summaryrefslogtreecommitdiffstats
path: root/Http
Commit message (Collapse)AuthorAgeFilesLines
...
| | * | | [Security] remove escape charters from username provided by Digest ↵v2.0.19Sebastiaan Stok2012-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | DigestAuthenticationListener
| | * | | [Security] Fixed digest authenticationVincent Simonin2012-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Digest authentication fail if digest parameters contains `=` character or `, ` string. * Support escaped characters
| | * | | [Security] Fixed digest authenticationVincent Simonin2012-11-151-5/+6
| | | | | | | | | | | | | | | | | | | | Digest authentication fail if digest parameters contains `=` character or `, ` string.
* | | | | Try to make sure cookies get deleted from the TokenProvider when no longer ↵Terje Bråten2012-11-212-4/+8
| | | | | | | | | | | | | | | | | | | | in use
* | | | | changed the Firewall to be a proper subscriberFabien Potencier2012-11-061-1/+8
| | | | |
* | | | | changed the remember-me listener to be a proper subscriberFabien Potencier2012-11-061-1/+8
| | | | |
* | | | | [Security] removed the 401 error custom status messageFabien Potencier2012-11-062-2/+2
| |_|/ / |/| | |
* | | | merged branch acasademont/tweak_userform_security_listener (PR #5824)Fabien Potencier2012-10-281-11/+8
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR was merged into the master branch. Commits ------- 3e58893 [Security] Tweak UsernamePasswordFormAuthenticationListener Discussion ---------- [Security] Tweak UsernamePasswordFormAuthenticationListener Bug fix: no Feature addition: no Backwards compatibility break: no Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/acasademont/symfony.png)](http://travis-ci.org/acasademont/symfony) Fixes the following tickets: - Todo: - License of the code: MIT Documentation PR: - Improvements: - Do not check twice for the ```only_post``` condition. The condition in the ```attemptAuthentication``` method is useless as this method will never be called if the previous ```requiresAuthentication``` call returns false. - If the expected request is ```only_post```, check only the POST variables for the username and password parameters. Otherwise, query params and attributes are checked before. - Use POST instead of post for correctness
| * | | | [Security] Tweak UsernamePasswordFormAuthenticationListenerAlbert Casademont2012-10-231-11/+8
| | | | | | | | | | | | | | | | | | | | | | | | | - Do not check twice for the only_post condition - If the expected request is only_post, check only the post variables for the username and password parameters
* | | | | fixed CSFabien Potencier2012-10-281-7/+7
| | | | |
* | | | | added a SecureRandomInterfaceFabien Potencier2012-10-281-2/+2
| | | | |
* | | | | moved the secure random dep for remember me as a constructor argumentFabien Potencier2012-10-281-1/+13
| | | | |
* | | | | renamed Prng to SecureRandomFabien Potencier2012-10-281-7/+7
| | | | |
* | | | | moved the secure random class from JMSSecurityExtraBundle to Symfony (closes ↵Fabien Potencier2012-10-281-25/+10
| | | | | | | | | | | | | | | | | | | | #3595)
* | | | | Merge branch '2.1'Fabien Potencier2012-10-243-3/+1
|\ \ \ \ \ | |/ / / / |/| / / / | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: added missing use statment (closes #5825) Code cleanup [WebProfilerBundle] Fixed the use of nested macros Removed unused use statements. Nsdocblocks [ConfigDumpReference] avoid notice for variable nodes fixed fallback locale UniqueValidatorTest, Change message on assertions Documented removed _form_is_choice_group function Conflicts: src/Symfony/Bundle/FrameworkBundle/Command/ConfigDumpReferenceCommand.php src/Symfony/Bundle/WebProfilerBundle/Profiler/TemplateManager.php
