Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 162d0be

Browse files
gmponosfabpot
gmponos
authored and
fabpot
committed
[Form] Added a cause on when a Csrf Error has occurred on CsrfValidationListener
1 parent a43f307 commit 162d0be

File tree

124 files changed

+1351
-373
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

124 files changed

+1351
-373
lines changed

‎UPGRADE-4.2.md

Lines changed: 28 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@ Finder
5555
Form
5656
----
5757

58+
* The `scale` option of the `IntegerType` is deprecated.
59+
* The `$scale` argument of the `IntegerToLocalizedStringTransformer` is deprecated.
60+
5861
* Deprecated calling `FormRenderer::searchAndRenderBlock` for fields which were already rendered.
5962
Instead of expecting such calls to return empty strings, check if the field has already been rendered.
6063

@@ -72,24 +75,12 @@ Form
7275
{% endfor %}
7376
```
7477

75-
Process
76-
-------
77-
78-
* Deprecated the `Process::setCommandline()` and the `PhpProcess::setPhpBinary()` methods.
79-
* Deprecated passing commands as strings when creating a `Process` instance.
80-
81-
Before:
82-
```php
83-
$process = new Process('ls -l');
84-
```
85-
86-
After:
87-
```php
88-
$process = new Process(array('ls', '-l'));
78+
HttpFoundation
79+
--------------
8980

