summaryrefslogtreecommitdiffstats
path: root/Http
Commit message (Collapse)AuthorAgeFilesLines
* [Security] Fixed digest authenticationVincent Simonin2012-11-151-5/+6
| | | | Digest authentication fail if digest parameters contains `=` character or `, ` string.
* fixed undefined variablev2.0.18James Michael DuPont2012-09-281-1/+1
|
* avoid fatal error on invalid sessionv2.0.17Kris Wallsmith2012-08-071-8/+15
|
* fixed CS (mainly method signatures)v2.0.16Fabien Potencier2012-07-0913-18/+18
|
* tweaked the previous commitFabien Potencier2012-06-161-1/+1
|
* [Security] Only redirect to urls called with http method GETUwe Jäger2012-06-141-1/+1
|
* merged branch kepten/ticket_1813 (PR #3551)v2.0.15Fabien Potencier2012-05-211-2/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache Discussion ---------- [HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] --------------------------------------------------------------------------- by stof at 2012-03-10T17:34:26Z you should also add a unit test for this --------------------------------------------------------------------------- by kepten at 2012-03-11T15:34:04Z Thanks for the feedback, I committed the changes. --------------------------------------------------------------------------- by stof at 2012-04-04T01:59:53Z @fabpot could you review it ? --------------------------------------------------------------------------- by fabpot at 2012-04-04T07:15:34Z My comments: * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers. * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs). * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed). --------------------------------------------------------------------------- by danielholmes at 2012-04-14T13:27:09Z A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this: ``` <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] </IfModule> ``` NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening --------------------------------------------------------------------------- by towards at 2012-04-20T16:12:49Z @kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI --------------------------------------------------------------------------- by kepten at 2012-04-20T16:15:57Z ok, so is my PR is useless or should I still fix problems? --------------------------------------------------------------------------- by towards at 2012-04-20T16:20:26Z your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes --------------------------------------------------------------------------- by vicb at 2012-04-20T16:20:36Z I have been working with @towards: your PR is useful, please implement his comments and squash your PR. --------------------------------------------------------------------------- by kepten at 2012-04-20T16:59:07Z never squashed before, is it okay now? :) --------------------------------------------------------------------------- by stof at 2012-04-20T17:21:07Z it is --------------------------------------------------------------------------- by vicb at 2012-05-20T19:57:51Z @fabpot this should be ready to be merged
| * [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI ↵kepten2012-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L]
* | fixed CSFabien Potencier2012-05-186-18/+18
| |
* | fixed phpdoc @param alignmentv2.0.14Fabien Potencier2012-05-155-17/+17
| |
* | use SecurityContextInterface instead of SecurityContextv2.0.13Pierre Minnieur2012-03-092-5/+5
|/
* fixed CSv2.0.10Fabien Potencier2012-01-171-1/+1
|
* fixed CSFabien Potencier2011-12-181-1/+1
|
* [DoctrineBridge] fixed some CSFabien Potencier2011-12-1311-2/+25
|
* check for session before trying to authentication detailsMatt Lehner2011-12-021-0/+4
|
* removed unused use statementsFabien Potencier2011-11-246-6/+0
|
* [Security] fixed HttpUtils::checkRequestPath() to not catch all exceptions ↵v2.0.6Fabien Potencier2011-11-141-1/+5
| | | | (closes #2637)
* merged branch snc/issue-1798 (PR #2528)Fabien Potencier2011-11-101-0/+8
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- f9befb6 Remove only the security token instead of the session cookie. 348bccb Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). Discussion ---------- Fix for issue 1798 Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). --------------------------------------------------------------------------- by snc at 2011/11/01 04:01:49 -0700 @stof I have changed the code so that it only removes the token... do we still need any hook support? --------------------------------------------------------------------------- by stof at 2011/11/01 04:07:17 -0700 well, the hook is for your own use case but it would be for 2.1 only anyway, not for 2.0 --------------------------------------------------------------------------- by snc at 2011/11/07 15:11:52 -0800 Now that #2414 is merged to 2.1, this could be simplified for the master branch...
| * Remove only the security token instead of the session cookie.H. Westphal2011-11-011-7/+6
| |
| * Clear session cookie if user was deleted, is disabled or locked to prevent ↵H. Westphal2011-10-311-1/+10
| | | | | | | | infinite redirect loops to the login path (fixes #1798).
