) [Translation] Fixed regression: When only one rule is passed to transChoice(), this rule should be used Conflicts: src/Symfony/Component/HttpKernel/Kernel.php
| * | Merge branch '2.2' into 2.3v2.3.4Fabien Potencier2013-08-271-4/+6
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: bumped Symfony version to 2.2.7 updated VERSION for 2.2.6 update CONTRIBUTORS for 2.2.6 updated CHANGELOG for 2.2.6 clearToken exception is thrown at wrong place. Conflicts: src/Symfony/Component/HttpKernel/Kernel.php
| | * clearToken exception is thrown at wrong place.v2.2.6Xavier HAUSHERR2013-08-261-4/+6
| | |
* | | Merge branch '2.3'Fabien Potencier2013-08-221-0/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [Locale] fixed build-data exit code in case of an error fixed request format of sub-requests when explicitely set by the developer (closes #8787) Sets _format attribute only if it wasn't set previously by the user. Exclude little words of 'ee' to 'oo' plural transformation fixed the format of the request used to render an exception Fix typo in the check_path validator added a missing use statement (closes #8808) fix for Process:isSuccessful() Include untrusted host in the exception message Conflicts: src/Symfony/Component/HttpKernel/EventListener/ExceptionListener.php src/Symfony/Component/HttpKernel/Fragment/InlineFragmentRenderer.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-08-221-0/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [Locale] fixed build-data exit code in case of an error fixed request format of sub-requests when explicitely set by the developer (closes #8787) Sets _format attribute only if it wasn't set previously by the user. Exclude little words of 'ee' to 'oo' plural transformation fixed the format of the request used to render an exception Fix typo in the check_path validator added a missing use statement (closes #8808) fix for Process:isSuccessful() Conflicts: UPGRADE-3.0.md src/Symfony/Component/Locale/Resources/data/build-data.php
| | * added a missing use statement (closes #8808)Fabien Potencier2013-08-211-0/+1
| | |
* | | [HttpKernel] added $event->isMasterRequest()Kris Wallsmith2013-08-082-5/+3
| | |
* | | Merge branch '2.3'Fabien Potencier2013-08-021-0/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: moved some fixed dep versions from 2.2.* to ~2.2 (refs #8613) [HttpKernel] added a missing dep for dev [Form] fixed wrong call to setTimeZone() (closes #8644) Fix issue with \DateTimeZone::UTC / 'UTC' for PHP 5.4 [Form] Fixed patched forms to be valid even if children are not submitted Revert "[Form] Fix of "PATCH'ed forms are never valid"" [Form] Fixed: If a form is not present in a request, it is not automatically submitted Fixes link indices [Form] Removed the "disabled" attribute from the placeholder option in select fields due to problems with the BlackBerry 10 browser Revert "[Form] Remove "value" attribute on empty_value option" [routing] added ability for apache matcher to handle array values removed dead code and fixed CS [Validator] fixed StaticMethodLoader trying to invoke methods of abstract classes (closes #8589)
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-08-021-0/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [HttpKernel] added a missing dep for dev [Form] fixed wrong call to setTimeZone() (closes #8644) Fix issue with \DateTimeZone::UTC / 'UTC' for PHP 5.4 [Form] Removed the "disabled" attribute from the placeholder option in select fields due to problems with the BlackBerry 10 browser [routing] added ability for apache matcher to handle array values removed dead code and fixed CS [Validator] fixed StaticMethodLoader trying to invoke methods of abstract classes (closes #8589) Conflicts: src/Symfony/Bundle/TwigBundle/TokenParser/RenderTokenParser.php src/Symfony/Component/Form/FormConfigBuilder.php src/Symfony/Component/HttpKernel/composer.json src/Symfony/Component/Validator/Tests/GraphWalkerTest.php
| | * removed dead code and fixed CSFabien Potencier2013-07-281-0/+1
| | |
* | | Use HMAC construction for remember me cookie hashesJon Cave2013-07-211-1/+1
| | |
* | | Merge branch '2.3'Fabien Potencier2013-07-204-4/+30
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [PropertyAccess] added moves to pluralMap [Security] fixed issue where authentication listeners clear unrelated tokens added greek translation [DependencyInjection] Add exception for service name not dumpable in PHP bumped Symfony version to 2.3.3-DEV fix issue #8499 modelChoiceList call getPrimaryKey on a non object updated VERSION for 2.3.2 updated CHANGELOG for 2.3.2 [DependencyInjection] Add exception for service name not dumpable in PHP fixed typo bumped Symfony version to 2.2.5 updated VERSION for 2.2.4 update CONTRIBUTORS for 2.2.4 updated CHANGELOG for 2.2.4 Fixed NativeSessionStorage:regenerate when does not exists removed extraneous whitespaces Conflicts: src/Symfony/Component/HttpKernel/Kernel.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-07-204-4/+30
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [PropertyAccess] added moves to pluralMap [Security] fixed issue where authentication listeners clear unrelated tokens fix issue #8499 modelChoiceList call getPrimaryKey on a non object [DependencyInjection] Add exception for service name not dumpable in PHP Conflicts: src/Symfony/Component/DependencyInjection/Dumper/PhpDumper.php src/Symfony/Component/DependencyInjection/Tests/Dumper/PhpDumperTest.php src/Symfony/Component/Security/Tests/Http/Firewall/BasicAuthenticationListenerTest.php
| | * [Security] fixed issue where authentication listeners clear unrelated tokensalcaeus2013-07-194-4/+30
| | | | | | | | | | | | | | | This commit fixes an issue where authentication listeners clear all security tokens in case of authentication failure. This behavior makes it impossible to combine certain authentication mechanisms, notably x509 with form-based login.