| * | | Code cleanupv2.1.3Mario A. Alvarez Garcia2012-10-222-2/+0
| | | |
| * | | NsdocblocksDrak2012-10-201-1/+1
| | | |
* | | | Merge branch '2.1'Fabien Potencier2012-10-021-1/+1
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.1: [2.1] Fix SessionHandlerInterface autoloading Remove executable bit from HttpKernel/DependencyInjection/ConfigurableExtension.php [2.0][http-foundation] Fix Response::getDate method [DoctrineBridge] Require class option for DoctrineType [HttpFoundation] fixed the path to the SensioHandlerInterface class in composer.json Support the new Microsoft URL Rewrite Module for IIS 7.0. @see http://framework.zend.com/issues/browse/ZF-4491 @see http://framework.zend.com/code/revision.php?repname=Zend+Framework&rev=24842 fixed undefined variable hasColorSupport does not take an argument Improve FilterResponseEvent docblocks Response ref
| * | | Merge branch '2.0' into 2.1Fabien Potencier2012-10-021-1/+1
| |\ \ \ | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2.0: [2.0][http-foundation] Fix Response::getDate method Support the new Microsoft URL Rewrite Module for IIS 7.0. @see http://framework.zend.com/issues/browse/ZF-4491 @see http://framework.zend.com/code/revision.php?repname=Zend+Framework&rev=24842 fixed undefined variable hasColorSupport does not take an argument Improve FilterResponseEvent docblocks Response ref Conflicts: tests/Symfony/Tests/Component/HttpFoundation/ResponseTest.php
| | * | fixed undefined variablev2.0.18James Michael DuPont2012-09-281-1/+1
| | | |
| | * | avoid fatal error on invalid sessionv2.0.17Kris Wallsmith2012-08-071-8/+15
| | | |
| | * | fixed CS (mainly method signatures)v2.0.16Fabien Potencier2012-07-0913-18/+18
| | | |
* | | | Update ↵nervo2012-09-231-1/+1
|/ / / | | | | | | | | | | | | src/Symfony/Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php Better consistency in request method checking (See L.58)
* | | Move remember me ResponseListener from security bundle into security componentDerManoMann2012-08-301-0/+33
| | | | | | | | | | | | This move allows to implement the remember me feature in Silex without having to reference the security bundle.
* | | merged 2.0Fabien Potencier2012-08-101-8/+15
| | |
* | | [Security] tweaked previous mergeFabien Potencier2012-07-261-10/+4
| | |
* | | [Security] add docblocks to InteractiveLoginEventJonathan Ingram2012-07-261-0/+22
| | | | | | | | | Close #5053 (was easier to just create a new PR).
* | | [Security] Fixed use_referer option not working properly when login_path is ↵Albert Casademont2012-07-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a route name When use_referer is set to true and the request comes from the login page, the user should not be redirected to the login form again (the referer) but to the default_target_path. The problem arises when our login_path option is not a path but a route name, as the ```getUriForPath()``` method is not made to create routes from route names.
* | | merged branch KaipiYann/Fix-DocBlock-attemptAuthentication (PR #4996)Fabien Potencier2012-07-211-1/+1
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 134cc84 [Security] Fix DocBlock of attemptAuthentication Discussion ---------- [Security] Fix DocBlock of attemptAuthentication Bug fix: no Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: Todo: - License of the code: MIT Documentation PR: -
| * | | [Security] Fix DocBlock of attemptAuthenticationKaipi Yann2012-07-201-1/+1
| | | | | | | | | | | | | | | | Add Response as possible return type of the method because the method AbstractAuthenticationListener::handle() test if $returnValue is an instance of Response (line 148).