* | [Security] Fix checkRequestPath doc; closes #2323Jeremy Mikola2011-11-071-1/+1
| |
* | replace occurences of "an UserInteface" with "a UserInterface"Igor Wiedler2011-11-031-1/+1
|/
* removed unused use statementsFabien Potencier2011-10-297-11/+0
|
* merged branch helmer/target_path (PR #2228)Fabien Potencier2011-09-251-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 022a9a7 [Security] Make saving target_path extendible Discussion ---------- [Security] Make saving target_path extendible The problem lies in how Security component handles ``target_path`` - the latest request URI is always stored. This can lead to problems in following scenarios: a) The response type of the request is not HTML (think JSON, XML ..) b) The URI matches a route that does not listen to HTTP GET I opened a [PR](https://github.com/symfony/symfony/pull/604) months ago, to partly solve scenario A, which did not make it. Now I am proposing a different solution - user can extend ``ExceptionListener`` and override the logic behind setting the ``target_path`` to match his precise needs. In my simplified scenario, I would be using: ``` protected function setTargetPath(Request $request) { if ($request->isXmlHttpRequest() || 'GET' !== $request->getMethod()) { return; } $request->getSession()->set('_security.target_path', $request->getUri()); } ``` @Seldaek, @schmittjoh, @lsmith77, thoughts? --------------------------------------------------------------------------- by Seldaek at 2011/09/21 02:37:02 -0700 Seems like a better solution for flexibility's sake. Would be quite awesome if you could add a cookbook entry to symfony/symfony-docs about this, otherwise I'm afraid we'll have to explain it over and over again :) --------------------------------------------------------------------------- by helmer at 2011/09/21 03:38:57 -0700 [Cookbook](https://github.com/helmer/symfony-docs/commit/b22c5e666edb2586840884e32f8209425125c30d) entry done. Perhaps though I rushed ahead .. --------------------------------------------------------------------------- by Seldaek at 2011/09/21 03:52:01 -0700 Thanks. You can already do a pull request against symfony-docs, just reference this pull request in it so it's not merged before this is merged.
* Fixed the creation of the subrequestsChristophe Coevoet2011-09-181-0/+3
| | | | | | The subrequest must be created using an absolute path to keep the informations about the host and the base path. Closes #2168
* Added missing method to HTTP Digest entry pointStefano Sala2011-09-061-0/+10
|
* increased visibility of httpUtils propertyJohannes Schmitt2011-08-181-1/+2
|
* Using the $status parameter instead of fixed value when creating a ↵v2.0.0Henrik Westphal2011-07-241-1/+1
| | | | RedirectResponse.
* fixes #1659Johannes Schmitt2011-07-191-0/+5
|
* fixes several bugsJohannes Schmitt2011-07-191-15/+42
|
* merged branch schmittjoh/abstractAuthenticationListener (PR #1683)Fabien Potencier2011-07-131-8/+8
|\ | | | | | | | | | | | | | | | | | | | | | | Commits ------- 29e4063 [Security] changed order of checks to check for more specific things first Discussion ---------- [Security] changed order of checks
| * [Security] changed order of checks to check for more specific things firstJohannes Schmitt2011-07-131-8/+8
| |
* | [Security] fixes #1329Johannes Schmitt2011-07-131-1/+1
| |
* | Added a AccessDeniedHttpException to wrap the AccessDeniedException.Christophe Coevoet2011-07-111-5/+6
| | | | | | | | See #1631
* | [Security] fixed redirection URLs when using {_locale} in the patternFabien Potencier2011-07-111-0/+13
| |
* | [Security] tweaked previous commitFabien Potencier2011-07-051-0/+1
| |
* | [Security] removed a hackFabien Potencier2011-07-051-9/+14
| |
* | [Security] reverted change from previous mergeFabien Potencier2011-07-041-0/+6
| |
* | merged branch Herzult/testSecurity (PR #1447)Fabien Potencier2011-07-043-10/+2
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 164aea4 [Security] Add tests for the channel listener d51cbc0 [Security] Remove useless attribute in basic authentication listener & test it 91e6dc9 [Security] Add tests for the anonymous authentication listener 3c2affb [Security] Update access listener constructor's prototype and add tests 81afd77 [Security] Add tests for the firewall map aa6ae33 [Security] Remove useless attribute & var in firewall Discussion ---------- Test security --------------------------------------------------------------------------- by lsmith77 at 2011/06/29 13:41:07 -0700 @schmittjoh is probably the person to review this change ..
