summaryrefslogtreecommitdiffstats
path: root/Http
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '2.3' into 2.4Fabien Potencier2013-12-291-57/+56
|\ | | | | | | | | | | | | | | | | | | | | * 2.3: [Security] made code easier to understand, added some missing unit tests [DependencyInjection] fixed InlineServiceDefinitionsPass to not inline a service if it's part of the current definition (to avoid an infinite loop) [DomCrawler] Fixed creating form objects from form nodes. disabled php.ini changes when using HHVM in .travis.yml [Process] fixed HHVM support Add support for HHVM in the getting of the PHP executable [Security] fixed error 500 instead of 403 if previous exception is provided to AccessDeniedException
| * [Security] made code easier to understand, added some missing unit testsFabien Potencier2013-12-291-75/+58
| |
| * [Security] fixed error 500 instead of 403 if previous exception is provided ↵Tomasz Szymczyk2013-12-281-51/+67
| | | | | | | | to AccessDeniedException
* | Merge branch '2.3' into 2.4Fabien Potencier2013-12-282-3/+3
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed typos Fixed deprecated method calls Add testing against HHVM at Travis-CI Fixed typo Fixed typo fixed acronyms [Validator] Fixed IBAN validator with 0750447346 value Conflicts: src/Symfony/Component/HttpKernel/Debug/TraceableEventDispatcher.php
| * fixed acronymsFabien Potencier2013-12-282-3/+3
| |
* | Merge branch '2.3' into 2.4Fabien Potencier2013-12-281-2/+2
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed a typo fixed CS for lambdas [Yaml] fixed some license headers Fixes message value for objects Check for hour, minute & second validity fixed various typos [Filesystem] Fixed mirror for symlinks [Validator] Removed duplicated test for IBAN in data provider Conflicts: src/Symfony/Bundle/FrameworkBundle/Command/ContainerDebugCommand.php src/Symfony/Component/Console/Application.php src/Symfony/Component/Debug/Tests/ErrorHandlerTest.php src/Symfony/Component/Filesystem/Tests/FilesystemTest.php src/Symfony/Component/HttpKernel/Tests/DependencyInjection/ContainerAwareHttpKernelTest.php
| * fixed various typosFabien Potencier2013-12-271-2/+2
| |
* | Merge branch '2.3' into 2.4Fabien Potencier2013-12-261-3/+4
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: (31 commits) Fix parent serialization of user object [DependencyInjection] fixed typo add memcache, memcached, and mongodb extensions to run skipped tests [DependencyInjection] Fixed support for backslashes in service ids. fix #9356 [Security] Logger should manipulate the user reloaded from provider [BrowserKit] fixes #8311 CookieJar is totally ignorant of RFC 6265 edge cases [HttpFoundation] fixed constants that do exist in 2.3 (only in 2.4) fix 5528 let ArrayNode::normalizeValue respect order of value array provided fix #7243 allow 0 as arraynode name Fixed issue in BaseDateTimeTransformer when invalid timezone cause Transformation filed exception (closes #9403). BinaryFileResponse should also return 416 or 200 on some range-requets Do normalization on tag options bumped Symfony version to 2.3.9 updated VERSION for 2.3.8 update CONTRIBUTORS for 2.3.8 updated CHANGELOG for 2.3.8 [Filesystem] Changed the mode for a target file in copy() to be write only. [Console] fixed CS fixed TableHelper when cell value has new line Improved and fixed grammar mistakes. Added pluralized messages ... Conflicts: src/Symfony/Component/BrowserKit/Cookie.php src/Symfony/Component/HttpKernel/Kernel.php src/Symfony/Component/Routing/Matcher/UrlMatcher.php
| * fix #9356 [Security] Logger should manipulate the user reloaded from providerMatthieu Auger2013-12-201-3/+4
| |
* | Merge branch '2.3' into 2.4v2.4.0Fabien Potencier2013-11-262-2/+2
|\ \ | |/ | | | | | | | | | | | | | | | | | | * 2.3: Fixed mistake in upgrade docu Container::camelize also takes backslashes into consideration fixed typos fixed @expectedException class names fixed some typos fixed @expectedException class names Typo and better wording for german validator translation
* | minor #9487 unify constructor initialization style throughout symfony (Tobion)Fabien Potencier2013-11-224-33/+32
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- unify constructor initialization style throughout symfony | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | n/a In almost all classes symfony uses property initialization when the value is static. Constructor initialization is only used for things that actually have logic, like passed parameters or dynamic values. IMHO it makes the code much more readable because property definition, phpdoc and default value is in one place. Also one can easily see what the constructor implements for logic like overridden default value of a parent class. Otherwise the real deal is just hidden behind 10 property initializations. One more advantage is that it requires less code. As you can see, the code was almost cut in half (210 additions and 395 deletions). I unified it accordingly across symfony. Sometimes it was [not even consistent within one class](https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Config/Definition/BaseNode.php#L32). At the same time I recognized some errors like missing parent constructor call, or undefined properties or private properties that are not even used. I then realized that a few Kernel tests were not passing because they were deeply implementation specific like modifying booted flag with a custom `KernelForTest->setIsBooted();`. I improved and refactored the kernel tests in the __second commit__. __Third commit__ unifies short ternary operator, e.g. `$foo ?: new Foo()`. __Forth commit__ unifies missing parentheses, e.g. `new Foo()`. Commits ------- 077a089 unify missing parentheses 2888594 unify short ternary operator 2a9daff [HttpKernel] better written kernel tests 111ac18 unify constructor initialization style throughout symfony
| * | unify missing parenthesesTobias Schultze2013-11-143-31/+31
| | |
| * | unify constructor initialization style throughout symfonyTobias Schultze2013-11-111-2/+1
| | |
* | | [Security] Added a missing field in SimpleAuthenticationHandlerJakub Zalas2013-11-212-0/+193
|/ /