90-
// alternatively, when a shell wrapper is required
91-
$process = Process::fromShellCommandline('ls -l');
92-
```
81+
* The default value of the "$secure" and "$samesite" arguments of Cookie's constructor
82+
will respectively change from "false" to "null" and from "null" to "lax" in Symfony
83+
5.0, you should define their values explicitly or use "Cookie::create()" instead.
9384

9485
FrameworkBundle
9586
---------------
@@ -164,6 +155,25 @@ Monolog
164155

165156
* The methods `DebugProcessor::getLogs()`, `DebugProcessor::countErrors()`, `Logger::getLogs()` and `Logger::countErrors()` will have a new `$request` argument in version 5.0, not defining it is deprecated.
166157

158+
Process
159+
-------
160+
161+
* Deprecated the `Process::setCommandline()` and the `PhpProcess::setPhpBinary()` methods.
162+
* Deprecated passing commands as strings when creating a `Process` instance.
163+
164+
Before:
165+
```php
166+
$process = new Process('ls -l');
167+
```
168+
169+
After:
170+
```php
171+
$process = new Process(array('ls', '-l'));
172+
173+
// alternatively, when a shell wrapper is required
174+
$process = Process::fromShellCommandline('ls -l');
175+
```
176+
167177
Security
168178
--------
169179

@@ -206,3 +216,4 @@ Validator
206216
* The component is now decoupled from `symfony/translation` and uses `Symfony\Contracts\Translation\TranslatorInterface` instead
207217
* The `ValidatorBuilderInterface` has been deprecated and `ValidatorBuilder` made final
208218
* Deprecated validating instances of `\DateTimeInterface` in `DateTimeValidator`, `DateValidator` and `TimeValidator`. Use `Type` instead or remove the constraint if the underlying model is type hinted to `\DateTimeInterface` already.
219+
* Using the `Bic` constraint without `symfony/intl` is deprecated

‎UPGRADE-5.0.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@ Finder
6969

7070
* The `Finder::sortByName()` method has a new `$useNaturalSort` argument.
7171

72+
Form
73+
----
74+
75+
* The `scale` option was removed from the `IntegerType`.
76+
* The `$scale` argument of the `IntegerToLocalizedStringTransformer` was removed.
77+
7278
FrameworkBundle
7379
---------------
7480

@@ -117,6 +123,8 @@ HttpFoundation
117123
* The `$size` argument of the `UploadedFile` constructor has been removed.
118124
* The `getClientSize()` method of the `UploadedFile` class has been removed.
119125
* The `getSession()` method of the `Request` class throws an exception when session is null.
126+
* The default value of the "$secure" and "$samesite" arguments of Cookie's constructor
127+
changed respectively from "false" to "null" and from "null" to "lax".
120128

121129
Monolog
122130
-------
@@ -191,6 +199,7 @@ Validator
191199
* The component is now decoupled from `symfony/translation` and uses `Symfony\Contracts\Translation\TranslatorInterface` instead
192200
* The `ValidatorBuilderInterface` has been removed and `ValidatorBuilder` is now final
193201
* Removed support for validating instances of `\DateTimeInterface` in `DateTimeValidator`, `DateValidator` and `TimeValidator`. Use `Type` instead or remove the constraint if the underlying model is type hinted to `\DateTimeInterface` already.
202+
* The `symfony/intl` component is now required for using the `Bic` constraint
194203

195204
Workflow
196205
--------

‎src/Symfony/Bridge/Monolog/CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ CHANGELOG
77
* added `ProcessorInterface`: an optional interface to allow autoconfiguration of Monolog processors
88
* The methods `DebugProcessor::getLogs()`, `DebugProcessor::countErrors()`, `Logger::getLogs()`
99
and `Logger::countErrors()` will have a new `$request` argument in version 5.0, not defining
10-
it is deprecated since Symfony 4.2.
10+
it is deprecated
1111

1212
4.1.0
1313
-----

‎src/Symfony/Bundle/FrameworkBundle/Command/ContainerDebugCommand.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
use Symfony\Component\Console\Output\OutputInterface;
2323
use Symfony\Component\Console\Style\SymfonyStyle;
2424
use Symfony\Component\DependencyInjection\ContainerBuilder;
25+
use Symfony\Component\DependencyInjection\Exception\ServiceNotFoundException;
2526
use Symfony\Component\DependencyInjection\Loader\XmlFileLoader;
2627
use Symfony\Component\DependencyInjection\ParameterBag\ParameterBag;
2728

@@ -144,7 +145,16 @@ protected function execute(InputInterface $input, OutputInterface $output)
144145
$options['show_hidden'] = $input->getOption('show-hidden');
145146
$options['raw_text'] = $input->getOption('raw');
146147
$options['output'] = $io;
147-
$helper->describe($io, $object, $options);
148+
149+
try {
150+
$helper->describe($io, $object, $options);
151+
} catch (ServiceNotFoundException $e) {
152+
if ('' !== $e->getId() && '@' === $e->getId()[0]) {
153+
throw new ServiceNotFoundException($e->getId(), $e->getSourceId(), null, array(substr($e->getId(), 1)));
154+
}
155+
156+
throw $e;
157+
}
148158

149159
if (!$input->getArgument('name') && !$input->getOption('tag') && !$input->getOption('parameter') && $input->isInteractive()) {
150160
if ($input->getOption('tags')) {

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Compiler/CachePoolPass.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ public static function getServiceProvider(ContainerBuilder $container, $name)
133133
{
134134
$container->resolveEnvPlaceholders($name, null, $usedEnvs);
135135

136-
if ($usedEnvs || preg_match('#^[a-z]++://#', $name)) {
136+
if ($usedEnvs || preg_match('#^[a-z]++:#', $name)) {
137137