* | | Merge branch '2.3'Fabien Potencier2013-07-111-1/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Reverts JSON_NUMERIC_CHECK Just a Typo [Yaml] removed wrong comment removal inside a string block Fixing configuration validation error messages. [HtppKernel] fixed inline fragment renderer fixed inline fragment renderer ProgressHelper shows percentage complete. Comment fixed: RedrawFrequency is measured in steps. fix handling of a default 'template' as a string Conflicts: src/Symfony/Component/Console/Tests/Helper/ProgressHelperTest.php
| * | Merge branch '2.2' into 2.3v2.3.2Fabien Potencier2013-07-111-1/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Reverts JSON_NUMERIC_CHECK Just a Typo [Yaml] removed wrong comment removal inside a string block Fixing configuration validation error messages. [HtppKernel] fixed inline fragment renderer fixed inline fragment renderer ProgressHelper shows percentage complete. Comment fixed: RedrawFrequency is measured in steps. fix handling of a default 'template' as a string Conflicts: src/Symfony/Component/Console/Helper/ProgressHelper.php src/Symfony/Component/Console/Tests/Helper/ProgressHelperTest.php src/Symfony/Component/HttpKernel/Tests/Fragment/HIncludeFragmentRendererTest.php src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php
| | * Just a Typov2.2.4Moritz Borgmann2013-07-111-1/+1
| | |
* | | Revert "marked some classes as being experimental in 2.3"Fabien Potencier2013-06-133-6/+0
| | | | | | | | | | | | This reverts commit 74cfc84c87ac281d1ed5aeb8eca9c86ae46c50cf.
* | | merged branch Seldaek/simplesecurity (PR #6069)Fabien Potencier2013-06-133-0/+338
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [Security] Add simpler customization options The goal of this is to provide a simpler extension point for people that don't have the time to dive into the whole security factory + authentication provider + user provider + authentication listener + token mess. As it stands, it gives you a way to just create one class that is handling all the security stuff in one (by implementing SimpleFormAuthenticatorInterface and UserProviderInterface) + one or more token classes. I would like feedback on whether people think this makes sense or not before continuing and doing a SimpleHttpAuthenticatorInterface for non-form based stuff. Just FYI that's how it would look in security.yml: ```yaml security: providers: simple: id: simple_authenticator firewalls: foo: pattern: ^/ simple_form: provider: simple authenticator: simple_authenticator ``` /cc @atrauzzi (who posted a long rant on the ML about how hard this all is, and I can't agree more - I hope it's the right account on github?) Commits ------- 74cfc84 marked some classes as being experimental in 2.3 471e5bc [Security] allowed simple pre-auth to be optional if another auth mechanism already authenticated the user 01c913b moved the simple HTTP authenticator to a pre-auth one 887d9b8 fixed wrong Logger interface 65335ea [Security] Renamed simple_token to simple_http, added support for failure and success handler to both simple firewalls f7a11a1 [Security] Add simple_token auth method 1fe2ed6 [Security] Add SimpleForm authentication
| * | marked some classes as being experimental in 2.3Fabien Potencier2013-05-083-0/+6
| | |
| * | [Security] allowed simple pre-auth to be optional if another auth mechanism ↵Fabien Potencier2013-05-081-0/+5
| | | | | | | | | | | | already authenticated the user
| * | moved the simple HTTP authenticator to a pre-auth oneFabien Potencier2013-05-081-6/+6
| | |
| * | fixed wrong Logger interfaceFabien Potencier2013-05-081-1/+1
| | |
| * | [Security] Renamed simple_token to simple_http, added support for failure ↵Jordi Boggiano2013-05-082-12/+133
| | | | | | | | | | | | and success handler to both simple firewalls
| * | [Security] Add simple_token auth methodJordi Boggiano2013-05-081-0/+90
| | |
| * | [Security] Add SimpleForm authenticationJordi Boggiano2013-05-081-0/+116
| | |
* | | [Security] Removed an unnecessary call to sprintf() and added a test case.Jakub Zalas2013-06-021-1/+1
|/ /
* | Merge branch '2.2'Fabien Potencier2013-05-061-2/+2
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: added additional tests to cover invalid argument exceptions in OutputFormatterStyle component added a missing check for the provider key [Validator] fixed wrong URL for XSD [Validator] Fixed: $traverse and $deep is passed to the visitor from Validator::validate() [Form] Fixed transform()/reverseTransform() to always throw TransformationFailedExceptions [Form] Fixed: String validation groups are never interpreted as callbacks if the repository method returns an array ensure that it's internal poin... [Form] Improved multi-byte handling of NumberToLocalizedStringTransformer Fix wrong method in findTaggedServiceIds(), add example to docblock. Conflicts: src/Symfony/Component/Form/Extension/Core/DataTransformer/ChoicesToBooleanArrayTransformer.php src/Symfony/Component/Form/Extension/Validator/Constraints/FormValidator.php