| * [Security] Remove useless attribute in basic authentication listener & test itAntoine Hérault2011-06-261-6/+0
| |
| * [Security] Update access listener constructor's prototype and add testsAntoine Hérault2011-06-261-2/+2
| |
| * [Security] Remove useless attribute & var in firewallAntoine Hérault2011-06-251-2/+0
| |
* | [Security] Fix http retry authentication entry pointAntoine Hérault2011-06-251-1/+1
| |
* | [Security] Fix http form authentication entry pointAntoine Hérault2011-06-251-1/+1
| |
* | [Security] Fix http digest authentication entry pointAntoine Hérault2011-06-251-1/+1
|/
* [Security] Fix http basic authentication entry pointAntoine Hérault2011-06-251-1/+1
|
* [Security] added an HttpUtils class to manage logic related to Requests and ↵Fabien Potencier2011-06-226-30/+135
| | | | | | | | | | | | | | Responses This change removes the need for the {_locale} hack. Now, all paths in the Security component can be: * An absolute path (/login) * An absolute URL (http://symfony.com/login) * A route name (login) So, if you want to use a path that includes a global parameter (like _locale), use a route instead of a path.
* Renamed core.* events to kernel.* and CoreEvents to KernelEventsJordi Boggiano2011-06-216-11/+8
|
* [Security] renamed UserProviderInterface::loadUser() to refreshUser()Fabien Potencier2011-06-161-1/+1
|
* made some tweaks to error levelsFabien Potencier2011-06-154-7/+7
|
* [Security] reverted some changes from previous mergeFabien Potencier2011-06-151-4/+1
|
* merged branch kaiwa/loglevel (PR #1073)Fabien Potencier2011-06-1510-18/+21
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- cdf4b6a Checked log levels a45d3ee Reverted last commit 529381b ControllerNotFound: Changed log level from info to error. Also moved throw exception code block up, to prevent the message from beeing logged multiple times. 7c29e88 Changed log level of "Matched route ..." message from info to debug dca09fd Changed log level of "Using Controller ..." message from info to debug Discussion ---------- Log levels Just wanted to ask if the log level INFO is still correct for these messages? As there are only four log levels left (DEBUG, INFO, WARNING, ERROR), DEBUG might be the more appropriate level for these messages now. Let me give an example: An application is logging user actions (maybe to database) in order to assure comprehensibility, e. g. "User %s deleted post %d", "User %s written a message to user %s". These are not warnings of course, so the only suitable log level is INFO. But they will be thrown together with these very common (at least two per request?) "Using controller..." and "Matched route..." messages when choosing INFO as log level. --------------------------------------------------------------------------- by Seldaek at 2011/05/24 07:13:18 -0700 Agreed, this stuff is framework debug information. --------------------------------------------------------------------------- by fabpot at 2011/05/24 08:53:24 -0700 Why do you want to change these two specific ones? The framework uses the INFO level at other places too. Is it a good idea to say that the framework only logs with DEBUG? --------------------------------------------------------------------------- by stof at 2011/05/24 09:12:53 -0700 Doctrine logs at the INFO level too and I think it is useful to keep it as INFO. Being able to see the queries without having all DEBUG messages of the event dispatcher and security components is useful IMO. --------------------------------------------------------------------------- by Seldaek at 2011/05/25 02:30:24 -0700 Yeah, that's true, maybe we just need to reintroduce (again, meh:) NOTICE between INFO and WARNING. @kaiwa Of course the other way could be that you just add your DB handler to the app logger stack. That could be done in a onCoreRequest listener or such, basically you'd have to call `->pushHandler($yourDBHandler)` on the `monolog.logger.app` service. That way your messages will flow to it, but it won't receive noise from the framework stuff since those log on monolog.logger.request and other log channels. --------------------------------------------------------------------------- by fabpot at 2011/05/25 02:48:26 -0700 @Seldaek: I don't think we need another level. We just need to come up with a standard rules about the usage of each level. Adapted from log4j: * ERROR: Other runtime errors or unexpected conditions. * WARN: Use of deprecated APIs, poor use of API, 'almost' errors, other runtime that are undesirable or unexpected, but not necessarily "wrong" (unable to write to the profiler DB, ). * INFO: Interesting runtime events (security infos like the fact the user is logged-in or not, SQL logs, ...). * DEBUG: Detailed information on the flow through the system (route match, security flow infos like the fact that a token was found or that remember-me cookie is found, ...). What do you think? --------------------------------------------------------------------------- by stloyd at 2011/05/25 02:53:38 -0700 +1 for this standard (also this PR can be merged then), but we should review code for other "wrong" log levels usage (if everyone accept this standard) --------------------------------------------------------------------------- by fabpot at 2011/05/25 02:55:07 -0700 I won't merge this PR before all