* | | | [Security] Extract default logout success handling logicAlexander2012-07-142-11/+52
| | | |
* | | | ensured that an exception is always converted to an error response (and that ↵Fabien Potencier2012-07-131-1/+0
| | | | | | | | | | | | | | | | we keep the HTTP status code and headers)
* | | | [Security] made sure that we always replace the security access denied ↵Fabien Potencier2012-07-131-4/+2
| | | | | | | | | | | | | | | | exception to an HTTP one
* | | | [Security] Remove hard dependency on $providerKey for default auth success ↵Alexander2012-07-121-6/+24
| | | | | | | | | | | | | | | | handler
* | | | merged branch asm89/refactor-authentication-success-handling (PR #4599)Fabien Potencier2012-07-096-79/+198
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- bb138da [Security] Fix regression after rebase. Target url should be firewall dependent eb19f2c [Security] Add note to CHANGELOG about refactored authentication failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock f9d5606 [Security] Update AuthenticationFailureHandlerInterface docblock. Never return null 915704c [Security] Move default authentication failure handling strategy to seperate class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler c6aa392 [Security] Move default authentication success handling strategy to seperate class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test Discussion ---------- [Security] Refactor authentication success handling Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=refactor-authentication-success-handling)](http://travis-ci.org/asm89/symfony) License of the code: MIT This PR extracts the default authentication success handling to its own class as discussed in #4553. In the end the PR will basically revert #3183 (as suggested by @schmittjoh) and fix point one of #838. There are a few noticeable changes in this PR: - This implementation changes the constructor signature of the `AbstractAuthentictionListener` and `UsernamePasswordFormAuthenticationListener` by making the `AuthenticationSuccessHandler` mandatory (BC break). If this WIP is approved I will refactor the failure handling logic too and then this will also move one place in the constructor - This PR reverts the change of making the returning of a `Response` optional in the `AuthenticationSuccessHandlerInterface`. Developers can now extend the default behavior themselves @schmittjoh Any suggestions? Or a +1 to do the failure logic too? --------------------------------------------------------------------------- by schmittjoh at 2012-06-17T23:53:07Z +1 from me @fabpot, what so you think? --------------------------------------------------------------------------- by fabpot at 2012-06-19T08:15:48Z Can you add a note in the CHANGELOG? Thanks. --------------------------------------------------------------------------- by asm89 at 2012-06-19T10:22:20Z I will, but I'll first do the same for the failure logic. --------------------------------------------------------------------------- by travisbot at 2012-06-21T08:03:14Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1671555) (merged 17c8f66f into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-21T08:45:38Z :+1: thank you @stof. I think this is good to go now. --------------------------------------------------------------------------- by travisbot at 2012-06-21T08:50:28Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1671817) (merged 8982c769 into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-21T14:23:58Z @schmittjoh @fabpot The `LogoutListener` currently throws an exception when the successhandler doesn't return a `Response` ([link](https://github.com/symfony/symfony/blob/9e9519913d2c5e2bef96070bcb9106e1e389c3bd/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php#L101)). Should this code check for this too? --------------------------------------------------------------------------- by schmittjoh at 2012-06-21T14:26:49Z Yes, this code was removed, but needs to be re-added here as well. --------------------------------------------------------------------------- by travisbot at 2012-06-21T15:08:59Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1674437) (merged 5afa240d into 55c6df99). --------------------------------------------------------------------------- by asm89 at 2012-06-26T06:01:02Z @fabpot Can you make a final decision on this? If you decide on point 3, this code can be merged. I agree with the arguments of @stof about the option handling and it 'only' being a BC break for direct users of the security component. I even think these direct users should be really careful anyway, since the behavior of the success and failurehandlers now change back to how they acted in 2.0. Now I am thinking about it, can't the optional parameters of this class move to setters anyway? That will make it cleaner to extend. --------------------------------------------------------------------------- by asm89 at 2012-06-28T10:29:50Z ping @fabpot --------------------------------------------------------------------------- by fabpot at 2012-06-28T17:23:02Z I'm ok with option 1 (the BC break). After doing the last changes, can you squash your commits before I merge? Thanks. --------------------------------------------------------------------------- by asm89 at 2012-07-06T21:59:54Z @fabpot I rebased the PR, added the authors and also ported the fix that was done in 8ffaafa86741a03ecb2f91e3d67802f4c6baf36b to be contained in the default success handler. I also squashed all the CS and 'small blabla fix' commits. Is it ok now? Edit: travisbot will probably say that the tests in this PR fail, but that is because current master fails on form things --------------------------------------------------------------------------- by asm89 at 2012-07-08T18:53:05Z I rebased the PR, tests are green now: [![Build Status](https://secure.travis-ci.org/asm89/symfony.png?branch=refactor-authentication-success-handling)](http://travis-ci.org/asm89/symfony).