* | minor #9427 adjust doctrine dependencies (Tobion)Fabien Potencier2013-11-092-19/+16
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- adjust doctrine dependencies | Q | A | ------------- | --- | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #9384, #9385 | License | MIT | Doc PR | - I went through all components/bundles/bridges in symfony and searched for doctrine dependencies. Then looked if it only requires a subset (annotations instead of common for example). Commits ------- 7366901 adjust doctrine dependencies
| * | adjust doctrine dependenciesTobias Schultze2013-11-072-19/+16
| | |
* | | Fix bug with variable named context to securityContext in ↵mieszko42013-11-051-1/+1
|/ / | | | | | | SimplePreAuthenticationListener->handle function
* | Merge branch '2.3'Fabien Potencier2013-10-301-1/+1
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed CS fixed CS [HttpKernel] fixed memory limit display in MemoryDataCollector Fixed the error handling when decoding invalid XML to avoid a Warning [Form] Fixed: The "data" option is taken into account even if it is NULL [DomCrawler] [HttpFoundation] Make `Content-Type` attributes identification case-insensitive Conflicts: src/Symfony/Bundle/FrameworkBundle/Tests/Templating/TimedPhpEngineTest.php
| * Merge branch '2.2' into 2.3v2.3.7Fabien Potencier2013-10-301-1/+1
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: fixed CS Fixed the error handling when decoding invalid XML to avoid a Warning [Form] Fixed: The "data" option is taken into account even if it is NULL [DomCrawler] [HttpFoundation] Make `Content-Type` attributes identification case-insensitive Conflicts: src/Symfony/Component/Form/Extension/Core/Type/FormType.php
| | * fixed CSv2.2.10Fabien Potencier2013-10-301-1/+1
| | |
* | | Merge branch '2.3'Fabien Potencier2013-10-181-1/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | * 2.3: [DoctrineBridge] Added type check to prevent calling clear() on arrays [Intl] Improved FormTypeCsrfExtension to use the type class as default intention if the form name is empty Fix docblock typo
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-10-181-1/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [DoctrineBridge] Added type check to prevent calling clear() on arrays [Intl] Improved FormTypeCsrfExtension to use the type class as default intention if the form name is empty Fix docblock typo Conflicts: src/Symfony/Component/Form/Extension/Csrf/Type/FormTypeCsrfExtension.php
| | * Fix docblock typoAdrien Brault2013-10-171-1/+1
| | |
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-10-171-1/+0
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [DoctrineBridge] Loosened CollectionToArrayTransformer::transform() to accept arrays Removed unused use statements. Make usleep longer and simplify assertions Added japanese translation resource for security component. [Yaml] Fixed the escaping of strings starting with a dash when dumping Fix in ChainLoader.php fixed wrong started states
| | * Removed unused use statements.Hugo Hamon2013-10-161-1/+0
| | |
* | | Removed dead code (unused use statements).Hugo Hamon2013-10-161-1/+0
| | |
* | | [Security\Csrf] Split CsrfTokenGenerator into CsrfTokenManager and ↵v2.4.0-BETA1Bernhard Schussek2013-10-073-24/+54
| | | | | | | | | | | | TokenGenerator
* | | Merge branch '2.3'Fabien Potencier2013-10-011-1/+0
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Fix: duplicate usage of Symfony\Component\HttpFoundation\Response [Form] add support for Length and Range constraint in order to replace MaxLength, MinLength, Max and Min constraints in next release (2.3) Revert "merged branch Tobion/flattenexception (PR #9111)" [Form] check the required output timezone against the actual timezone of the input datetime object, rather than the expected timezone supplied Conflicts: src/Symfony/Component/HttpKernel/EventListener/ExceptionListener.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-10-011-1/+0
| |\ \ | | |/ | | | | | | | | | * 2.2: Fix: duplicate usage of Symfony\Component\HttpFoundation\Response
| | * Fix: duplicate usage of Symfony\Component\HttpFoundation\Responsesimpson2013-10-011-1/+0
| | |
* | | feature#8957 [HttpFoundation] added a way to override the Request class (fabpot)Fabien Potencier2013-10-011-1/+1
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [HttpFoundation] added a way to override the Request class | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #7461, #7453 | License | MIT | Doc PR | symfony/symfony-docs#3021 This is an alternative implementation for #7461. I've also reverted #7381 and #7390 as these changes are not needed anymore. Todo: - [ ] add some tests Commits ------- 464439d [HttpFoundation] added a way to override the Request class
| * | | [HttpFoundation] added a way to override the Request classFabien Potencier2013-09-301-1/+1
| | | |
* | | | feature#6554 [Security] Added Security\Csrf sub-component with better token ↵Fabien Potencier2013-09-304-25/+27
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | generation (bschussek) This PR was merged into the master branch. Discussion ---------- [Security] Added Security\Csrf sub-component with better token generation | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | TODO **Update September 27, 2013** This PR simplifies the CSRF mechanism to generate completely random tokens. A random token is generated once per ~~intention~~ token ID and then stored in the session. Tokens are valid until the session expires. Since the CSRF token generator depends on `StringUtils` and `SecureRandom` from Security\Core, and since Security\Http currently depends on the Form component for token generation, I decided to add a new Security\Csrf sub-component that contains the improved CSRF token generator. Consequences: * Security\Http now depends on Security\Csrf instead of Form * Form now optionally depends on Security\Csrf * The configuration for the "security.secure_random" service and the "security.csrf.