summaryrefslogtreecommitdiffstats
path: root/Http
Commit message (Collapse)AuthorAgeFilesLines
* [Security] Add note to CHANGELOG about refactored authentication ↵Alexander2012-07-083-36/+28
| | | | failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock
* [Security] Update AuthenticationFailureHandlerInterface docblock. Never ↵Alexander2012-07-081-1/+1
| | | | return null
* [Security] Move default authentication failure handling strategy to seperate ↵Alexander2012-07-084-35/+116
| | | | class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler
* [Security] Move default authentication success handling strategy to seperate ↵Alexander2012-07-084-47/+90
| | | | class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test
* [Security] Fix typo in docblockAdrien Brault2012-07-071-1/+1
|
* [Security] fixed automatic registration of the response listener when ↵Fabien Potencier2012-07-061-4/+6
| | | | | | | | | | | | | creating the listener This is not a problem with Symfony, but when using the component standalone (Silex for instance), the context listener might be instantiated even if the firewall does not need to be fired. In that case, the handle() method is not called, but the response listener is called, which means that en empty token is stored in the session. For Silex, it means that when authenticated, if you visit a 404 page, you would be disconnected automatically.
* merged branch uwej711/security_target_path_master (PR #4409)Fabien Potencier2012-07-022-4/+6
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 8ffaafa Make the session entry for the target url firewall dependent. Discussion ---------- [Security] Make the session entry for the target url firewall dependent. Bug fix: yes Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Fixes the following tickets: License of the code: MIT If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url, which will lead me to the admin login form again. --------------------------------------------------------------------------- by travisbot at 2012-05-25T09:33:44Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1431566) (merged 8ffaafa8 into 45849ce3). --------------------------------------------------------------------------- by uwej711 at 2012-06-09T08:05:54Z Doesn't this make sense or did this slip through? Or is there something missing?
| * Make the session entry for the target url firewall dependent.Uwe Jäger2012-05-252-4/+6
| | | | | | | | | | | | | | If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url. This is not what you usually want to happen.
* | fixed phpdocFabien Potencier2012-06-261-1/+4
| |
* | [Security] simplified some codeFabien Potencier2012-06-261-16/+21
| |
* | [Security] changed the HttpUtils constructor to tak both a UrlGenerator and ↵Fabien Potencier2012-06-261-9/+13
| | | | | | | | a UrlMatcher instead of a Router (to make it useable by Silex)
* | merged 2.0Fabien Potencier2012-06-201-1/+1
|\ \
| * | tweaked the previous commitFabien Potencier2012-06-161-1/+1
| | |
| * | [Security] Only redirect to urls called with http method GETUwe Jäger2012-06-141-1/+1
| | |
* | | [Security] Check post_only option and request methodHenrik Bjørnskov2012-06-091-0/+12
| |/ |/|
* | merged 2.0Fabien Potencier2012-05-211-2/+2
|\ \ | |/
| * merged branch kepten/ticket_1813 (PR #3551)v2.0.15Fabien Potencier2012-05-211-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache Discussion ---------- [HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] --------------------------------------------------------------------------- by stof at 2012-03-10T17:34:26Z you should also add a unit test for this --------------------------------------------------------------------------- by kepten at 2012-03-11T15:34:04Z Thanks for the feedback, I committed the changes. --------------------------------------------------------------------------- by stof at 2012-04-04T01:59:53Z @fabpot could you review it ? --------------------------------------------------------------------------- by fabpot at 2012-04-04T07:15:34Z My comments: * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers. * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs). * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed). --------------------------------------------------------------------------- by danielholmes at 2012-04-14T13:27:09Z A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this: ``` <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] </IfModule> ``` NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening --------------------------------------------------------------------------- by