| * Merge branch '2.1' into 2.2Fabien Potencier2013-05-061-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: added additional tests to cover invalid argument exceptions in OutputFormatterStyle component added a missing check for the provider key [Validator] fixed wrong URL for XSD [Form] Fixed transform()/reverseTransform() to always throw TransformationFailedExceptions [Form] Fixed: String validation groups are never interpreted as callbacks if the repository method returns an array ensure that it's internal poin... Fix wrong method in findTaggedServiceIds(), add example to docblock. Conflicts: src/Symfony/Bridge/Doctrine/Form/DataTransformer/CollectionToArrayTransformer.php src/Symfony/Component/Form/Extension/Core/DataTransformer/DataTransformerChain.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ArrayToPartsTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ChoiceToValueTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ChoicesToValuesTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/DateTimeToArrayTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/DateTimeToRfc3339TransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/IntegerToLocalizedStringTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ValueToDuplicatesTransformerTest.php
| | * added a missing check for the provider keyv2.1.10Fabien Potencier2013-05-051-2/+2
| | |
* | | Merge branch '2.2'Fabien Potencier2013-04-171-1/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Fix default value handling for multi-value options [HttpKernel] truncate profiler token to 6 chars (see #7665) Disabled APC on Travis for PHP 5.5+ as it is not available [HttpFoundation] do not use server variable PATH_INFO because it is already decoded and thus symfony is fragile to double encoding of the path Fix download over SSL using IE < 8 and binary file response [Console] Fix merging of application definition, fixes #7068, replaces #7158 [HttpKernel] fixed the Kernel when the ClassLoader component is not available (closes #7406) fixed output of bag values [Yaml] improved boolean naming ($notEOF -> !$EOF) [Yaml] fixed handling an empty value [Routing][XML Loader] Add a possibility to set a default value to null [Console] fixed handling of "0" input on ask The /e modifier for preg_replace() is deprecated in PHP 5.5; replace with preg_replace_callback() fixed handling of "0" input on ask [HttpFoundation] Fixed bug in key searching for NamespacedAttributeBag [Form] DateTimeToRfc3339Transformer use proper transformation exteption in reverse transformation Update PhpEngine.php [PropertyAccess] Add objectives to pluralMap [Security] Removed unused var [HttpFoundation] getClientIp is fixed. Conflicts: src/Symfony/Component/Console/Tests/Command/CommandTest.php src/Symfony/Component/Console/Tests/Input/ArgvInputTest.php src/Symfony/Component/HttpFoundation/Request.php src/Symfony/Component/HttpKernel/Kernel.php
| * | merged branch lyrixx/path-10 (PR #7597)Fabien Potencier2013-04-081-1/+1
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the 2.2 branch. Discussion ---------- [Security] Removed unused var | Q | A | ------------- | --- | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | I guess | Fixed tickets | - Commits ------- bd26419 [Security] Removed unused var
| | * | [Security] Removed unused varGrégoire Pineau2013-03-281-1/+1
| | | |
* | | | [CS Fix] Consistent coding-style of concatenation operator usageDariusz Górecki2013-04-021-1/+1
| | | |
* | | | Merge branch '2.2'Fabien Potencier2013-04-011-3/+4
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: (22 commits) fixed doc references (closes #7515) fixed doc references (closes #7515) On OS X, sys_get_tmp_dir() returns /var/private/..., which really is below /private/var. Doctrine cannot handle bare random non-utf8 strings small changes [SecurityBundle] Fixed configuration exemple idAsIndex should be true with a smallint or bigint id field. [PropertyAccess] Remove trailing periods from doc blocks Fix param docs for PropertyAccessor read method Fixed long multibyte parameter logging in DbalLogger:startQuery Keep the file extension in the temporary copy and test that it exists (closes #7482) bumped Symfony version to 2.1.10-DEV [Validator][translation][japanese]replaced period to japanese one [Validator][translation][japanese]fixed japanese translation to more practical one [Validator][translation][japanese]fixed message ordering to be consistent with other languages [Validator][translation][japanese]added new validation messages in japanese translation updated VERSION for 2.1.9 update CONTRIBUTORS for 2.1.9 updated CHANGELOG for 2.1.9 [Security] fixed wrong interface Remove already defined arguments Add missing use [FrameworkBundle] Reuse definition variable in FormPass ... Conflicts: src/Symfony/Bridge/Doctrine/Logger/DbalLogger.php src/Symfony/Bundle/WebProfilerBundle/Resources/views/Collector/config.html.twig