*" services was moved to FrameworkBundle to guarantee BC In the new Security\Csrf sub-component, I tried to improve the naming where I could do so without breaking BC: * CSRF "providers" are now called "token generators" * CSRF "intentions" are now called "token IDs", because that's really what they are ##### TODO - [ ] The documentation needs to be checked for references to the configuration of the application secret. Remarks that the secret is used for CSRF protection need to be removed. - [ ] Add aliases "csrf_token_generator" and "csrf_token_id" for "csrf_provider" and "intention" in the SecurityBundle configuration - [x] Make sure `SecureRandom` never blocks for `CsrfTokenGenerator` Commits ------- 7f02304 [Security] Added missing PHPDoc tag 2e04e32 Updated Composer dependencies to require the Security\Csrf component where necessary bf85e83 [FrameworkBundle][SecurityBundle] Added service configuration for the new Security CSRF sub-component 2048cf6 [Form] Deprecated the CSRF implementation and added an optional dependency to the Security CSRF sub-component instead 85d4959 [Security] Changed Security HTTP sub-component to depend on CSRF sub-component instead of Form 1bf1640 [Security] Added CSRF sub-component
| * | | | Updated Composer dependencies to require the Security\Csrf component where ↵Bernhard Schussek2013-09-301-0/+1
| | | | | | | | | | | | | | | | | | | | necessary
| * | | | [Security] Changed Security HTTP sub-component to depend on CSRF ↵Bernhard Schussek2013-09-274-25/+26
| | | | | | | | | | | | | | | | | | | | sub-component instead of Form
* | | | | Merge branch '2.3'Fabien Potencier2013-09-2918-12/+84
|\ \ \ \ \ | |/ / / / |/| | / / | | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed Client when using the terminable event Fix problem with Windows file links (backslash in JavaScript string) [Security] fixed wrong phpdoc [DependencyInjection] Prevented inlining of lazy loaded private service definitions. [Routing] removed extra argument [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted). Added doc comments Conflicts: src/Symfony/Component/Routing/Router.php src/Symfony/Component/Security/Http/Firewall.php
| * | | Merge branch '2.2' into 2.3Fabien Potencier2013-09-2918-12/+84
| |\ \ \ | | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: fixed Client when using the terminable event Fix problem with Windows file links (backslash in JavaScript string) [Security] fixed wrong phpdoc [Routing] removed extra argument [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted). Added doc comments Conflicts: src/Symfony/Component/HttpFoundation/Request.php
| | * | [Security] fixed wrong phpdocFabien Potencier2013-09-271-3/+1
| | | |
| | * | Added doc commentsPiotr Antosik2013-09-1918-10/+84
| | | |
* | | | Merge branch '2.3'Fabien Potencier2013-09-222-5/+2
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [Locale] added support for the position argument to NumberFormatter::parse() [Locale] added some more stubs for the number formatter [Yaml] fixed typo [Yaml] fixed a test on PHP < 5.4 [DomCrawler]Crawler guess charset from html fixed PHP 5.3 compatibility [Yaml] reverted previous merge partially (refs #8897) [Security] remove unused logger [Security] fix typo [Yaml] Fixed filename in the ParseException message
| * | | Merge branch '2.2' into 2.3Fabien Potencier2013-09-222-5/+2
| |\ \ \ | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [Locale] added support for the position argument to NumberFormatter::parse() [Locale] added some more stubs for the number formatter [Yaml] fixed typo [Yaml] fixed a test on PHP < 5.4 [DomCrawler]Crawler guess charset from html fixed PHP 5.3 compatibility [Yaml] reverted previous merge partially (refs #8897) [Security] remove unused logger [Security] fix typo [Yaml] Fixed filename in the ParseException message Conflicts: src/Symfony/Component/Console/Input/InputDefinition.php src/Symfony/Component/Locale/Stub/StubNumberFormatter.php src/Symfony/Component/Locale/Tests/Stub/StubNumberFormatterTest.php
| | * | merged branch Tobion/security-fix-typo (PR #9069)v2.2.8v2.2.7Fabien Potencier2013-09-192-5/+2
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the 2.2 branch. Discussion ---------- [Security] fix typo and remove unused logger | Q | A | ------------- | --- | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | License | MIT Commits ------- a33cc51 [Security] remove unused logger 62de9c1 [Security] fix typo
| | | * | [Security] remove unused loggerTobias Schultze2013-09-181-4/+1
| | | | |
| | | * | [Security] fix typoTobias Schultze2013-09-181-1/+1
| | | | |
* | | | | merged branch fabpot/expression-engine (PR #8913)Fabien Potencier2013-09-191-3/+3
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- New Component: Expression Language | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #8850, #7352 | License | MIT | Doc PR | not yet TODO: - [ ] write documentation - [x] add tests for the new component - [x] implement expression support for access rules in the security component - [x] find a better character/convention for expressions in the YAML format - [x] check the performance of the evaluation mode - [x] better error messages in the evaluation mode - [x] add support in the Routing - [x] add support in the Validator The ExpressionLanguage component provides an engine that can compile and evaluate expressions. An expression is a one-liner that returns a value (mostly, but not limited to, Booleans). It is a strip-down version of Twig (only the expression part of it is implemented.) Like Twig, the expression is lexed, parsed, and compiled/evaluated. So, it is immune to external injections by design. If we compare it to Twig, here are the main big differences: * only support for Twig expressions * no ambiguity for calls (foo.bar is only valid for properties, foo['bar'] is only valid for array calls, and foo.bar() is required for method calls) * no support for naming conventions in method calls (if the method is named getFoo(), you must use getFoo() and not foo()) * no notion of a line for errors, but a cursor (we are mostly talking about one-liners here) * removed everything specific to the templating engine (like output escaping or filters) * no support for named arguments in method calls * only one extension point with functions (no possibility to define new operators, ...) * and probably even more I don't remember right now * there is no need for a runtime environment, the compiled PHP string is self-sufficient An open question is whether we keep the difference betweens arrays and hashes. The other big difference with Twig is that it can work in two modes (possible because of the restrictions described above): * compilation: the expression is compiled to PHP and is self-sufficient * evaluation: the expression is evaluated without being compiled to PHP (the node tree produced by the parser can be serialized and evaluated afterwards -- so it can be saved on disk or in a database to speed up things when needed) Let's see a simple example: ```php $language = new ExpressionLanguage(); echo $language->evaluate('1 + 1'); // will echo 2 echo $language->compile('1 + 2'); // will echo "(1 + 2)" ``` The language supports: * all basic math operators (with precedence rules): * unary: not, !, -, + * binary: or, ||, and, &&, b-or, b-xor, b-and, ==, ===, !