| * | | | [Security] Fix regression after rebase. Target url should be firewall dependentAlexander2012-07-082-5/+8
| | | | |
| * | | | [Security] Add note to CHANGELOG about refactored authentication ↵Alexander2012-07-083-36/+28
| | | | | | | | | | | | | | | | | | | | failure/success handling [Security] Various CS + doc fixes [Security] Exception when authentication failure/success handlers do not return a response [Security] Add authors + fix docblock
| * | | | [Security] Update AuthenticationFailureHandlerInterface docblock. Never ↵Alexander2012-07-081-1/+1
| | | | | | | | | | | | | | | | | | | | return null
| * | | | [Security] Move default authentication failure handling strategy to seperate ↵Alexander2012-07-084-35/+116
| | | | | | | | | | | | | | | | | | | | class [Security] Update configuration for changes regarding default failure handler [Security] Fixes + add AbstractFactory test for failure handler
| * | | | [Security] Move default authentication success handling strategy to seperate ↵Alexander2012-07-084-47/+90
| | |_|/ | |/| | | | | | | | | | class [Security] Update configuration for changes regarding default success handler [Security] Fix + add AbstractFactory test
* | | | fixed CSFabien Potencier2012-07-0914-19/+19
|/ / /
* | | [Security] Fix typo in docblockAdrien Brault2012-07-071-1/+1
|/ /
* | [Security] fixed automatic registration of the response listener when ↵Fabien Potencier2012-07-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | creating the listener This is not a problem with Symfony, but when using the component standalone (Silex for instance), the context listener might be instantiated even if the firewall does not need to be fired. In that case, the handle() method is not called, but the response listener is called, which means that en empty token is stored in the session. For Silex, it means that when authenticated, if you visit a 404 page, you would be disconnected automatically.
* | merged branch uwej711/security_target_path_master (PR #4409)Fabien Potencier2012-07-022-4/+6
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 8ffaafa Make the session entry for the target url firewall dependent. Discussion ---------- [Security] Make the session entry for the target url firewall dependent. Bug fix: yes Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Fixes the following tickets: License of the code: MIT If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url, which will lead me to the admin login form again. --------------------------------------------------------------------------- by travisbot at 2012-05-25T09:33:44Z This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1431566) (merged 8ffaafa8 into 45849ce3). --------------------------------------------------------------------------- by uwej711 at 2012-06-09T08:05:54Z Doesn't this make sense or did this slip through? Or is there something missing?
| * | Make the session entry for the target url firewall dependent.Uwe Jäger2012-05-252-4/+6
| | | | | | | | | | | | | | | | | | | | | If there are two firewalls (eg. main and admin), calling an protected admin url will direct you to the login form of the admin. If I ignore this and go to the login form of the main firewall directly I will end up being redirected to the stored admin target url. This is not what you usually want to happen.
* | | fixed phpdocFabien Potencier2012-06-261-1/+4
| | |
* | | [Security] simplified some codeFabien Potencier2012-06-261-16/+21
| | |
* | | [Security] changed the HttpUtils constructor to tak both a UrlGenerator and ↵Fabien Potencier2012-06-261-9/+13
| | | | | | | | | | | | a UrlMatcher instead of a Router (to make it useable by Silex)
* | | merged 2.0Fabien Potencier2012-06-201-1/+1
|\ \ \ | | |/ | |/|
| * | tweaked the previous commitFabien Potencier2012-06-161-1/+1
| | |
| * | [Security] Only redirect to urls called with http method GETUwe Jäger2012-06-141-1/+1
| | |
* | | [Security] Check post_only option and request methodHenrik Bjørnskov2012-06-091-0/+12
| |/ |/|
* | merged 2.0Fabien Potencier2012-05-211-2/+2
|\ \ | |/
| * merged branch kepten/ticket_1813 (PR #3551)v2.0.15Fabien Potencier2012-05-211-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache Discussion ---------- [HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] --------------------------------------------------------------------------- by stof at 2012-03-10T17:34:26Z you should also add a unit test for this --------------------------------------------------------------------------- by kepten at 2012-03-11T15:34:04Z Thanks for the feedback, I committed the changes. --------------------------------------------------------------------------- by stof at 2012-04-04T01:59:53Z @fabpot could you review it ? --------------------------------------------------------------------------- by fabpot at 2012-04-04T07:15:34Z My comments: * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers. * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs). * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed). --------------------------------------------------------------------------- by danielholmes at 2012-04-14T13:27:09Z A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this: ``` <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] </IfModule> ``` NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening --------------------------------------------------------------------------- by towards at 2012-04-20T16:12:49Z @kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI --------------------------------------------------------------------------- by kepten at 2012-04-20T16:15:57Z ok, so is my PR is useless or should I still fix problems? --------------------------------------------------------------------------- by towards at 2012-04-20T16:20:26Z your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes --------------------------------------------------------------------------- by vicb at 2012-04-20T16:20:36Z I have been working with @towards: your PR is useful, please implement his comments and squash your PR. --------------------------------------------------------------------------- by kepten at 2012-04-20T16:59:07Z never squashed before, is it okay now? :) --------------------------------------------------------------------------- by stof at 2012-04-20T17:21:07Z it is --------------------------------------------------------------------------- by vicb at 2012-05-20T19:57:51Z @fabpot this should be ready to be merged
| | * [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI ↵kepten2012-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L]
| * | fixed CSFabien Potencier2012-05-186-18/+18
| | |
| * | fixed phpdoc @param alignmentv2.0.14Fabien Potencier2012-05-155-17/+17
| | |
| * | use SecurityContextInterface instead of SecurityContextv2.0.13Pierre Minnieur2012-03-092-5/+5
| |/
| * fixed CSv2.0.10Fabien Potencier2012-01-171-1/+1
| |
* | fixed CSFabien Potencier2012-05-186-19/+19
| |
* | fixed phpdoc @param alignmentFabien Potencier2012-05-155-18/+18
| |
* | [Security] fixed English grammar in exception messageDouglas Greenshields2012-05-011-1/+1
| |
* | fixed CS (missing or misplaced license blocks)Eriksen Costa2012-04-025-42/+42
| |
* | updated license blocksEriksen Costa2012-03-319-27/+27
| |
* | fixed CSFabien Potencier2012-03-231-2/+2
| |
* | [Security] Log file/line that triggered the AccessDeniedExceptionJordi Boggiano2012-03-231-2/+2
| |
* | [SecurityBundle] Allow switching to the user that is already impersonated ↵Andreas Hucks2012-03-151-6/+10
| | | | | | | | | | | | | | | | | | | | (fix #2554) Disabled exception when switching to the user that is already impersonated, exception is now only thrown when trying to switch to a new user. Added an Excption exception when switching fails because target user does not exist. Added funtional tests for switching users.
* | fixed docblockPierre Minnieur2012-03-071-1/+1
| |
* | use SecurityContextInterface instead of SecurityContextPierre Minnieur2012-03-071-2/+2
| |
* | use SecurityContextInterface instead of SecurityContextPierre Minnieur2012-03-061-2/+2
| |
* | merged branch jmikola/logout-csrf (PR #3007)Fabien Potencier2012-03-052-15/+43
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 49a8654 [Security] Use LogoutException for invalid CSRF token in LogoutListener a96105e [SecurityBundle] Use assertCount() in tests 4837407 [SecurityBundle] Fix execution of functional tests with different names 66722b3 [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens aaaa040 [Security] Allow LogoutListener to validate CSRF tokens b1f545b [Security] Refactor LogoutListener constructor to take options c48c775 [SecurityBundle] Add functional test for form login with CSRF token Discussion ---------- [Security] Implement support for CSRF tokens in logout URL's ``` Bug fix: no Feature addition: yes Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: - Todo: - ``` [![Build Status](https://secure.travis-ci.org/jmikola/symfony.png?branch=logout-csrf)](http://travis-ci.org/jmikola/symfony) This derived from #3006 but properly targeting on the master branch. This exposes new configuration options to the logout listener to enable CSRF protection, as already exists for the form login listener. The individual commits and their extended messages should suffice for explaining the logical changes of the PR. In addition to changing LogoutListener, I also created a templating helper to generate logout URL's, which includes a CSRF token if necessary. This may or may not using routing, depending on how the listener is configured since both route names or hard-coded paths are valid options. Additionally, I added unit tests for LogoutListener and functional tests for both CSRF-enabled form logins and the new logout listener work. Kudo's to @henrikbjorn for taking the time to document CSRF validation for form login listeners (see [here](http://henrik.bjrnskov.dk/symfony2-cross-site-request-forgery/)). The [Logout CSRF Protection](http://www.yiiframework.com/wiki/190/logout-csrf-protection/) article on the Yii Framework wiki was also helpful in drafting this. --------------------------------------------------------------------------- by jmikola at 2011-12-31T07:50:31Z Odd that Travis CI reported a build failure for PHP 5.3.2, but both 5.3 and 5.4 passed: http://travis-ci.org/#!