| * | | Doctrine cannot handle bare random non-utf8 stringsTerje Bråten2013-03-311-3/+3
| | | |
| * | | [Security] fixed wrong interfaceFabien Potencier2013-03-261-1/+1
| | | |
| * | | Add missing useXavier HAUSHERR2013-03-261-0/+1
| | | |
* | | | [Security] Return 401 when using use_forward for form authenticationGunnar Lium2013-03-231-1/+6
| | | |
* | | | merged branch adrienbrault/security-feature (PR #4776)Fabien Potencier2013-03-231-1/+9
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [2.2] [Security] Add an option to disable the hasPreviousSession() check in AbstractAuthenticationListener Bug fix: no Feature addition: yes Backwards compatibility break: no Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/adrienbrault/symfony.png?branch=security-feature)](http://travis-ci.org/adrienbrault/symfony) Fixes the following tickets: #3703 Todo: Add this option to the symfony doc security configuration reference License of the code: MIT Documentation PR: N/A As stated in #3703, all authentication listeners that inherit from AbstractAuthenticationListener, only work when a previous session has been created. This PR allows to change the default behavior in the security.yml file. Example: ```yml security: firewalls: secured_area: pattern: ^/demo/secured/ form_login: check_path: /demo/secured/login_check login_path: /demo/secured/login require_previous_session: false # The default value is true logout: path: /demo/secured/logout target: /demo/ #anonymous: ~ #http_basic: # realm: "Secured Demo Area" ``` PS: While removing my old commit, it closed the #4774 PR ... Commits ------- 0562463 [Security] Add an option to disable the hasPreviousSession() check in AbstractAuthenticationListener
| * | | [Security] Add an option to disable the hasPreviousSession() check in ↵Adrien BRAULT2012-07-091-1/+2
| | | | | | | | | | | | | | | | AbstractAuthenticationListener
* | | | Merge branch '2.1' into 2.2Fabien Potencier2013-03-151-1/+1
|\ \ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: changed sub-requests creation to '::create()' Conflicts: src/Symfony/Bundle/FrameworkBundle/HttpKernel.php src/Symfony/Component/Security/Http/HttpUtils.php
| * | | changed sub-requests creation to '::create()'Jean-François Simon2013-03-151-1/+1
| | | |
* | | | fixed merge issueFabien Potencier2013-03-151-1/+1
| | | |
* | | | Merge branch '2.1' into 2.2Fabien Potencier2013-03-151-2/+12
|\ \ \ \ | |/ / / | | | / | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: sub-requests are now created with the same class as their parent [FrameworkBundle] removed BC break [FrameworkBundle] changed temp kernel name in cache:clear [DoctrineBridge] Avoids blob values to be logged by doctrine [Security] use current request attributes to generate redirect url? [Validator] fix showing wrong max file size for upload errors [TwigBridge] removed double var initialization (refs #7344) [2.1][TwigBridge] Fixes Issue #7342 in TwigBridge [FrameworkBundle] fixed cahe:clear command's warmup [TwigBridge] now enter/leave scope on Twig_Node_Module [TwigBridge] fixed fixed scope & trans_default_domain node visitor [TwigBridge] fixed non probant tests & added new one [BrowserKit] added ability to ignored malformed set-cookie header [Translation] removed wriong 'use' [Translation] added xliff loader/dumper with resname support [TwigBridge] fixes Conflicts: src/Symfony/Bundle/FrameworkBundle/HttpKernel.php src/Symfony/Component/Security/Http/HttpUtils.php src/Symfony/Component/Translation/Loader/XliffFileLoader.php src/Symfony/Component/Translation/Tests/Loader/XliffFileLoaderTest.php
| * | sub-requests are now created with the same class as their parentJean-François Simon2013-03-141-1/+1
| | |
| * | [Security] use current request attributes to generate redirect url?Jean-François Simon2013-03-131-3/+13
| | |
* | | Merge branch '2.1' into 2.2Fabien Potencier2013-02-111-2/+4