=, !==, <, >, >=, <=, not in, in, .., +, -, ~, *, /, %, ** * all literals supported by Twig: strings, numbers, arrays (`[1, 2]`), hashes (`{a: "b"}`), Booleans, and null. * simple variables (`foo`), array accesses (`foo[1]`), property accesses (`foo.bar`), and method calls (`foo.bar(1, 2)`). * the ternary operator: `true ? true : false` (and all the shortcuts implemented in Twig). * function calls (`constant('FOO')` -- `constant` is the only built-in functions). * and of course, any combination of the above. The compilation is better for performances as the end result is just a plain PHP string without any runtime. For the evaluation, we need to tokenize, parse, and evaluate the nodes on the fly. This can be optimized by using a `ParsedExpression` or a `SerializedParsedExpression` instead: ```php $nodes = $language->parse($expr, $names); $expression = new SerializedParsedExpression($expr, serialize($nodes)); // You can now store the expression in a DB for later reuse // a SerializedParsedExpression can be evaluated like any other expressions, // but under the hood, the lexer and the parser won't be used at all, so it''s much faster. $language->evaluate($expression); ``` That's all folks! I can see many use cases for this new component, and we have two use cases in Symfony that we can implement right away. ## Using Expressions in the Service Container The first one is expression support in the service container (it would replace #8850) -- anywhere you can pass an argument in the service container, you can use an expression: ```php $c->register('foo', 'Foo')->addArgument(new Expression('bar.getvalue()')); ``` You have access to the service container via `this`: container.get("bar").getvalue(container.getParameter("value")) The implementation comes with two functions that simplifies expressions (`service()` to get a service, and `parameter` to get a parameter value). The previous example can be simplified to: service("bar").getvalue(parameter("value")) Here is how to use it in XML: ```xml <parameters> <parameter key="value">foobar</parameter> </parameters> <services> <service id="foo" class="Foo"> <argument type="expression">service('bar').getvalue(parameter('value'))</argument> </service> <service id="bar" class="Bar" /> </services> ``` and in YAML (I chose the syntax randomly ;)): ```yaml parameters: value: foobar services: bar: class: Bar foo: class: Foo arguments: [@=service("bar").getvalue(parameter("value"))] ``` When using the container builder, Symfony uses the evaluator, but with the PHP dumper, the compiler is used, and there is no overhead as the expression engine is not needed at runtime. The expression above would be compiled to: ```php $this->get("bar")->getvalue($this->getParameter("value")) ``` ## Using Expression for Security Access Control Rules The second use case in Symfony is for access rules. As we all know, the way to configure the security access control rules is confusing, which might lead to insecure applications (see http://symfony.com/blog/security-access-control-documentation-issue for more information). Here is how the new `allow_if` works: ```yaml access_control: - { path: ^/_internal/secure, allow_if: "'127.0.0.1' == request.getClientIp() or has_role('ROLE_ADMIN')" } ``` This one restricts the URLs starting with `/_internal/secure` to people browsing from the localhost. Here, `request` is the current Request instance. In the expression, there is access to the following variables: * `request` * `token` * `user` And to the following functions: * `is_anonymous` * `is_authenticated` * `is_fully_authenticated` * `is_rememberme` * `has_role` You can also use expressions in Twig, which works well with the `is_granted` function: ```jinja {% if is_granted(expression('has_role("FOO")')) %} ... {% endif %} ``` ## Using Expressions in the Routing Out of the box, Symfony can only match an incoming request based on some pre-determined variables (like the path info, the method, the scheme, ...). But some people want to be able to match on more complex logic, based on other information of the Request object. That's why we introduced `RequestMatcherInterface` recently (but we no default implementation in Symfony itself). The first change I've made (not related to expression support) is implement this interface for the default `UrlMatcher`. It was simple enough. Then, I've added a new `condition` configuration for Route objects, which allow you to add any valid expression. An expression has access to the `request` and to the routing `context`. Here is how one would configure it in a YAML file: ```yaml hello: path: /hello/{name} condition: "context.getMethod() in ['GET', 'HEAD'] and request.headers.get('User-Agent') =~ '/firefox/i'" ``` Why do I keep the context as all the data are also available in the request? Because you can also use the condition without using the RequestMatcherInterface, in which case, you don't have access to the request. So, the previous example is equivalent to: ```yaml hello: path: /hello/{name} condition: "request.getMethod() in ['GET', 'HEAD'] and request.headers.get('User-Agent') =~ '/firefox/i'" ``` When using the PHP dumper, there is no overhead as the condition is compiled. Here is how it looks like: ```php // hello if (0 === strpos($pathinfo, '/hello') && preg_match('#^/hello/(?P<name>[^/]++)$#s', $pathinfo, $matches) && (in_array($context->getMethod(), array(0 => "GET", 1 => "HEAD")) && preg_match("/firefox/i", $request->headers->get("User-Agent")))) { return $this->mergeDefaults(array_replace($matches, array('_route' => 'hello')), array ()); } ``` Be warned that conditions are not taken into account when generating a URL. ## Using Expressions in the Validator There is a new Expression constraint that you can put on a class. The expression is then evaluated for validation: ```php use Symfony\Component\Validator\Constraints as Assert; /** * @Assert\Condition(condition="this.getFoo() == 'fo'", message="Not good!") */ class Obj { public function getFoo() { return 'foo'; } } ``` In the expression, you get access to the current object via the `this` variable. ## Dynamic annotations The expression language component is also very useful in annotations. the SensoLabs FrameworkExtraBundle leverages this possibility to implement HTTP validation caching in the `@Cache` annotation and to add a new `@Security` annotation (see sensiolabs/SensioFrameworkExtraBundle#238.) Commits ------- d4ebbfd [Validator] Renamed Condition to Expression and added possibility to set it onto properties a3b3a78 [Validator] added a constraint that runs an expression 1bcfb40 added optimized versions of expressions 984bd38 mades things more consistent for the end user d477f15 [Routing] added support for expression conditions in routes 86ac8d7 [ExpressionLanguage] improved performance e369d14 added a Twig extension to create Expression instances 38b7fde added support for expression in control access rules 2777ac7 [HttpFoundation] added ExpressionRequestMatcher c25abd9 [DependencyInjection] added support for expressions in the service container 3a41781 [ExpressionLanguage] added support for regexes 9d98fa2 [ExpressionLanguage] added the component
| * | | | | added support for expression in control access rulesFabien Potencier2013-09-191-3/+3
| | |_|_|/ | |/| | |
* | | | | merged branch nicolas-bastien/remove_unsued_statement (PR #9075)Fabien Potencier2013-09-192-9/+0
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [Security] Remove unused use statement Commits ------- 6981669 Remove unused use statement
| * | | | | Remove unused use statementNicolas Bastien2013-09-192-9/+0
| | | | | |
* | | | | | Merge branch '2.3'Fabien Potencier2013-09-198-1/+7
|\ \ \ \ \ \ | |/ / / / / |/| | / / / | | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: fixed phpdoc Fix some annotates [FrameworkBundle] made sure that the debug event dispatcher is used everywhere [HttpKernel] remove unneeded strtoupper updated the composer install command to reflect changes in Composer Conflicts: src/Symfony/Component/Serializer/Encoder/XmlEncoder.php
| * | | | Merge branch '2.2' into 2.3Fabien Potencier2013-09-197-0/+7
| |\ \ \ \ | | | |/ / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Fix some annotates [FrameworkBundle] made sure that the debug event dispatcher is used everywhere [HttpKernel] remove unneeded strtoupper updated the composer install command to reflect changes in Composer Conflicts: src/Symfony/Component/Console/Application.php src/Symfony/Component/Console/Command/Command.php src/Symfony/Component/Console/Input/InputDefinition.php src/Symfony/Component/CssSelector/Node/CombinedSelectorNode.php src/Symfony/Component/Form/Form.php src/Symfony/Component/HttpKernel/Debug/ErrorHandler.php src/Symfony/Component/HttpKernel/DependencyInjection/RegisterListenersPass.php src/Symfony/Component/HttpKernel/Tests/DependencyInjection/RegisterListenersPassTest.php src/Symfony/Component/Locale/Locale.php src/Symfony/Component/Locale/README.md src/Symfony/Component/Locale/Stub/DateFormat/FullTransformer.php
| | * | | Fix some annotatesbronze1man2013-09-197-0/+7
| | | |/ | | |/|
* | | | [Security] fixed README filesFabien Potencier2013-09-181-2/+2
| | | |
* | | | [Security] Split the component into 3 sub-components Core, ACL, HTTPBernhard Schussek2013-09-1834-0/+4502
| | | |
* | | | [Security] made sure that the exception listener is always removed from the ↵Fabien Potencier2013-09-082-5/+28
| |_|/ |/| | | | | | | | event dispatcher at the end of the request
* | | Merge branch '2.3'Fabien Potencier2013-09-062-1/+7
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Fixing singular form for kisses, accesses and addresses. fixed some circular references [Security] fixed a leak in ExceptionListener [Security] fixed a leak in the ContextListener Ignore posix_istatty warnings removed unused variable [Form] fix iterator typehint typos Button missing getErrorsAsString() fixes #8084 Debug: Not calling undefined method anymore. If the form contained a submit button the call would fail and the debug of the form wasn't possible. Now it will work in all cases. This fixes #8084 Use isset() instead of array_key_exists() in DIC Fixed annotation [BrowserKit] fixed method/files/content when redirecting a request [BrowserKit] removed some headers when redirecting a request [BrowserKit] fixed headers when redirecting if history is set to false (refs #8697) [HttpKernel] fixed route parameters storage in the Request data collector (closes #8867) [BrowserKit] Pass headers when `followRedirect()` is called Return BC compatibility for `@Route` parameters and default values Conflicts: src/Symfony/Component/Security/Http/Firewall/ContextListener.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-09-062-1/+7
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Fixing singular form for kisses, accesses and addresses. fixed some circular references [Security] fixed a leak in ExceptionListener [Security] fixed a leak in the ContextListener Ignore posix_istatty warnings typos [HttpKernel] fixed route parameters storage in the Request data collector (closes #8867) Return BC compatibility for `@Route` parameters and default values Conflicts: src/Symfony/Bundle/FrameworkBundle/Templating/Helper/FormHelper.php src/Symfony/Component/Console/Application.php
| | * [Security] fixed a leak in ExceptionListenerFabien Potencier2013-09-061-0/+4
| | |
| | * [Security] fixed a leak in the ContextListenerFabien Potencier2013-09-061-1/+3
| | |
* | | Merge branch '2.3'Fabien Potencier2013-08-301-2/+2