/jmikola/symfony/builds/463356 My local machine passes as well. --------------------------------------------------------------------------- by jmikola at 2012-02-06T20:05:30Z @schmittjoh: Please let me know your thoughts on the last commit. I think it would be overkill to add support for another handler service and/or error page just for logout exceptions. Perhaps as an alternative, we might just want to consider an invalid CSRF token on logout imply a false return value for `LogoutListener::requiresLogout()`. That would sacrifice the ability to handle the error separately (which a 403 response allows us), although we could still add logging (currently done in ExceptionListener). --------------------------------------------------------------------------- by jmikola at 2012-02-13T17:41:33Z @schmittjoh: ping --------------------------------------------------------------------------- by fabpot at 2012-02-14T23:36:22Z @jmikola: Instead of merging symfony/master, can you rebase? --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:00:49Z Will do. --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:05:48Z ``` [avocado: symfony] logout-csrf (+9/-216) $ git rebase master First, rewinding head to replay your work on top of it... Applying: [SecurityBundle] Add functional test for form login with CSRF token Applying: [Security] Refactor LogoutListener constructor to take options Applying: [Security] Allow LogoutListener to validate CSRF tokens Applying: [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens Applying: [SecurityBundle] Fix execution of functional tests with different names Applying: [SecurityBundle] Use assertCount() in tests Using index info to reconstruct a base tree... Falling back to patching base and 3-way merge... Applying: [Security] Use LogoutException for invalid CSRF token in LogoutListener [avocado: symfony] logout-csrf (+7) $ git st # On branch logout-csrf # Your branch and 'origin/logout-csrf' have diverged, # and have 223 and 9 different commit(s) each, respectively. # nothing to commit (working directory clean) [avocado: symfony] logout-csrf (+7) $ ``` After rebasing, my merge commits disappeared. Is this normal? --------------------------------------------------------------------------- by stof at 2012-02-15T00:15:07Z Are you sure they disappeared ? Diverging from the remote branch is logical (you rewrote the history and so changed the commit id) but are you sure it does not have the commits on top of master ? Try ``git log master..logout-scrf`` If your commut are there, you simply need to force the push for the logout-csrf branch (take care to push only this branch during the force push to avoid messing all others as git won't warn you when asking to force) --------------------------------------------------------------------------- by stof at 2012-02-15T00:17:09Z ah sorry, you talked only about the merge commit. Yeah it is normal. When reapplying your commits on top of master, the merge commit are not kept as you are reapplying the changes linearly on top of the other branch (and deleting the merge commit was the reason why @fabpot asked you to rebase instead of merging btw) --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:18:00Z The merge commits are not present in `git log master..logout-csrf`. Perhaps it used those merge commits when rebasing, as there were definitely conflicts resolved when I originally merged in symfony/master (@fabpot had made his own changes to LogoutListener). I'll force-push the changes to my PR brange. IIRC, GitHub is smart enough to preserve inline diff comments, provided they were made through the PR and not on the original commits. --------------------------------------------------------------------------- by jmikola at 2012-02-15T00:19:38Z That worked well. In the future, I think I'll stick to merging upstream in and then rebasing afterwards. Resolving conflicts is much easier during a merge than interactive rebase. --------------------------------------------------------------------------- by jmikola at 2012-02-23T18:46:13Z @fabpot @schmittjoh: Is there anything else I can do for this PR? I believe the exception was the only outstanding question (see: [this comment](https://github.com/symfony/symfony/pull/3007#issuecomment-3835716)).