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: added support for the X-Forwarded-For header (closes #6982, closes #7000) fixed the IP address in HttpCache when calling the backend [EventDispatcher] Added assertion. [EventDispathcer] Fix removeListener [DependencyInjection] Add clone for resources which were introduced in 2.1 [DependencyInjection] Allow frozen containers to be dumped to graphviz Fix 'undefined index' error, when entering scope recursively [Security] fixed session creation on login (closes #7011) Add dot character `.` to legal mime subtype regular expression [HttpFoundation] fixed the creation of sub-requests under some circumstancies (closes #6923, closes #6936)
| * | [Security] fixed session creation on login (closes #7011)Adrien Samson2013-02-071-2/+4
| | |
* | | Merge branch '2.1' into 2.2Fabien Potencier2013-02-071-2/+4
|\ \ \ | |/ / | | | | | | | | | | | | | | | * 2.1: [HttpKernel] fixed the creation of the Profiler directory [Security] fixed session creation when none is needed (closes #6917) [FrameworkBundle] removed obsolete comment (see 2e356c1)
| * | [Security] fixed session creation when none is needed (closes #6917)Fabien Potencier2013-02-041-2/+4
| | |
* | | Merge branch '2.1'Fabien Potencier2013-01-231-0/+18
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: [DependencyInjection] fixed the creation of synthetic services in ContainerBuilder [Security] PHPDoc in SecurityEvents Fix typos in README Added an error message in the DebugClassLoader when using / instead of \. KNOWN_ISSUES with php 5.3.16 [FrameworkBundle] fixed Client::doRequest that must call its parent method (closes #6737) [Yaml] fixed ignored text when parsing an inlined mapping or sequence (closes #6786) [Yaml] fixed #6773 [Yaml] fixed #6770 bumped Symfony version to 2.1.8-DEV bumped Symfony version to 2.0.23-DEV Conflicts: src/Symfony/Bundle/FrameworkBundle/Client.php src/Symfony/Component/HttpKernel/Kernel.php
| * | Merge branch '2.0' into 2.1Fabien Potencier2013-01-221-0/+18
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.0: [DependencyInjection] fixed the creation of synthetic services in ContainerBuilder [Security] PHPDoc in SecurityEvents [FrameworkBundle] fixed Client::doRequest that must call its parent method (closes #6737) [Yaml] fixed ignored text when parsing an inlined mapping or sequence (closes #6786) [Yaml] fixed #6773 [Yaml] fixed #6770 bumped Symfony version to 2.0.23-DEV Conflicts: src/Symfony/Component/DependencyInjection/ContainerBuilder.php src/Symfony/Component/HttpKernel/Kernel.php src/Symfony/Component/Yaml/Inline.php src/Symfony/Component/Yaml/Tests/InlineTest.php
| | * | [Security] PHPDoc in SecurityEventsFran Moreno2013-01-211-0/+18
| | | |
| | * | merged branch Tobion/fix-double-encoding (PR #6363)v2.0.21v2.0.20Fabien Potencier2012-12-201-2/+2
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the 2.0 branch. Commits ------- 8b2c17f fix double-decoding in the routing system Discussion ---------- fix double-decoding in the routing system @fabpot @vicb This should fix it. You know what ;) Don't want to leak more information. And the good thing, it's no hack nor does it break BC.
| | | * | fix double-decoding in the routing systemTobias Schultze2012-12-141-2/+2
| | | | |
* | | | | Fixed PHPDocPascal Borreli2013-01-111-1/+1
| | | | |
* | | | | merged branch Seldaek/psr3 (PR #6628)Fabien Potencier2013-01-1016-21/+21
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Commits ------- 67d7423 Remove use of deprecated HttpKernel LoggerInterface dca4528 [HttpKernel] Extend psr/log's NullLogger class 1e5a890 [Monolog] Mark old non-PSR3 methods as deprecated 91a86f8 [HttpKernel][Monolog] Add PSR-3 support to the LoggerInterface Discussion ---------- [HttpKernel][MonologBridge] PSR-3 support This enables PSR-3 support and monolog 1.3+. The first commit is the main part. The rest deals with deprecation of short-hand methods (warn/err/crit/emerg) that are fully expanded in PSR-3 (warning/error/critical/emergency). The downside of deprecating them is that for bundles it's a bit harder to support older and newer versions. If that is too much of a hassle you can drop that for now and cherry pick the first commit. The upside is that it forces people to move towards PSR-3 compatible stuff, which means eventually we could completely drop the LoggerInterface from the framework. In any case I think the documentation should only mention the `Psr\Log\LoggerInterface` and people should start hinting against that. The change should be done in core as well I suppose. Anyway I wanted to throw this out there as it is to get feedback. --------------------------------------------------------------------------- by stof at 2013-01-09T09:15:15Z @Seldaek I also think you should change the typehint to use the PSR LoggerInterface in all classes using the logger --------------------------------------------------------------------------- by Seldaek at 2013-01-09T09:54:55Z OK updated according to all the feedback. I tested it in an app and it still seems to work so there shouldn't be any major issues. --------------------------------------------------------------------------- by Seldaek at 2013-01-09T09:59:55Z @fabpot if you merge please merge also the bundle PR, otherwise it won't be possible to update without conflict. --------------------------------------------------------------------------- by frosas at 2013-01-10T14:59:20Z I'm trying to understand why a `composer update` of a Symfony 2.1.