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [Security] fixed some phpdoc Fixed PHPDoc Blocks optimized circular reference checker fixed misleading doc block [HttpKernel] changed fragment URLs to be relative by default (closes #8458) Conflicts: src/Symfony/Component/HttpKernel/Fragment/RoutableFragmentRenderer.php src/Symfony/Component/HttpKernel/Tests/Fragment/RoutableFragmentRendererTest.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-08-301-2/+2
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | * 2.2: [Security] fixed some phpdoc Fixed PHPDoc Blocks optimized circular reference checker [HttpKernel] changed fragment URLs to be relative by default (closes #8458)
| | * [Security] fixed some phpdocFabien Potencier2013-08-301-2/+2
| | |
* | | merged branch vierbergenlars/patch-1 (PR #8854)Fabien Potencier2013-08-301-1/+3
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [Security] Keep other query string parameters when switching users | Q | A | ---------------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | n/a | Doc PR | n/a When switching users, the whole query string gets dropped when redirecting after the switch. I think only the switch user parameter should be dropped from the query string. Commits ------- 0a338f5 [Security] Keep other query string parameters when switching users
| * | | [Security] Keep other query string parameters when switching usersLars Vierbergen2013-08-271-1/+3
| | | |
* | | | Merge branch '2.3'Fabien Potencier2013-08-291-4/+6
|\ \ \ \ | |/ / / |/| / / | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Clear lazy loading initializer after the service is successfully initialized [FrameworkBundle] added support for double-quoted strings in the extractor (closes #8797) [SecurityBundle] Move format-dependent tests from SecurityExtensionTest bumped Symfony version to 2.3.5-DEV updated VERSION for 2.3.4 updated CHANGELOG for 2.3.4 bumped Symfony version to 2.2.7 updated VERSION for 2.2.6 update CONTRIBUTORS for 2.2.6 updated CHANGELOG for 2.2.6 clearToken exception is thrown at wrong place. fix typo in test skipped message [Form] Fixed Form::all() signature for PHP 5.3.3 [Form] Fixed Form::all() signature for PHP 5.3.3 [Locale] Fixed: Locale::setDefault() throws no exception when "en" is passed [Locale] Fixed: StubLocale::setDefault() throws no exception when "en" is passed [Translation] Grammar fix [Yaml] fixed embedded folded string parsing [Validator] fixed Boolean handling in XML constraint mappings (closes #5603) [Translation] Fixed regression: When only one rule is passed to transChoice(), this rule should be used Conflicts: src/Symfony/Component/HttpKernel/Kernel.php
| * | Merge branch '2.2' into 2.3v2.3.4Fabien Potencier2013-08-271-4/+6
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: bumped Symfony version to 2.2.7 updated VERSION for 2.2.6 update CONTRIBUTORS for 2.2.6 updated CHANGELOG for 2.2.6 clearToken exception is thrown at wrong place. Conflicts: src/Symfony/Component/HttpKernel/Kernel.php
| | * clearToken exception is thrown at wrong place.v2.2.6Xavier HAUSHERR2013-08-261-4/+6
| | |
* | | Merge branch '2.3'Fabien Potencier2013-08-221-0/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [Locale] fixed build-data exit code in case of an error fixed request format of sub-requests when explicitely set by the developer (closes #8787) Sets _format attribute only if it wasn't set previously by the user. Exclude little words of 'ee' to 'oo' plural transformation fixed the format of the request used to render an exception Fix typo in the check_path validator added a missing use statement (closes #8808) fix for Process:isSuccessful() Include untrusted host in the exception message Conflicts: src/Symfony/Component/HttpKernel/EventListener/ExceptionListener.php src/Symfony/Component/HttpKernel/Fragment/InlineFragmentRenderer.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-08-221-0/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [Locale] fixed build-data exit code in case of an error fixed request format of sub-requests when explicitely set by the developer (closes #8787) Sets _format attribute only if it wasn't set previously by the user. Exclude little words of 'ee' to 'oo' plural transformation fixed the format of the request used to render an exception Fix typo in the check_path validator added a missing use statement (closes #8808) fix for Process:isSuccessful() Conflicts: UPGRADE-3.0.md src/Symfony/Component/Locale/Resources/data/build-data.php
| | * added a missing use statement (closes #8808)Fabien Potencier2013-08-211-0/+1
| | |
* | | [HttpKernel] added $event->isMasterRequest()Kris Wallsmith2013-08-082-5/+3
| | |
* | | Merge branch '2.3'Fabien Potencier2013-08-021-0/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: moved some fixed dep versions from 2.2.* to ~2.2 (refs #8613) [HttpKernel] added a missing dep for dev [Form] fixed wrong call to setTimeZone() (closes #8644) Fix issue with \DateTimeZone::UTC / 'UTC' for PHP 5.4 [Form] Fixed patched forms to be valid even if children are not submitted Revert "[Form] Fix of "PATCH'ed forms are never valid"" [Form] Fixed: If a form is not present in a request, it is not automatically submitted Fixes link indices [Form] Removed the "disabled" attribute from the placeholder option in select fields due to problems with the BlackBerry 10 browser Revert "[Form] Remove "value" attribute on empty_value option" [routing] added ability for apache matcher to handle array values removed dead code and fixed CS [Validator] fixed StaticMethodLoader trying to invoke methods of abstract classes (closes #8589)
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-08-021-0/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [HttpKernel] added a missing dep for dev [Form] fixed wrong call to setTimeZone() (closes #8644) Fix issue with \DateTimeZone::UTC / 'UTC' for PHP 5.4 [Form] Removed the "disabled" attribute from the placeholder option in select fields due to problems with the BlackBerry 10 browser [routing] added ability for apache matcher to handle array values removed dead code and fixed CS [Validator] fixed StaticMethodLoader trying to invoke methods of abstract classes (closes #8589) Conflicts: src/Symfony/Bundle/TwigBundle/TokenParser/RenderTokenParser.php src/Symfony/Component/Form/FormConfigBuilder.php src/Symfony/Component/HttpKernel/composer.json src/Symfony/Component/Validator/Tests/GraphWalkerTest.php