towards at 2012-04-20T16:12:49Z @kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI --------------------------------------------------------------------------- by kepten at 2012-04-20T16:15:57Z ok, so is my PR is useless or should I still fix problems? --------------------------------------------------------------------------- by towards at 2012-04-20T16:20:26Z your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes --------------------------------------------------------------------------- by vicb at 2012-04-20T16:20:36Z I have been working with @towards: your PR is useful, please implement his comments and squash your PR. --------------------------------------------------------------------------- by kepten at 2012-04-20T16:59:07Z never squashed before, is it okay now? :) --------------------------------------------------------------------------- by stof at 2012-04-20T17:21:07Z it is --------------------------------------------------------------------------- by vicb at 2012-05-20T19:57:51Z @fabpot this should be ready to be merged
| | * [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI ↵kepten2012-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L]
| * | fixed CSFabien Potencier2012-05-186-18/+18
| | |
| * | fixed phpdoc @param alignmentv2.0.14Fabien Potencier2012-05-155-17/+17
| | |
| * | use SecurityContextInterface instead of SecurityContextv2.0.13Pierre Minnieur2012-03-092-5/+5
| |/
| * fixed CSv2.0.10Fabien Potencier2012-01-171-1/+1
| |
* | fixed CSFabien Potencier2012-05-186-19/+19
| |
* | fixed phpdoc @param alignmentFabien Potencier2012-05-155-18/+18
| |
* | [Security] fixed English grammar in exception messageDouglas Greenshields2012-05-011-1/+1
| |
* | fixed CS (missing or misplaced license blocks)Eriksen Costa2012-04-025-42/+42
| |
* | updated license blocksEriksen Costa2012-03-319-27/+27
| |
* | fixed CSFabien Potencier2012-03-231-2/+2
| |
* | [Security] Log file/line that triggered the AccessDeniedExceptionJordi Boggiano2012-03-231-2/+2
| |
* | [SecurityBundle] Allow switching to the user that is already impersonated ↵Andreas Hucks2012-03-151-6/+10
| | | | | | | | | | | | | | | | | | | | (fix #2554) Disabled exception when switching to the user that is already impersonated, exception is now only thrown when trying to switch to a new user. Added an Excption exception when switching fails because target user does not exist. Added funtional tests for switching users.
* | fixed docblockPierre Minnieur2012-03-071-1/+1
| |
* | use SecurityContextInterface instead of SecurityContextPierre Minnieur2012-03-071-2/+2
| |
* | use SecurityContextInterface instead of SecurityContextPierre Minnieur2012-03-061-2/+2
| |
* | merged branch jmikola/logout-csrf (PR #3007)Fabien Potencier2012-03-052-15/+43
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 49a8654 [Security] Use LogoutException for invalid CSRF token in LogoutListener a96105e [SecurityBundle] Use assertCount() in tests 4837407 [SecurityBundle] Fix execution of functional tests with different names 66722b3 [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens aaaa040 [Security] Allow LogoutListener to validate CSRF tokens b1f545b [Security] Refactor LogoutListener constructor to take options c48c775 [SecurityBundle] Add functional test for form login with CSRF token Discussion ---------- [Security] Implement support for CSRF tokens in logout URL's ``` Bug fix: no Feature addition: yes Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: - Todo: - ``` [![Build Status](https://secure.travis-ci.org/jmikola/symfony.png?branch=logout-csrf)](http://travis-ci.org/jmikola/symfony) This derived from #3006 but properly targeting on the master branch. This exposes new configuration options to the logout listener to enable CSRF protection, as already exists for the form login listener. The individual commits and their extended messages should suffice for explaining the logical changes of the PR. In addition to changing LogoutListener, I also created a templating helper to generate logout URL's, which includes a CSRF token if necessary. This may or may not using routing, depending on how the listener is configured since both route names or hard-coded paths are valid options. Additionally, I added unit tests for LogoutListener and functional tests for both CSRF-enabled form logins and the new logout listener work. Kudo's to @henrikbjorn for taking the time to document CSRF validation for form login listeners (see [here](http://henrik.bjrnskov.dk/symfony2-cross-site-request-forgery/)). The [Logout CSRF Protection](http://www.yiiframework.com/wiki/190/logout-csrf-protection/) article on the Yii Framework wiki was also helpful in drafting this. --------------------------------------------------------------------------- by jmikola at 2011-12-31T07:50:31Z Odd that Travis CI reported a build failure for PHP 5.3.2, but both 5.3 and 5.4 passed: http://travis-ci.org/#!