* resulted in a fatal error. Shouldn't a stable version don't break like this? As @olaurendeau points, why Symfony depends 1.* instead of 1.2.*? Or why Monolog 1.3 breaks its public interface (EDIT: I'm not sure about it)? Or why isn't this PR being merged (into branch 2.1) at the same time Monolog 1.3 is released? Please, understand I'm not looking for who to blame, it's just I want to know if this situation is unexpected or if otherwise a `composer update` on a stable branch is not as innocent as it seems. --------------------------------------------------------------------------- by stof at 2013-01-10T15:06:51Z @frosas it cannot be merged into 2.1 as it is a BC break. The 2.1 branch has been updated to forbid Monolog 1.3 already --------------------------------------------------------------------------- by Seldaek at 2013-01-10T15:11:58Z @frosas you can blame me for releasing as 1.3.0 and not 2.0, but technically for monolog this isn't really a BC break, I just added an interface. The problem is due to the way it's used in symfony, it ended up as a fatal error. In any case the situation is now sorted out I think. --------------------------------------------------------------------------- by frosas at 2013-01-10T15:26:43Z @stof now I see this `>=1.0,<1.3-dev` change in the 2.1 branch. Now, shouldn't a new (2.1.7) version be released for all of us not in the dev minimum-stability? @Seldaek then do you see feasible to rely only in X.Y.* versions to avoid this kind of errors? --------------------------------------------------------------------------- by Seldaek at 2013-01-10T15:45:22Z @frosas relying on X.Y.* is painful because you always need to wait until someone updates the constraint to get the new version. Of course using ~1.3 like in this PR means if I fuck up and break BC people will update to it, but that's a less likely occurrence than the alternative I think, so I would rather not use X.Y.* --------------------------------------------------------------------------- by frosas at 2013-01-10T15:50:50Z @Seldaek you are right about this, but I was thinking more in changing it only for the stable versions. EDIT: I mean, how often do you need a new feature in a branch you only apply fixes to? --------------------------------------------------------------------------- by stof at 2013-01-10T15:57:32Z @frosas Monolog and Symfony have separate release cycles. Foorcing Symfony users to use an old version of Monolog until they update to a new version of Symfony whereas the newer Monolog is compatible is a bad idea. Thus, as Monolog keeps BC, it does not maintain bugfix releases for all older versions (just like Twig does too). So it would also forbid you to get the fixes done in newer Monolog versions. The incompatibility between Symfony 2.1 LoggerInterface and PSR-3 (whereas they expect exactly the same behavior and signature for methods with the same name) is unfortunate and is the reason why we get some issues here. --------------------------------------------------------------------------- by frosas at 2013-01-10T16:21:06Z @stof I appreciate you prefer to allow newer versions at the price of having to be constantly monitoring its changes to avoid breaks. Another similar but safer strategy would be to stick to X.Y.* versions and upgrade to X.Y+1.* once the new version integration is tested, but I understand this is discutible in projects as close to Symfony as Monolog. Returning to the issue, what do you say to release this 2.1.7 version? Or is it only me who is having issues here? --------------------------------------------------------------------------- by stof at 2013-01-10T16:26:20Z @frosas a minor release should not break BC when following smeantic versionning (Symfony warned about the fact it is not strictly followed for the first releases of 2.x). But as far as monolog is concerned, 1.3 is BC with 1.2. --------------------------------------------------------------------------- by Seldaek at 2013-01-10T16:49:55Z @frosas sorry I didn't get you still had the problem. I tagged a 2.1.7 of monologbundle which hopefully fixes your issue.