| | * removed dead code and fixed CSFabien Potencier2013-07-281-0/+1
| | |
* | | Use HMAC construction for remember me cookie hashesJon Cave2013-07-211-1/+1
| | |
* | | Merge branch '2.3'Fabien Potencier2013-07-204-4/+30
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: [PropertyAccess] added moves to pluralMap [Security] fixed issue where authentication listeners clear unrelated tokens added greek translation [DependencyInjection] Add exception for service name not dumpable in PHP bumped Symfony version to 2.3.3-DEV fix issue #8499 modelChoiceList call getPrimaryKey on a non object updated VERSION for 2.3.2 updated CHANGELOG for 2.3.2 [DependencyInjection] Add exception for service name not dumpable in PHP fixed typo bumped Symfony version to 2.2.5 updated VERSION for 2.2.4 update CONTRIBUTORS for 2.2.4 updated CHANGELOG for 2.2.4 Fixed NativeSessionStorage:regenerate when does not exists removed extraneous whitespaces Conflicts: src/Symfony/Component/HttpKernel/Kernel.php
| * | Merge branch '2.2' into 2.3Fabien Potencier2013-07-204-4/+30
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: [PropertyAccess] added moves to pluralMap [Security] fixed issue where authentication listeners clear unrelated tokens fix issue #8499 modelChoiceList call getPrimaryKey on a non object [DependencyInjection] Add exception for service name not dumpable in PHP Conflicts: src/Symfony/Component/DependencyInjection/Dumper/PhpDumper.php src/Symfony/Component/DependencyInjection/Tests/Dumper/PhpDumperTest.php src/Symfony/Component/Security/Tests/Http/Firewall/BasicAuthenticationListenerTest.php
| | * [Security] fixed issue where authentication listeners clear unrelated tokensalcaeus2013-07-194-4/+30
| | | | | | | | | | | | | | | This commit fixes an issue where authentication listeners clear all security tokens in case of authentication failure. This behavior makes it impossible to combine certain authentication mechanisms, notably x509 with form-based login.
* | | Merge branch '2.3'Fabien Potencier2013-07-111-1/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.3: Reverts JSON_NUMERIC_CHECK Just a Typo [Yaml] removed wrong comment removal inside a string block Fixing configuration validation error messages. [HtppKernel] fixed inline fragment renderer fixed inline fragment renderer ProgressHelper shows percentage complete. Comment fixed: RedrawFrequency is measured in steps. fix handling of a default 'template' as a string Conflicts: src/Symfony/Component/Console/Tests/Helper/ProgressHelperTest.php
| * | Merge branch '2.2' into 2.3v2.3.2Fabien Potencier2013-07-111-1/+1
| |\ \ | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Reverts JSON_NUMERIC_CHECK Just a Typo [Yaml] removed wrong comment removal inside a string block Fixing configuration validation error messages. [HtppKernel] fixed inline fragment renderer fixed inline fragment renderer ProgressHelper shows percentage complete. Comment fixed: RedrawFrequency is measured in steps. fix handling of a default 'template' as a string Conflicts: src/Symfony/Component/Console/Helper/ProgressHelper.php src/Symfony/Component/Console/Tests/Helper/ProgressHelperTest.php src/Symfony/Component/HttpKernel/Tests/Fragment/HIncludeFragmentRendererTest.php src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php
| | * Just a Typov2.2.4Moritz Borgmann2013-07-111-1/+1
| | |
* | | Revert "marked some classes as being experimental in 2.3"Fabien Potencier2013-06-133-6/+0
| | | | | | | | | | | | This reverts commit 74cfc84c87ac281d1ed5aeb8eca9c86ae46c50cf.
* | | merged branch Seldaek/simplesecurity (PR #6069)Fabien Potencier2013-06-133-0/+338
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Discussion ---------- [Security] Add simpler customization options The goal of this is to provide a simpler extension point for people that don't have the time to dive into the whole security factory + authentication provider + user provider + authentication listener + token mess. As it stands, it gives you a way to just create one class that is handling all the security stuff in one (by implementing SimpleFormAuthenticatorInterface and UserProviderInterface) + one or more token classes. I would like feedback on whether people think this makes sense or not before continuing and doing a SimpleHttpAuthenticatorInterface for non-form based stuff. Just FYI that's how it would look in security.yml: ```yaml security: providers: simple: id: simple_authenticator firewalls: foo: pattern: ^/ simple_form: provider: simple authenticator: simple_authenticator ``` /cc @atrauzzi (who posted a long rant on the ML about how hard this all is, and I can't agree more - I hope it's the right account on github?) Commits ------- 74cfc84 marked some classes as being experimental in 2.3 471e5bc [Security] allowed simple pre-auth to be optional if another auth mechanism already authenticated the user 01c913b moved the simple HTTP authenticator to a pre-auth one 887d9b8 fixed wrong Logger interface 65335ea [Security] Renamed simple_token to simple_http, added support for failure and success handler to both simple firewalls f7a11a1 [Security] Add simple_token auth method 1fe2ed6 [Security] Add SimpleForm authentication
| * | marked some classes as being experimental in 2.3Fabien Potencier2013-05-083-0/+6
| | |
| * | [Security] allowed simple pre-auth to be optional if another auth mechanism ↵Fabien Potencier2013-05-081-0/+5
| | | | | | | | | | | | already authenticated the user
| * | moved the simple HTTP authenticator to a pre-auth oneFabien Potencier2013-05-081-6/+6
| | |
| * | fixed wrong Logger interfaceFabien Potencier2013-05-081-1/+1
| | |
| * | [Security] Renamed simple_token to simple_http, added support for failure ↵Jordi Boggiano2013-05-082-12/+133
| | | | | | | | | | | | and success handler to both simple firewalls
| * | [Security] Add simple_token auth methodJordi Boggiano2013-05-081-0/+90
| | |
| * | [Security] Add SimpleForm authenticationJordi Boggiano2013-05-081-0/+116
| | |