occurrences of the logger calls have been reviewed carefully and changed to the right level. --------------------------------------------------------------------------- by kaiwa at 2011/05/25 02:58:44 -0700 @fabpot: Just noticed these two occurring for every request in my log file. You are right, there are other places where this changes must be applied if we will change the log level. @stof: Hmm, i see. It is not possible to set the logger separately for each bundle, is it? That maybe would solve the problem. If somebody is interested in seeing the queries, he could set the log handler level to DEBUG for doctrine bundle, but still use INFO for the framwork itself. Plus he could even define a different output file or a completely different handler. I'm not sure if something like that is possible already (?) or realizable at all... just came into my mind. --------------------------------------------------------------------------- by Seldaek at 2011/05/25 03:01:07 -0700 Just FYI, from Monolog\Logger (which has CRITICAL and ALERT): * Debug messages const DEBUG = 100; * Messages you usually don't want to see const INFO = 200; * Exceptional occurences that are not errors * This is typically the logging level you want to use const WARNING = 300; * Errors const ERROR = 400; * Critical conditions (component unavailable, etc.) const CRITICAL = 500; * Action must be taken immediately (entire service down) * Should trigger alert by sms, email, etc. const ALERT = 550; The values kind of match http error codes too, 4xx are expected errors that are not really important (404s etc) and 5xx are server errors that you'd better fix ASAP. I'm ok with the descriptions, but I think alert and critical should be included too. I'll probably update Monolog docblocks to match whatever ends up in the docs. --------------------------------------------------------------------------- by Seldaek at 2011/05/25 03:03:21 -0700 @kaiwa you can do a lot, but not from the default monolog configuration entry, I'm not sure if we can really make that fully configurable without having a giant config mess. Please refer to my [comment above](https://github.com/symfony/symfony/pull/1073#issuecomment-1234316) to see how you could solve it. Maybe @fabpot has an idea how to make this more usable though. --------------------------------------------------------------------------- by stof at 2011/05/25 03:19:43 -0700 @Seldaek the issue is that the different logging channels are only know in the compiler pass, not in the DI extension. So changing the level in the extension is really hard IMO. Thus, the handlers are shared between the different logging channels (needed to open the log file only once for instance, or to send a single mail instead of one per channel) and the level is handled in the handlers, not the logger. I'm +1 for the standard, by adding the distinction between 400 and 500 status calls using ERROR and CRITICAL (which is already the case in the code). @kaiwa do you have time to review the calls to the logger between DEBUG and INFO or do you prefer I do it ? For instance, the Security component currently logs all message at DEBUG level and some of them should be INFO. --------------------------------------------------------------------------- by kaiwa at 2011/05/25 04:31:04 -0700 @stof ok i'll do that --------------------------------------------------------------------------- by kaiwa at 2011/05/25 12:22:51 -0700 Need some help :) I came across `ControllerNameParser::handleControllerNotFoundException()` which leads to redundant log messages currently: >[2011-05-25 20:53:16] request.INFO: Unable to find controller "AppBaseBundle:Blog" - class "App\BaseBundle\Controller\BlogController" does not exist. >[2011-05-25 20:53:16] request.ERROR: InvalidArgumentException: Unable to find controller "AppBaseBundle:Blog" - class "App\BaseBundle\Controller\BlogController" does not exist. (uncaught exception) at /home/ruth/symfony3/src/Symfony/Bundle/FrameworkBundle/Controller/ControllerNameParser.php line 87 Is it necessary to call `$this->logger->info($log);` if the InvalidArgumentException will be logged anyway? --------------------------------------------------------------------------- by stof at 2011/05/25 12:39:22 -0700 Well, the issue is that the ControllerNameParser logs messages and then uses them to throw an exception. I guess the logging call should be removed as it is redundant with the one of the ExceptionListener. @fabpot thoughts ? --------------------------------------------------------------------------- by kaiwa at 2011/05/27 11:39:25 -0700 I checked all debug, info and log calls. Sometimes it is hard to distinguish between the levels, so it would be great if someone reviews @cdf4b6a. @stof, maybe you want to take a look? --------------------------------------------------------------------------- by kaiwa at 2011/05/31 12:52:07 -0700 @stof, thanks for your comments. I added some replies above, please let me know your suggestions. --------------------------------------------------------------------------- by stof at 2011/05/31 14:04:22 -0700 @kaiwa As I said before, all the security logging calls should be DEBUG (most of them) or INFO (the one syaing that authentication succeeded for instance), but not WARN or ERROR as the exception don't go outside the firewall.