| * | | | | Remove use of deprecated HttpKernel LoggerInterfaceJordi Boggiano2013-01-0916-16/+16
| | | | | |
| * | | | | [Monolog] Mark old non-PSR3 methods as deprecatedJordi Boggiano2013-01-094-5/+5
| | | | | |
* | | | | | merged branch asm89/issue-837 (PR #4935)Fabien Potencier2013-01-102-2/+4
|\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Commits ------- 73db84f [Security] Move translations file to 'security' domain 324703a [Security] Switch to English messages as message keys aa74769 [Security] Fix CS + unreachable code 2d7a7ba [Security] Fix `AuthenticationException` serialization 50d5724 [Security] Introduced `UsernameNotFoundException#get/setUsername` 39da27a [Security] Removed `get/setExtraInformation`, added `get/set(Token|User)` 837ae15 [Security] Add note about changed constructor to changelog d6c57cf [FrameworkBundle] Register security exception translations d7129b9 [Security] Fix exception constructors called in `UserChecker` 0038fbb [Security] Add initial translations for AccountStatusException childs 50e2cfc [Security] Add custom `getMessageKey` AccountStatusException childs 1147977 [Security] Fix InsufficientAuthenticationException constructor calls 79430b8 [Security] Fix AuthenticationServiceException constructor calls 42cced4 [Security] Fix AuthenticationException constructor calls 963a1d7 [Security] Add initial translations for the exceptions ed6eed4 [Security] Add `getMessageKey` and `getMessageData` to auth exceptions 694c47c [Security] Change signature of `AuthenticationException` to match `\Exception` Discussion ---------- [2.2][Security] AuthenticationException enhancements Bug fix: semi Feature addition: yes Backwards compatibility break: yes Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=issue-837)](http://travis-ci.org/asm89/symfony) Fixes the following tickets: #837 License of the code: MIT This PR adds the functionality discussed in #837 and changes the constructor of the `AuthenticationException` to match that of `\Exception`. This PR will allow developers to show a translated (save) authentication exception message to the user. :) *Todo:* - Add some functional test to check that the exceptions can indeed be translated? - Get feedback on the current English messages --------------------------------------------------------------------------- by asm89 at 2012-07-15T14:04:11Z ping @schmittjoh --------------------------------------------------------------------------- by schmittjoh at 2012-07-15T14:57:32Z Looks good to me. While you are at the exceptions, I think we can also get rid of the "extra information" thing and replace it by explicit getters/setters. Mostly that will mean adding set/getToken, set/getUser, set/getUsername. Bundles might add custom exceptions which have other data. This will make it a bit more useful and predictable. --------------------------------------------------------------------------- by asm89 at 2012-07-15T15:40:45Z @schmittjoh I removed the `get/setExtraInformation` and added the more explicit getters/setters as you suggested. --------------------------------------------------------------------------- by asm89 at 2012-07-15T19:33:15Z @fabpot Did you reschedule this for 2.2? Why? It was originally a 2.1 ticket. I think it is an important one because at the moment there is no reliable way to show users the cause of an `AuthenticationException` without the threat of exposing sensitive information. This issue has been around for a while, see the original issue this PR refers to, or for example [this TODO comment in FOSUB](https://github.com/FriendsOfSymfony/FOSUserBundle/blob/master/Controller/SecurityController.php#L37). The PR itself is ready to merge now. My only question that remains is about whether the actual translations should be functional tested? --------------------------------------------------------------------------- by fabpot at 2012-07-15T19:43:19Z We need to stop at some point. If not, we never release anything. beta3 was scheduled for today and I don't plan any other one before the first RC and I won't have time to review this PR next week. So, if you, @schmittjoh, @vicb, @stof, and a few other core devs "validate" this PR, I might consider merging it before 2.1. --------------------------------------------------------------------------- by asm89 at 2012-07-15T19:46:09Z @fabpot I totally agree with your point of view. I just have been trying to pickup some security issues that were still open. :) --------------------------------------------------------------------------- by stof at 2012-07-15T19:50:29Z This looks good to me --------------------------------------------------------------------------- by asm89 at 2012-08-12T09:06:24Z Since the beta period is over I assume the window was missed to get this security related PR in 2.1. If I have feedback from @fabpot I'll still try to make it mergeable asap though. --------------------------------------------------------------------------- by fabpot at 2012-08-13T10:10:32Z @asm89 This would indeed be considered for merging in 2.2. --------------------------------------------------------------------------- by Antek88 at 2012-10-03T10:30:46Z +1 --------------------------------------------------------------------------- by stof at 2012-10-04T21:27:15Z @asm89 could you rebase this PR ? It conflicts with master --------------------------------------------------------------------------- by fabpot at 2012-10-05T17:16:44Z What's the status of this PR? @asm89 Have you taken all the feedback into account? --------------------------------------------------------------------------- by stof at 2012-10-13T17:48:48Z @asm89 ping --------------------------------------------------------------------------- by fabpot at 2012-10-29T09:48:40Z @asm89 If you don't have time, I can finish the work on this PR, but can you just tell me what's left? --------------------------------------------------------------------------- by asm89 at 2012-10-29T10:02:22Z I can pick this up, but I have two outstanding questions: - One about adding `::create()`? https://github.com/symfony/symfony/pull/4935#discussion_r1358297 - And what is the final verdict on the messages? https://github.com/symfony/symfony/pull/4935#discussion_r1165701 The initial idea was that the exception itself have an exception message which is plain english and informative for the developer. If you want to display the 'safe' user messages you have the optional dependency on the translator. There