* | | [Security] Removed an unnecessary call to sprintf() and added a test case.Jakub Zalas2013-06-021-1/+1
|/ /
* | Merge branch '2.2'Fabien Potencier2013-05-061-2/+2
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: added additional tests to cover invalid argument exceptions in OutputFormatterStyle component added a missing check for the provider key [Validator] fixed wrong URL for XSD [Validator] Fixed: $traverse and $deep is passed to the visitor from Validator::validate() [Form] Fixed transform()/reverseTransform() to always throw TransformationFailedExceptions [Form] Fixed: String validation groups are never interpreted as callbacks if the repository method returns an array ensure that it's internal poin... [Form] Improved multi-byte handling of NumberToLocalizedStringTransformer Fix wrong method in findTaggedServiceIds(), add example to docblock. Conflicts: src/Symfony/Component/Form/Extension/Core/DataTransformer/ChoicesToBooleanArrayTransformer.php src/Symfony/Component/Form/Extension/Validator/Constraints/FormValidator.php
| * Merge branch '2.1' into 2.2Fabien Potencier2013-05-061-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: added additional tests to cover invalid argument exceptions in OutputFormatterStyle component added a missing check for the provider key [Validator] fixed wrong URL for XSD [Form] Fixed transform()/reverseTransform() to always throw TransformationFailedExceptions [Form] Fixed: String validation groups are never interpreted as callbacks if the repository method returns an array ensure that it's internal poin... Fix wrong method in findTaggedServiceIds(), add example to docblock. Conflicts: src/Symfony/Bridge/Doctrine/Form/DataTransformer/CollectionToArrayTransformer.php src/Symfony/Component/Form/Extension/Core/DataTransformer/DataTransformerChain.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ArrayToPartsTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ChoiceToValueTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ChoicesToValuesTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/DateTimeToArrayTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/DateTimeToRfc3339TransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/IntegerToLocalizedStringTransformerTest.php src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/ValueToDuplicatesTransformerTest.php
| | * added a missing check for the provider keyv2.1.10Fabien Potencier2013-05-051-2/+2
| | |
* | | Merge branch '2.2'Fabien Potencier2013-04-171-1/+1
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: Fix default value handling for multi-value options [HttpKernel] truncate profiler token to 6 chars (see #7665) Disabled APC on Travis for PHP 5.5+ as it is not available [HttpFoundation] do not use server variable PATH_INFO because it is already decoded and thus symfony is fragile to double encoding of the path Fix download over SSL using IE < 8 and binary file response [Console] Fix merging of application definition, fixes #7068, replaces #7158 [HttpKernel] fixed the Kernel when the ClassLoader component is not available (closes #7406) fixed output of bag values [Yaml] improved boolean naming ($notEOF -> !$EOF) [Yaml] fixed handling an empty value [Routing][XML Loader] Add a possibility to set a default value to null [Console] fixed handling of "0" input on ask The /e modifier for preg_replace() is deprecated in PHP 5.5; replace with preg_replace_callback() fixed handling of "0" input on ask [HttpFoundation] Fixed bug in key searching for NamespacedAttributeBag [Form] DateTimeToRfc3339Transformer use proper transformation exteption in reverse transformation Update PhpEngine.php [PropertyAccess] Add objectives to pluralMap [Security] Removed unused var [HttpFoundation] getClientIp is fixed. Conflicts: src/Symfony/Component/Console/Tests/Command/CommandTest.php src/Symfony/Component/Console/Tests/Input/ArgvInputTest.php src/Symfony/Component/HttpFoundation/Request.php src/Symfony/Component/HttpKernel/Kernel.php
| * | merged branch lyrixx/path-10 (PR #7597)Fabien Potencier2013-04-081-1/+1
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the 2.2 branch. Discussion ---------- [Security] Removed unused var | Q | A | ------------- | --- | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | I guess | Fixed tickets | - Commits ------- bd26419 [Security] Removed unused var
| | * | [Security] Removed unused varGrégoire Pineau2013-03-281-1/+1
| | | |
* | | | [CS Fix] Consistent coding-style of concatenation operator usageDariusz Górecki2013-04-021-1/+1
| | | |
* | | | Merge branch '2.2'Fabien Potencier2013-04-011-3/+4
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.2: (22 commits) fixed doc references (closes #7515) fixed doc references (closes #7515) On OS X, sys_get_tmp_dir() returns /var/private/..., which really is below /private/var. Doctrine cannot handle bare random non-utf8 strings small changes [SecurityBundle] Fixed configuration exemple idAsIndex should be true with a smallint or bigint id field. [PropertyAccess] Remove trailing periods from doc blocks Fix param docs for PropertyAccessor read method Fixed long multibyte parameter logging in DbalLogger:startQuery Keep the file extension in the temporary copy and test that it exists (closes #7482) bumped Symfony version to 2.1.10-DEV [Validator][translation][japanese]replaced period to japanese one [Validator][translation][japanese]fixed japanese translation to more practical one [Validator][translation][japanese]fixed message ordering to be consistent with other languages [Validator][translation][japanese]added new validation messages in japanese translation updated VERSION for 2.1.9 update CONTRIBUTORS for 2.1.9 updated CHANGELOG for 2.1.9 [Security] fixed wrong interface Remove already defined arguments Add missing use [FrameworkBundle] Reuse definition variable in FormPass ... Conflicts: src/Symfony/Bridge/Doctrine/Logger/DbalLogger.php src/Symfony/Bundle/WebProfilerBundle/Resources/views/Collector/config.html.twig
| * | | Doctrine cannot handle bare random non-utf8 stringsTerje Bråten2013-03-311-3/+3
| | | |
| * | | [Security] fixed wrong interfaceFabien Potencier2013-03-261-1/+1
| | | |
generated by cgit v1.1 at 2025-06-03 18:08:49 +0000