| * Checked log levelskaiwa2011-05-2710-18/+21
| |
* | fixed CSFabien Potencier2011-06-131-1/+1
| |
* | made logoutPath localizable as wellNed Schwartz2011-06-101-1/+3
| |
* | storing localized targetPath in a string as opposed to updating the attributeNed Schwartz2011-06-101-4/+3
| |
* | In the spirit of 882a8e3f09c602a6f0ed3b5bd20e8d4688331500 allow for ↵Ned Schwartz2011-06-101-0/+2
| | | | | | | | localized logout target url
* | fixed CSFabien Potencier2011-06-0816-16/+16
| |
* | fixed CSFabien Potencier2011-06-081-0/+2
| |
* | [Security] fixed sub-requests creation (closes #1212)Fabien Potencier2011-06-083-3/+5
| |
* | Added the support of the locale in the login path and the check pathChristophe Coevoet2011-06-062-7/+10
| |
* | [Security/Http] removed irrelevant codeJohannes M. Schmitt2011-06-031-2/+0
| |
* | added missing license headersFabien Potencier2011-05-317-0/+63
| |
* | merged origin/masterFabien Potencier2011-05-311-1/+1
|\ \
| * | [Security] fixed wrong function callFabien Potencier2011-05-301-1/+1
| | |
* | | merged origin/masterFabien Potencier2011-05-302-2/+11
|\ \ \ | |/ /
| * | Merge branch 'master' of http://github.com/symfony/symfony into securityJohannes M. Schmitt2011-05-301-5/+10
| |\ \
| * \ \ Merge branch 'master' of git://github.com/symfony/symfony into securityJohannes Schmitt2011-05-281-0/+1
| |\ \ \
| * | | | [Security/Http] use deep parameter for CSRF parameterJohannes Schmitt2011-05-181-1/+1
| | | | |
| * | | | Merge remote branch 'origin/master' into securityJohannes Schmitt2011-05-181-2/+2
| |\ \ \ \ | | | |_|/ | | |/| | | | | | | | | | | | Conflicts: src/Symfony/Bundle/FrameworkBundle/Listener/RequestAttributeInitializingListener.php
| * | | | [Security/Http] better error message when session times out, or cookies are ↵Johannes Schmitt2011-05-141-0/+9
| | | | | | | | | | | | | | | | | | | | disabled
| * | | | [Security/Http] {_locale} can be used as placeholder in target path generationJohannes Schmitt2011-05-141-1/+1
| | | | | | | | | | | | | | | | | | | | fixes #861
* | | | | [Security] fixed event namesFabien Potencier2011-05-305-7/+7
| | | | |
* | | | | [Security] removed obsolete use statementsFabien Potencier2011-05-306-6/+0
| | | | |
* | | | | renamed constants to upper casedFabien Potencier2011-05-302-2/+2
| | | | |
* | | | | Merge remote branch 'Seldaek/events' into events1Fabien Potencier2011-05-307-19/+19
|\ \ \ \ \ | |_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Seldaek/events: [EventDispatcher] Removed temporary code [FrameworkBundle] Improved code readability [FrameworkBundle] Clarified code and fixed regression Update Core and Security events to latest model [EventDispatcher] Allow registration of arbitrary callbacks [EventDispatcher] Remove useless code [EventDispatcher] Minor memory optimization to getListeners() [FrameworkBundle] Small optimization, remove some function calls
| * | | | Update Core and Security events to latest modelJordi Boggiano2011-05-267-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | The main benefit is that in XML/YML files we have common syntax (i.e. core.controller, form.pre_bind) that properly namespaces event names (before: onCoreController was ok, preBind was not). On the other hand in PHP land we also have namespaced events, CoreEvents::controller, FormEvents::preBind, before it was Events::onCoreController, Events::onPreBind, we now have more context.