/jmikola/symfony/builds/463356 My local machine passes as well. --------------------------------------------------------------------------- by jmikola at 2012-02-06T20:05:30Z @schmittjoh: Please let me know your thoughts on the last commit. I think it would be overkill to add support for another handler service and/or error page just for logout exceptions. Perhaps as an alternative, we might just want to consider an invalid CSRF token on logout imply a false return value for `LogoutListener::requiresLogout()`. That would sacrifice the ability to handle the error separately (which a 403 response allows us), although we could still add logging (currently done in ExceptionListener). --------------------------------------------------------------------------- by jmikola at 2012-02-13T17:41:33Z @schmittjoh: ping --------------------------------------------------------------------------- by fabpot at 2012-02-14T23:36:22Z @jmikola: Instead of merging symfony/master, can you rebase? --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:00:49Z Will do. --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:05:48Z ``` [avocado: symfony] logout-csrf (+9/-216) $ git rebase master First, rewinding head to replay your work on top of it... Applying: [SecurityBundle] Add functional test for form login with CSRF token Applying: [Security] Refactor LogoutListener constructor to take options Applying: [Security] Allow LogoutListener to validate CSRF tokens Applying: [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens Applying: [SecurityBundle] Fix execution of functional tests with different names Applying: [SecurityBundle] Use assertCount() in tests Using index info to reconstruct a base tree... Falling back to patching base and 3-way merge... Applying: [Security] Use LogoutException for invalid CSRF token in LogoutListener [avocado: symfony] logout-csrf (+7) $ git st # On branch logout-csrf # Your branch and 'origin/logout-csrf' have diverged, # and have 223 and 9 different commit(s) each, respectively. # nothing to commit (working directory clean) [avocado: symfony] logout-csrf (+7) $ ``` After rebasing, my merge commits disappeared. Is this normal? --------------------------------------------------------------------------- by stof at 2012-02-15T00:15:07Z Are you sure they disappeared ? Diverging from the remote branch is logical (you rewrote the history and so changed the commit id) but are you sure it does not have the commits on top of master ? Try ``git log master..logout-scrf`` If your commut are there, you simply need to force the push for the logout-csrf branch (take care to push only this branch during the force push to avoid messing all others as git won't warn you when asking to force) --------------------------------------------------------------------------- by stof at 2012-02-15T00:17:09Z ah sorry, you talked only about the merge commit. Yeah it is normal. When reapplying your commits on top of master, the merge commit are not kept as you are reapplying the changes linearly on top of the other branch (and deleting the merge commit was the reason why @fabpot asked you to rebase instead of merging btw) --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:18:00Z The merge commits are not present in `git log master..logout-csrf`. Perhaps it used those merge commits when rebasing, as there were definitely conflicts resolved when I originally merged in symfony/master (@fabpot had made his own changes to LogoutListener). I'll force-push the changes to my PR brange. IIRC, GitHub is smart enough to preserve inline diff comments, provided they were made through the PR and not on the original commits. --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:19:38Z That worked well. In the future, I think I'll stick to merging upstream in and then rebasing afterwards. Resolving conflicts is much easier during a merge than interactive rebase. --------------------------------------------------------------------------- by jmikola at 2012-02-23T18:46:13Z @fabpot @schmittjoh: Is there anything else I can do for this PR? I believe the exception was the only outstanding question (see: [this comment](https://github.com/symfony/symfony/pull/3007#issuecomment-3835716)).