is a comparison made with the Validator component, but in my opinion that's a different case because the violations always contain the message directed at the user and have no plain english message for the developer. Apart from that the Validator component contains it's own code for replacing `{{ }}` variables in messages (duplication? not as flexible as the translator). Concluding I'd opt for: optional dependency on translator component if you want to show 'safe' user messages + message keys. @schmittjoh Any things to add? --------------------------------------------------------------------------- by schmittjoh at 2012-10-29T10:14:09Z Message keys sound good to me. I wouldn't add the ``create`` method for now. On Mon, Oct 29, 2012 at 11:02 AM, Alexander <notifications@github.com>wrote: > I can pick this up, but I have two outstanding questions: > > - One about adding ::create()? symfony/symfony#4935<https://github.com/symfony/symfony/issues/4935#discussion_r1358297> > - And what is the final verdict on the messages? symfony/symfony#4935<https://github.com/symfony/symfony/issues/4935#discussion_r1165701>The initial idea was that the exception itself have an exception message > which is plain english and informative for the developer. If you want to > display the 'safe' user messages you have the optional dependency on the > translator. There is a comparison made with the Validator component, but in > my opinion that's a different case because the violations always contain > the message directed at the user and have no plain english message for the > developer. Apart from that the Validator component contains it's own code > for replacing {{ }} variables in messages (duplication? not as > flexible as the translator). Concluding I'd opt for: optional dependency on > translator component if you want to show 'safe' user messages + message > keys. > > @schmittjoh <https://github.com/schmittjoh> Any things to add? > > — > Reply to this email directly or view it on GitHub<https://github.com/symfony/symfony/pull/4935#issuecomment-9861016>. > > --------------------------------------------------------------------------- by fabpot at 2012-10-29T10:27:37Z As I said in the discussion about the translations, I'm -1 for the message keys to be consistent with how we manage translations everywhere else in the framework. --------------------------------------------------------------------------- by stof at 2012-10-29T10:30:50Z @fabpot When we changed the English translation for the validation errors in 2.1, we had to tag the commit as a BC rbeak as it was changing the source for all other translations. And if you look at the state of the files now, you will see that we are *not* using the English as source anymore in some places as some validation errors have a pluralized translation but the source has not been changed. So I think using a key is more future-proof. --------------------------------------------------------------------------- by asm89 at 2012-10-30T19:44:49Z Any final decision on this? On one hand I have @stof and @schmittjoh +1 on message keys, on the other @fabpot -1. I guess it's your call @fabpot. Edit: also @vicb seemed to be +1 on message keys earlier on. --------------------------------------------------------------------------- by drak at 2012-11-01T20:19:00Z I am also -1, I agree with @fabpot --------------------------------------------------------------------------- by asm89 at 2012-11-12T09:38:51Z @fabpot Can you please give a definite answer on this? I personally think @stof and @vicb have good points to do message keys, but with all these different people +1 and -1'ing the PR I'm lost on what it should actually do. --------------------------------------------------------------------------- by asm89 at 2012-11-14T09:59:06Z ping @fabpot --------------------------------------------------------------------------- by asm89 at 2012-11-26T10:01:27Z ping @fabpot We talked about this in Berlin. Any final thoughts on the PR? :) One idea was to do message keys + opt depend on the translator component if you want to use them, or use your own implementation. --------------------------------------------------------------------------- by fabpot at 2012-11-26T14:01:37Z The conclusion is: keep using plain English. On Mon, Nov 26, 2012 at 11:01 AM, Alexander <notifications@github.com>wrote: > ping @fabpot <https://github.com/fabpot> We talked about this in Berlin. > Any final thoughts on the PR? :) One idea was to do message keys + opt > depend on the translator component if you want to use them, or use your own > implementation. > > — > Reply to this email directly or view it on GitHub<https://github.com/symfony/symfony/pull/4935#issuecomment-10709997>. > > --------------------------------------------------------------------------- by Inori at 2012-11-26T15:00:22Z is this final? if not, then +1 for message keys --------------------------------------------------------------------------- by vicb at 2012-11-27T22:33:47Z @fabpot I can't understand why we keep discussing this for months as this implementation use *both* keys and plain Englis, ie using keys is optional ( if it was not it would not be an issue according to #6129) --------------------------------------------------------------------------- by asm89 at 2013-01-02T21:43:46Z @fabpot @vicb I'll rebase this PR, fix the comments and refactor the message keys to use plain English + {{ }} syntax for the placeholders. --------------------------------------------------------------------------- by asm89 at 2013-01-07T15:00:58Z @fabpot If I fix this tonight, will it make the beta? --------------------------------------------------------------------------- by fabpot at 2013-01-07T15:53:00Z yes, definitely. --------------------------------------------------------------------------- by asm89 at 2013-01-07T20:13:38Z @fabpot I switched the implementation to English messages instead of message keys and fixed the final comments + rebased. Anything you want me to do after this? Still happy with `getMessageKey()`?
| * | | | | | [Security] Removed `get/setExtraInformation`, added `get/set(Token|User)`Alexander2013-01-071-1/+1
| | | | | | |
| * | | | | | [Security] Fix InsufficientAuthenticationException constructor callsAlexander2013-01-071-1/+3
| | | | | | |
| * | | | | | [Security] Fix AuthenticationException constructor callsAlexander2013-01-071-1/+1
| |/ / / / /
generated by cgit v1.1 at 2025-06-05 23:59:08 +0000