| * | | | [EventDispatcher] Allow registration of arbitrary callbacksJordi Boggiano2011-05-261-1/+1
| | |/ / | |/| | | | | | | | | | | | | | This in effect removes the direct link between event name and the method name on the handler. Any callback can be given as a handler and the event name becomes an arbitrary string. Allowing for easier namespacing (see next commit)
* | | | [Various] Fixed phpdocPascal Borreli2011-05-291-5/+10
| |_|/ |/| |
* | | [Security] Adding tests and then fixing bug where ContextListener did no loggingRyan Weaver2011-05-261-0/+1
|/ /
* | [Security] updated with "intention"Kris Wallsmith2011-05-161-2/+2
|/
* [Security] use deep flag when retrieving username + passwordJohannes Schmitt2011-05-102-3/+3
|
* [Security][HttpFoundation] splits Request::hasSession() into hasSession(), ↵Johannes Schmitt2011-05-051-1/+1
| | | | | | and hasPreviousSession() This closes #774, and fixes #772.
* [Phpdoc] Cleaning/fixingPascal Borreli2011-04-239-28/+32
|
* Merge remote branch 'bschussek/form-extensions'Fabien Potencier2011-04-231-1/+1
|\ | | | | | | | | | | | | * bschussek/form-extensions: [Form] Refactored code from CoreExtension to new ValidatorExtension [Form] Added FormTypeExtensionInterface [Form] Reorganized code into "form extensions"
| * [Form] Reorganized code into "form extensions"Bernhard Schussek2011-04-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The extension classes are now the only constructor argument of the FormFactory class. They replace the existing "type loader" classes. new FormFactory(array( new CoreExtension($validator, $storage), new CsrfExtension($csrfProvider), new DoctrineOrmExtension($em), )); Together with a few upcoming commits this mechanism will make * extension of the form framework in bundles and * usage of the forms outside of Symfony2 much easier.
* | Fixed various typoPascal Borreli2011-04-222-2/+2
|/
* fixes a bug in the SwitchUserListenerJohannes M. Schmitt2011-04-191-1/+4
|
* [Security] fixed URLFabien Potencier2011-04-121-1/+1
|
* [Security] Remove unneeded and invalid use statementJordi Boggiano2011-04-051-1/+0
|
* [SecurityBundle] fixed missing argument EventDisplatcher in RememberMe serviceAlexey Popkov2011-03-242-0/+2
|
* [Security] Removed useless method callChristophe Coevoet2011-03-231-2/+0
|
* [Security] Fixed some listeners not updated after the event refactoringChristophe Coevoet2011-03-223-5/+5
|
* Merge remote branch 'mvrhov/variousFixes'Fabien Potencier2011-03-211-2/+0
|\
| * removed unecessary use statements (ExceptionEvent was also undefined namespace)Miha Vrhovnik2011-03-211-2/+0
| |
* | Merge branch 'interactive-login-event' of git://github.com/yethee/symfony ↵Johannes M. Schmitt2011-03-211-1/+2
|\ \ | |/ |/| | | into security
| * [Security] Added a type hint.Deni2011-03-191-1/+2
| |
* | Fixing failure on forward which was broken by Event refactoringMiha Vrhovnik2011-03-191-1/+1
| |
* | fix to use setExceptionAmal Raghav2011-03-191-2/+2
|/
* Merge remote branch 'schmittjoh/security'Fabien Potencier2011-03-181-1/+1
|\
generated by cgit v1.1 at 2025-05-30 05:42:56 +0000