| * | [Security] Use LogoutException for invalid CSRF token in LogoutListenerJeremy Mikola2012-02-142-2/+11
| | | | | | | | | | | | | | | | | | On the advice of @schmittjoh, this commit adds a LogoutException class for use by LogoutListener if the CSRF token is invalid. The handling in the Security component's ExceptionListener is modeled after AccessDeniedException, which gets wrapped in an AccessDeniedHttpException in the absence of handler service or error page (I didn't think it was appropriate to re-use those for LogoutException).
| * | [Security] Allow LogoutListener to validate CSRF tokensJeremy Mikola2012-02-141-10/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds several new options to the logout listener, modeled after the form_login listener: * csrf_parameter * intention * csrf_provider The "csrf_parameter" and "intention" have default values if omitted. By default, "csrf_provider" is empty and CSRF validation is disabled in LogoutListener (preserving BC). If a service ID is given for "csrf_provider", CSRF validation will be enabled. Invalid tokens will result in an InvalidCsrfTokenException being thrown before any logout handlers are invoked.
| * | [Security] Refactor LogoutListener constructor to take optionsJeremy Mikola2012-02-141-9/+9
| | | | | | | | | | | | This will facilitate adding additional options for CSRF protection. Additionally, a unit test for existing behavior was added.
* | | [Security] added support for the remember_me parameter in the query (closes ↵Fabien Potencier2012-03-021-1/+1
| | | | | | | | | | | | #3460)
* | | [Security] added AccessMapInterfaceKris Wallsmith2012-02-154-5/+38
|/ /
* | Authentication(Success|Failure)Handler can now return nullOlivier Dolbeau2012-01-243-4/+8
| |
* | [Security] made the logout path check configurableFabien Potencier2011-12-231-1/+18
| |
* | merged 2.0Fabien Potencier2011-12-181-1/+1
|\ \ | |/
| * fixed CSFabien Potencier2011-12-181-1/+1
| |
* | merged 2.0Fabien Potencier2011-12-137-2/+13
|\ \ | |/
| * [DoctrineBridge] fixed some CSFabien Potencier2011-12-1311-2/+25
| |
* | added check for invalid user providersKris Wallsmith2011-12-051-0/+7
| |
* | merged branch jmikola/2.0-LoaderResolverInterface (PR #2785)Fabien Potencier2011-12-051-0/+4
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 7c1cbb9 [Config] Use LoaderResolverInterface for type-hinting 48b084e fixed typo 8ad94fb merged branch hhamon/doctrine_bridge_cs (PR #2775) 240796e [Bridge] [Doctrine] fixed coding conventions. 7cfc392 check for session before trying to authentication details 648fae7 merged branch proofek/domcrawlerform-radiodisabled (PR #2768) 3976b7a [DoctrineBridge] fixed CS 9a04783 merged branch beberlei/SecurityEntityRepositoryIdentifierFix (PR #2765) 3c83b89 [DoctrineBridge] Catch user-error when the identifier is not serialized with the User entity. 36c7d03 Fixed GH-2720 - Fix disabled atrribute handling for radio form elements Discussion ---------- [Config] Use LoaderResolverInterface for type-hinting ``` Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Fixes the following tickets: - ``` I've listed this as a BC break because we're changing the argument type-hint, but I think it's unlikely to affect anyone.
| * check for session before trying to authentication detailsMatt Lehner2011-12-021-0/+4
| |
* | removed unused use statementsFabien Potencier2011-11-241-1/+0
| |
* | merged 2.0Fabien Potencier2011-11-246-6/+0
|\ \ | |/
| * removed unused use statementsFabien Potencier2011-11-246-6/+0
| |
* | changed priorities for kernel.request listenersFabien Potencier2011-11-171-19/+0
| | | | | | | | | | | | | | The Firewall is now executed after the Router. This was needed to have access to the locale and other request attributes that are set by the Router. This change implies that all Firewall specific URLs have proper (empty) routes like `/login_check` and `/logout`.