| * | [Security] Use LogoutException for invalid CSRF token in LogoutListenerJeremy Mikola2012-02-142-2/+11
| | | | | | | | | | | | | | | | | | On the advice of @schmittjoh, this commit adds a LogoutException class for use by LogoutListener if the CSRF token is invalid. The handling in the Security component's ExceptionListener is modeled after AccessDeniedException, which gets wrapped in an AccessDeniedHttpException in the absence of handler service or error page (I didn't think it was appropriate to re-use those for LogoutException).
| * | [Security] Allow LogoutListener to validate CSRF tokensJeremy Mikola2012-02-141-10/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds several new options to the logout listener, modeled after the form_login listener: * csrf_parameter * intention * csrf_provider The "csrf_parameter" and "intention" have default values if omitted. By default, "csrf_provider" is empty and CSRF validation is disabled in LogoutListener (preserving BC). If a service ID is given for "csrf_provider", CSRF validation will be enabled. Invalid tokens will result in an InvalidCsrfTokenException being thrown before any logout handlers are invoked.
| * | [Security] Refactor LogoutListener constructor to take optionsJeremy Mikola2012-02-141-9/+9
| | | | | | | | | | | | This will facilitate adding additional options for CSRF protection. Additionally, a unit test for existing behavior was added.
* | | [Security] added support for the remember_me parameter in the query (closes ↵Fabien Potencier2012-03-021-1/+1
| | | | | | | | | | | | #3460)
* | | [Security] added AccessMapInterfaceKris Wallsmith2012-02-154-5/+38
|/ /
* | Authentication(Success|Failure)Handler can now return nullOlivier Dolbeau2012-01-243-4/+8
| |
* | [Security] made the logout path check configurableFabien Potencier2011-12-231-1/+18
| |
* | merged 2.0Fabien Potencier2011-12-181-1/+1
|\ \ | |/
| * fixed CSFabien Potencier2011-12-181-1/+1
| |
* | merged 2.0Fabien Potencier2011-12-137-2/+13
|\ \ | |/
| * [DoctrineBridge] fixed some CSFabien Potencier2011-12-1311-2/+25
| |
* | added check for invalid user providersKris Wallsmith2011-12-051-0/+7
| |
* | merged branch jmikola/2.0-LoaderResolverInterface (PR #2785)Fabien Potencier2011-12-051-0/+4
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 7c1cbb9 [Config] Use LoaderResolverInterface for type-hinting 48b084e fixed typo 8ad94fb merged branch hhamon/doctrine_bridge_cs (PR #2775) 240796e [Bridge] [Doctrine] fixed coding conventions. 7cfc392 check for session before trying to authentication details 648fae7 merged branch proofek/domcrawlerform-radiodisabled (PR #2768) 3976b7a [DoctrineBridge] fixed CS 9a04783 merged branch beberlei/SecurityEntityRepositoryIdentifierFix (PR #2765) 3c83b89 [DoctrineBridge] Catch user-error when the identifier is not serialized with the User entity. 36c7d03 Fixed GH-2720 - Fix disabled atrribute handling for radio form elements Discussion ---------- [Config] Use LoaderResolverInterface for type-hinting ``` Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Fixes the following tickets: - ``` I've listed this as a BC break because we're changing the argument type-hint, but I think it's unlikely to affect anyone.
| * check for session before trying to authentication detailsMatt Lehner2011-12-021-0/+4
| |
* | removed unused use statementsFabien Potencier2011-11-241-1/+0
| |
* | merged 2.0Fabien Potencier2011-11-246-6/+0
|\ \ | |/
| * removed unused use statementsFabien Potencier2011-11-246-6/+0
| |
* | changed priorities for kernel.request listenersFabien Potencier2011-11-171-19/+0
| | | | | | | | | | | | | | The Firewall is now executed after the Router. This was needed to have access to the locale and other request attributes that are set by the Router. This change implies that all Firewall specific URLs have proper (empty) routes like `/login_check` and `/logout`.