$dsn = $name;
138138

139139
if (!$container->hasDefinition($name = '.cache_connection.'.ContainerBuilder::hash($dsn))) {

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,9 @@ public function load(array $configs, ContainerBuilder $container)
199199
if ($this->isConfigEnabled($container, $config['session'])) {
200200
$this->sessionConfigEnabled = true;
201201
$this->registerSessionConfiguration($config['session'], $container, $loader);
202+
if (!empty($config['test'])) {
203+
$container->getDefinition('test.session.listener')->setArgument(1, '%session.storage.options%');
204+
}
202205
}
203206

204207
if ($this->isConfigEnabled($container, $config['request'])) {

‎src/Symfony/Bundle/FrameworkBundle/Test/WebTestCase.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ abstract class WebTestCase extends KernelTestCase
2323
/**
2424
* Creates a Client.
2525
*
26-
* @param array $options An array of options to pass to the createKernel class
26+
* @param array $options An array of options to pass to the createKernel method
2727
* @param array $server An array of server parameters
2828
*
2929
* @return Client A Client instance

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,13 @@ CHANGELOG
66

77
* Using the `security.authentication.trust_resolver.anonymous_class` and
88
`security.authentication.trust_resolver.rememberme_class` parameters to define
9-
the token classes is deprecated. To use
10-
custom tokens extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
9+
the token classes is deprecated. To use custom tokens extend the existing
10+
`Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`.
1111
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
1212
* Added `Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddExpressionLanguageProvidersPass`
1313
* Added `json_login_ldap` authentication provider to use LDAP authentication with a REST API.
14+
* Made remember-me cookies inherit their default config from `framework.session.cookie_*`
15+
and added an "auto" mode to their "secure" config option to make them secure on HTTPS automatically.
1416

1517
4.1.0
1618
-----

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use Symfony\Component\DependencyInjection\ChildDefinition;
1616
use Symfony\Component\DependencyInjection\ContainerBuilder;
1717
use Symfony\Component\DependencyInjection\Reference;
18+
use Symfony\Component\HttpFoundation\Cookie;
1819

1920
class RememberMeFactory implements SecurityFactoryInterface
2021
{
@@ -140,7 +141,11 @@ public function addConfiguration(NodeDefinition $node)
140141
;
141142

142143
foreach ($this->options as $name => $value) {
143-
if (\is_bool($value)) {
144+
if ('secure' === $name) {
145+
$builder->enumNode($name)->values(array(true, false, 'auto'))->defaultValue('auto' === $value ? null : $value);
146+
} elseif ('samesite' === $name) {
147+
$builder->enumNode($name)->values(array(null, Cookie::SAMESITE_LAX, Cookie::SAMESITE_STRICT))->defaultValue($value);
148+
} elseif (\is_bool($value)) {
144149
$builder->booleanNode($name)->defaultValue($value);
145150
} else {
146151
$builder->scalarNode($name)->defaultValue($value);

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
namespace Symfony\Bundle\SecurityBundle\DependencyInjection;
1313

14+
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\RememberMeFactory;
1415
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface;
1516
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\UserProvider\UserProviderFactoryInterface;
1617
use Symfony\Bundle\SecurityBundle\SecurityUserValueResolver;
@@ -22,6 +23,7 @@
2223
use Symfony\Component\DependencyInjection\ChildDefinition;
2324
use Symfony\Component\DependencyInjection\Compiler\ServiceLocatorTagPass;
2425
use Symfony\Component\DependencyInjection\ContainerBuilder;
26+
use Symfony\Component\DependencyInjection\Extension\PrependExtensionInterface;
2527
use Symfony\Component\DependencyInjection\Loader\XmlFileLoader;
2628
use Symfony\Component\DependencyInjection\Parameter;
2729
use Symfony\Component\DependencyInjection\Reference;
@@ -37,7 +39,7 @@
3739
* @author Fabien Potencier <[email protected]>
3840
* @author Johannes M. Schmitt <[email protected]>
3941
*/
40-
class SecurityExtension extends Extension
42+
class SecurityExtension extends Extension implements PrependExtensionInterface
4143
{
4244
private $requestMatchers = array();
4345
private $expressions = array();
@@ -54,6 +56,32 @@ public function __construct()
5456
}
5557
}
5658

59+
public function prepend(ContainerBuilder $container)
60+
{
61+
$rememberMeSecureDefault = false;
62+
$rememberMeSameSiteDefault = null;
63+
64+
if (!isset($container->getExtensions()['framework'])) {
65+
return;
66+
}
67+
foreach ($container->getExtensionConfig('framework') as $config) {
68+
if (isset($config['session'])) {
69+
$rememberMeSecureDefault = $config['session']['cookie_secure'] ?? $rememberMeSecureDefault;
70+
$rememberMeSameSiteDefault = array_key_exists('cookie_samesite', $config['session']) ? $config['session']['cookie_samesite'] : $rememberMeSameSiteDefault;
71+
}
72+
}
73+
foreach ($this->listenerPositions as $position) {
74+
foreach ($this->factories[$position] as $factory) {
75+
if ($factory instanceof RememberMeFactory) {
76+
\Closure::bind(function () use ($rememberMeSecureDefault, $rememberMeSameSiteDefault) {
77+
$this->options['secure'] = $rememberMeSecureDefault;
78+
$this->options['samesite'] = $rememberMeSameSiteDefault;
79+
}, $factory, $factory)();
80+
}
81+
}
82+
}
83+
}
84+
5785
public function load(array $configs, ContainerBuilder $container)