* | merged branch snc/login-referer (PR #2518)Fabien Potencier2011-11-171-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- f9a65ba Redirect to default_target_path if use_referer is true and the referer is the login_path. Discussion ---------- Login redirect Bug fix: no Feature addition: no Backwards compatibility break: yes Symfony2 tests pass: yes Redirect to default_target_path if use_referer is true and the referer is the login_path. --------------------------------------------------------------------------- by Seldaek at 2011/10/30 10:52:38 -0700 :+1: --------------------------------------------------------------------------- by stealth35 at 2011/10/30 11:04:16 -0700 @snc BC break ? --------------------------------------------------------------------------- by snc at 2011/10/30 12:11:39 -0700 Well I'm sure it is never intended by a developer to be redirected to the login page after logging in but it could be possible that the controller which displays the login form handles this case, so my change would break it.
| * | Redirect to default_target_path if use_referer is true and the referer is ↵Henrik Westphal2011-10-301-1/+1
| | | | | | | | | | | | the login_path.
* | | Merge branch '2.0'Fabien Potencier2011-11-141-1/+5
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | * 2.0: [HttpKernel] fixed Content-Length header when using ESI tags (closes #2623) [HttpFoundation] added an exception to MimeTypeGuesser::guess() when no guesser are available (closes #2636) [Security] fixed HttpUtils::checkRequestPath() to not catch all exceptions (closes #2637) [DoctrineBundle] added missing default parameters, needed to setup and use DBAL without ORM [Transation] Fix grammar. [TwigBundle] Fix trace to not show 'in at line' when file/line are empty.
| * | [Security] fixed HttpUtils::checkRequestPath() to not catch all exceptions ↵v2.0.6Fabien Potencier2011-11-141-1/+5
| | | | | | | | | | | | (closes #2637)
* | | merged branch snc/issue-1798-sf21 (PR #2598)Fabien Potencier2011-11-101-2/+1
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- 4d80ebd Remove security token if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). Discussion ---------- [2.1] Fix for issue 1798 Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1798 This is a simplified PR of #2528 for the master branch.
| * | | Remove security token if user was deleted, is disabled or locked to prevent ↵H. Westphal2011-11-101-0/+6
| | | | | | | | | | | | | | | | infinite redirect loops to the login path (fixes #1798).
* | | | Merge branch '2.0'Fabien Potencier2011-11-101-0/+8
|\ \ \ \ | |/ / / |/| / / | |/ / | | | | | | | | | * 2.0: Added a class to the logs ol element to prevent hiding it when toggling an exception (fixes #2589). Remove only the security token instead of the session cookie. Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798).
| * | merged branch snc/issue-1798 (PR #2528)Fabien Potencier2011-11-101-0/+8
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits ------- f9befb6 Remove only the security token instead of the session cookie. 348bccb Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). Discussion ---------- Fix for issue 1798 Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Clear session cookie if user was deleted, is disabled or locked to prevent infinite redirect loops to the login path (fixes #1798). --------------------------------------------------------------------------- by snc at 2011/11/01 04:01:49 -0700 @stof I have changed the code so that it only removes the token... do we still need any hook support? --------------------------------------------------------------------------- by stof at 2011/11/01 04:07:17 -0700 well, the hook is for your own use case but it would be for 2.1 only anyway, not for 2.0 --------------------------------------------------------------------------- by snc at 2011/11/07 15:11:52 -0800 Now that #2414 is merged to 2.1, this could be simplified for the master branch...
| | * | Remove only the security token instead of the session cookie.H. Westphal2011-11-011-7/+6
| | | |
| | * | Clear session cookie if user was deleted, is disabled or locked to prevent ↵H. Westphal2011-10-311-1/+10
| | | | | | | | | | | | | | | | infinite redirect loops to the login path (fixes #1798).
* | | | merged 2.0Fabien Potencier2011-11-081-1/+1
|\ \ \ \ | |/ / /
generated by cgit v1.1 at 2025-05-22 04:01:50 +0000