* | merged branch snc/login-referer (PR #2518)Fabien Potencier2011-11-171-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- f9a65ba Redirect to default_target_path if use_referer is true and the referer is the login_path. Discussion ---------- Login redirect Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Redirect to default_target_path if use_referer is true and the referer is the login_path. --------------------------------------------------------------------------- by Seldaek at 2011/10/30 10:52:38 -0700 :+1: --------------------------------------------------------------------------- by stealth35 at 2011/10/30 11:04:16 -0700 @snc BC break ? --------------------------------------------------------------------------- by snc at 2011/10/30 12:11:39 -0700 Well I'm sure it is never intended by a developer to be redirected to the login page after logging in but it could be possible that the controller which displays the login form handles this case, so my change would break it.
| * | Redirect to default_target_path if use_referer is true and the referer is ↵Henrik Westphal2011-10-301-1/+1
| | | | | | | | | | | | the login_path.
* | | Merge branch '2.0'Fabien Potencier2011-11-141-1/+5
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | * 2.0: [HttpKernel] fixed Content-Length header when using ESI tags (closes #2623) [HttpFoundation] added an exception to MimeTypeGuesser::guess() when no guesser are available (closes #2636) [Security] fixed HttpUtils::checkRequestPath() to not catch all exceptions (closes #2637) [DoctrineBundle] added missing default parameters, needed to setup and use DBAL without ORM [Transation] Fix grammar. [TwigBundle] Fix trace to not show 'in at line' when file/line are empty.
| * | [Security] fixed HttpUtils::checkRequestPath() to not catch all exceptions ↵v2.0.6Fabien Potencier2011-11-141-1/+5
| | | | | | | | | | | | (closes #2637)
* | | merged branch snc/issue-1798-sf21 (PR #2598)Fabien Potencier2011-11-101-2/+1
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 4d80ebd Remove security token if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). Discussion ---------- [2.1] Fix for issue 1798 Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1798 This is a simplified PR of #2528 for the master branch.
| * | | Remove security token if user was deleted, is disabled or locked to prevent ↵H. Westphal2011-11-101-0/+6
| | | | | | | | | | | | | | | | infinite redirect loops to the login path (fixes #1798).
* | | | Merge branch '2.0'Fabien Potencier2011-11-101-0/+8
|\ \ \ \ | |/ / / |/| / / | |/ / | | | | | | | | | * 2.0: Added a class to the logs ol element to prevent hiding it when toggling an exception (fixes #2589). Remove only the security token instead of the session cookie. Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798).
| * | merged branch snc/issue-1798 (PR #2528)Fabien Potencier2011-11-101-0/+8
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- f9befb6 Remove only the security token instead of the session cookie. 348bccb Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). Discussion ---------- Fix for issue 1798 Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). --------------------------------------------------------------------------- by snc at 2011/11/01 04:01:49 -0700 @stof I have changed the code so that it only removes the token... do we still need any hook support? --------------------------------------------------------------------------- by stof at 2011/11/01 04:07:17 -0700 well, the hook is for your own use case but it would be for 2.1 only anyway, not for 2.0 --------------------------------------------------------------------------- by snc at 2011/11/07 15:11:52 -0800 Now that #2414 is merged to 2.1, this could be simplified for the master branch...
| | * | Remove only the security token instead of the session cookie.H. Westphal2011-11-011-7/+6
| | | |
| | * | Clear session cookie if user was deleted, is disabled or locked to prevent ↵H. Westphal2011-10-311-1/+10
| | | | | | | | | | | | | | | | infinite redirect loops to the login path (fixes #1798).