5886
{
5987
if (!array_filter($configs)) {

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ public function testSessionLessRememberMeLogout()
2626
$cookieJar->expire(session_name());
2727

2828
$this->assertNotNull($cookieJar->get('REMEMBERME'));
29+
$this->assertSame('lax', $cookieJar->get('REMEMBERME')->getSameSite());
2930

3031
$client->request('GET', '/logout');
3132

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/RememberMeLogout/config.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
imports:
22
- { resource: ./../config/framework.yml }
33

4+
framework:
5+
session:
6+
cookie_secure: auto
7+
cookie_samesite: lax
8+
49
security:
510
encoders:
611
Symfony\Component\Security\Core\User\User: plaintext

‎src/Symfony/Bundle/SecurityBundle/composer.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
},
2929
"require-dev": {
3030
"symfony/asset": "~3.4|~4.0",
31-
"symfony/browser-kit": "~3.4|~4.0",
31+
"symfony/browser-kit": "~4.2",
3232
"symfony/console": "~3.4|~4.0",
3333
"symfony/css-selector": "~3.4|~4.0",
3434
"symfony/dom-crawler": "~3.4|~4.0",
@@ -48,6 +48,7 @@
4848
"twig/twig": "~1.34|~2.4"
4949
},
5050
"conflict": {
51+
"symfony/browser-kit": "<4.2",
5152
"symfony/var-dumper": "<3.4",
5253
"symfony/event-dispatcher": "<3.4",
5354
"symfony/framework-bundle": "<4.2",

‎src/Symfony/Bundle/TwigBundle/TemplateIterator.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public function getIterator()
6363
$this->templates = array_merge(
6464
$this->templates,
6565
$this->findTemplatesInDirectory($bundle->getPath().'/Resources/views', $name),
66-
$this->findTemplatesInDirectory($this->rootDir.'/'.$bundle->getName().'/views', $name),
66+
$this->findTemplatesInDirectory($this->rootDir.'/Resources/'.$bundle->getName().'/views', $name),
6767
$this->findTemplatesInDirectory($this->defaultPath.'/bundles/'.$bundle->getName(), $name)
6868
);
6969
}

‎src/Symfony/Bundle/TwigBundle/Tests/Fixtures/templates/Resources/BarBundle/views/base.html.twig

Whitespace-only changes.

‎src/Symfony/Bundle/TwigBundle/Tests/TemplateIteratorTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ public function testGetIterator()
3131
sort($sorted);
3232
$this->assertEquals(
3333
array(
34+
'@Bar/base.html.twig',
3435
'@Bar/index.html.twig',
3536
'@Bar/layout.html.twig',
3637
'@Foo/index.html.twig',

‎src/Symfony/Bundle/WebProfilerBundle/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
WebProfilerBundle
22
=================
33

4+
The Web profiler bundle is a **development tool** that gives detailed
5+
information about the execution of any request.
6+
7+
**Never** enable it on production servers as it will lead to major security
8+
vulnerabilities in your project.
9+
410
Resources
511
---------
612

‎src/Symfony/Bundle/WebProfilerBundle/WebProfilerBundle.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,14 @@
1414
use Symfony\Component\HttpKernel\Bundle\Bundle;
1515

1616
/**
17-
* Bundle.
18-
*
1917
* @author Fabien Potencier <[email protected]>
2018
*/
2119
class WebProfilerBundle extends Bundle
2220
{
21+
public function boot()
22+
{
23+
if ('prod' === $this->container->getParameter('kernel.environment')) {
24+
@trigger_error('Using WebProfilerBundle in production is not supported and puts your project at risk, disable it.', E_USER_WARNING);
25+
}
26+
}
2327
}

‎src/Symfony/Component/BrowserKit/CHANGELOG.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ CHANGELOG
55
-----
66

77
* The method `Client::submit()` will have a new `$serverParameters` argument
8-
in version 5.0, not defining it is deprecated since version 4.2
8+
in version 5.0, not defining it is deprecated
9+
* Added ability to read the "samesite" attribute of cookies using `Cookie::getSameSite()`
910

1011
3.4.0
1112
-----

‎src/Symfony/Component/BrowserKit/Client.php

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ public function getMaxRedirects()
118118
public function insulate($insulated = true)
119119
{
120120
if ($insulated && !class_exists('Symfony\\Component\\Process\\Process')) {
121-
throw new \RuntimeException('Unable to isolate requests as the Symfony Process Component is not installed.');
121+
throw new \LogicException('Unable to isolate requests as the Symfony Process Component is not installed.');
122122
}
123123

124124
$this->insulated = (bool) $insulated;
@@ -297,7 +297,11 @@ public function click(Link $link)
297297
*/
298298
public function clickLink(string $linkText): Crawler
299299
{
300-
return $this->click($this->getCrawler()->selectLink($linkText)->link());
300+
if (null === $this->crawler) {
301+
throw new BadMethodCallException(sprintf('The "request()" method must be called before "%s()".', __METHOD__));
302+
}
303+
304+
return $this->click($this->crawler->selectLink($linkText)->link());
301305
}
302306

303307
/**
@@ -332,7 +336,11 @@ public function submit(Form $form, array $values = array()/*, array $serverParam
332336
*/
333337
public function submitForm(string $button, array $fieldValues = array(), string $method = 'POST', array $serverParameters = array()): Crawler
334338
{
335-
$buttonNode = $this->getCrawler()->selectButton($button);
339+
if (null === $this->crawler) {
340+
throw new BadMethodCallException(sprintf('The "request()" method must be called before "%s()".', __METHOD__));
341+
}
342+
343+
$buttonNode = $this->crawler->selectButton($button);
336344
$form = $buttonNode->form($fieldValues, $method);
337345

338346
return $this->submit($form, array(), $serverParameters);

0 commit comments

Comments
 (0)