* | | | merged 2.0Fabien Potencier2011-11-081-1/+1
|\ \ \ \ | |/ / /
| * | | [Security] Fix checkRequestPath doc; closes #2323Jeremy Mikola2011-11-071-1/+1
| | | |
* | | | merged branch dpb587/patch-sectok (PR #2414)Fabien Potencier2011-11-071-7/+7
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- ab9caa0 [Security] Check for request's session before attempting writes. dabff0e [Security] Support removing tokens from a session. Discussion ---------- [Security] Support removing tokens from a session. Currently there is no way to remove a session's security token without invalidating the entire session and all its data (the ContextListener will only update the session if a token is non-null and non-anonymous). This patch fixes that. I consider this a bug and I found no tests to prove otherwise. Let me know if I'm mistaken. Originally mentioned at https://groups.google.com/d/topic/symfony-devs/ojLvh0WUbfo/discussion Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: - --------------------------------------------------------------------------- by ms937 at 2011/10/24 05:19:21 -0700 This change looks good to me. In fact I'm using similar patch in my app and it works as intended. Also, several other people requested this on the mailing list. Could someone from Symfony team merge this? Thanks.
| * | | | [Security] Check for request's session before attempting writes.Danny Berger2011-10-251-1/+3
| | | | |
| * | | | [Security] Support removing tokens from a session.Danny Berger2011-10-141-9/+7
| | | | |
* | | | | merged 2.0Fabien Potencier2011-11-071-1/+1
|\ \ \ \ \ | | |/ / / | |/| | / | |_|_|/ |/| | |
| * | | replace occurences of "an UserInteface" with "a UserInterface"Igor Wiedler2011-11-031-1/+1
| | |/ | |/|
* | | merged 2.0Fabien Potencier2011-10-297-11/+0
|\ \ \ | |/ /
| * | removed unused use statementsFabien Potencier2011-10-297-11/+0
| |/
* | moved management of the locale from the Session class to the Request classFabien Potencier2011-10-081-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The locale management does not require sessions anymore. In the Symfony2 spirit, the locale should be part of your URLs. If this is the case (via the special _locale request attribute), Symfony will store it in the request (getLocale()). This feature is now also configurable/replaceable at will as everything is now managed by the new LocaleListener event listener. How to upgrade: The default locale configuration has been moved from session to the main configuration: Before: framework: session: default_locale: en After: framework: default_locale: en Whenever you want to get the current locale, call getLocale() on the request (was on the session before).
* | Removed redundant "@return void"-sHelmer Aaviksoo2011-10-078-14/+0
|/
* merged branch helmer/target_path (PR #2228)Fabien Potencier2011-09-251-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 022a9a7 [Security] Make saving target_path extendible Discussion ---------- [Security] Make saving target_path extendible The problem lies in how Security component handles ``target_path`` - the latest request URI is always stored. This can lead to problems in following scenarios: a) The response type of the request is not HTML (think JSON, XML ..) b) The URI matches a route that does not listen to HTTP GET I opened a [PR](https://github.com/symfony/symfony/pull/604) months ago, to partly solve scenario A, which did not make it. Now I am proposing a different solution - user can extend ``ExceptionListener`` and override the logic behind setting the ``target_path`` to match his precise needs. In my simplified scenario, I would be using: ``` protected function setTargetPath(Request $request) { if ($request->isXmlHttpRequest() || 'GET' !== $request->getMethod()) { return; } $request->getSession()->set('_security.target_path', $request->getUri()); } ``` @Seldaek, @schmittjoh, @lsmith77, thoughts? --------------------------------------------------------------------------- by Seldaek at 2011/09/21 02:37:02 -0700 Seems like a better solution for flexibility's sake. Would be quite awesome if you could add a cookbook entry to symfony/symfony-docs about this, otherwise I'm afraid we'll have to explain it over and over again :) --------------------------------------------------------------------------- by helmer at 2011/09/21 03:38:57 -0700 [Cookbook](https://github.com/helmer/symfony-docs/commit/b22c5e666edb2586840884e32f8209425125c30d) entry done. Perhaps though I rushed ahead .. --------------------------------------------------------------------------- by Seldaek at 2011/09/21 03:52:01 -0700 Thanks. You can already do a pull request against symfony-docs, just reference this pull request in it so it's not merged before this is merged.
* Fixed the creation of the subrequestsChristophe Coevoet2011-09-181-0/+3
| | | | | | The subrequest must be created using an absolute path to keep the informations about the host and the base path. Closes #2168
* Added missing method to HTTP Digest entry pointStefano Sala2011-09-061-0/+10
|
* increased visibility of httpUtils propertyJohannes Schmitt2011-08-181-1/+2
|
* Using the $status parameter instead of fixed value when creating a ↵v2.0.0Henrik Westphal2011-07-241-1/+1
| | | | RedirectResponse.
* fixes #1659Johannes Schmitt2011-07-191-0/+5
|
* fixes several bugsJohannes Schmitt2011-07-191-15/+42
|
* merged branch schmittjoh/abstractAuthenticationListener (PR #1683)Fabien Potencier2011-07-131-8/+8
|\ | | | | | | | | | | | | | | | | | | | | | | Commits ------- 29e4063 [Security] changed order of checks to check for more specific things first Discussion ---------- [Security] changed order of checks
| * [Security] changed order of checks to check for more specific things firstJohannes Schmitt2011-07-131-8/+8
| |
* | [Security] fixes #1329Johannes Schmitt2011-07-131-1/+1
| |
* | Added a AccessDeniedHttpException to wrap the AccessDeniedException.Christophe Coevoet2011-07-111-5/+6
| | | | | | | | See #1631
* | [Security] fixed redirection URLs when using {_locale} in the patternFabien Potencier2011-07-111-0/+13
| |
* | [Security] tweaked previous commitFabien Potencier2011-07-051-0/+1
| |
* | [Security] removed a hackFabien Potencier2011-07-051-9/+14
| |
* | [Security] reverted change from previous mergeFabien Potencier2011-07-041-0/+6
| |
* | merged branch Herzult/testSecurity (PR #1447)Fabien Potencier2011-07-043-10/+2
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 164aea4 [Security] Add tests for the channel listener d51cbc0 [Security] Remove useless attribute in basic authentication listener & test it 91e6dc9 [Security] Add tests for the anonymous authentication listener 3c2affb [Security] Update access listener constructor's prototype and add tests 81afd77 [Security] Add tests for the firewall map aa6ae33 [Security] Remove useless attribute & var in firewall Discussion ---------- Test security --------------------------------------------------------------------------- by lsmith77 at 2011/06/29 13:41:07 -0700 @schmittjoh is probably the person to review this change ..
| * [Security] Remove useless attribute in basic authentication listener & test itAntoine Hérault2011-06-261-6/+0
| |
| * [Security] Update access listener constructor's prototype and add testsAntoine Hérault2011-06-261-2/+2
| |
| * [Security] Remove useless attribute & var in firewallAntoine Hérault2011-06-251-2/+0
| |
* | [Security] Fix http retry authentication entry pointAntoine Hérault2011-06-251-1/+1
| |
* | [Security] Fix http form authentication entry pointAntoine Hérault2011-06-251-1/+1
| |
* | [Security] Fix http digest authentication entry pointAntoine Hérault2011-06-251-1/+1
|/
* [Security] Fix http basic authentication entry pointAntoine Hérault2011-06-251-1/+1
|
* [Security] added an HttpUtils class to manage logic related to Requests and ↵Fabien Potencier2011-06-226-30/+135
| | | | | | | | | | | | | | Responses This change removes the need for the {_locale} hack. Now, all paths in the Security component can be: * An absolute path (/login) * An absolute URL (http://symfony.com/login) * A route name (login) So, if you want to use a path that includes a global parameter (like _locale), use a route instead of a path.
* Renamed core.* events to kernel.* and CoreEvents to KernelEventsJordi Boggiano2011-06-216-11/+8
|
* [Security] renamed UserProviderInterface::loadUser() to refreshUser()Fabien Potencier2011-06-161-1/+1
|
* made some tweaks to error levelsFabien Potencier2011-06-154-7/+7
|
generated by cgit v1.1 at 2025-05-18 06:04:45 +0000