Merge branch '4.4' into 5.0

nicolas-grekas · nicolas-grekas · commit 9dbeab93f26c · 2019-12-03T17:35:18.000+01:00
* 4.4:
  [Security/Core] Fix checking for SHA256/SHA512 passwords
  [Cache][Lock] fix tests
  bumped Symfony version to 4.4.2
  updated VERSION for 4.4.1
  updated CHANGELOG for 4.4.1
diff --git a/CHANGELOG-4.4.md b/CHANGELOG-4.4.md
@@ -7,6 +7,58 @@ in 4.4 minor versions.
 To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
 To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v4.4.0...v4.4.1
 
+* 4.4.1 (2019-12-01)
+
+ * bug #34732 [DependencyInjection][Xml] Fix the attribute 'tag' is not allowed in 'bind' tag (tienvx)
+ * bug #34729 [DI] auto-register singly implemented interfaces by default (nicolas-grekas)
+ * bug #34728 [DI] fix overriding existing services with aliases for singly-implemented interfaces (nicolas-grekas)
+ * bug #34649 more robust initialization from request (dbu)
+ * bug #34715 [TwigBundle] remove service when base class is missing (xabbuh)
+ * bug #34600 [DoctrineBridge] do not depend on the QueryBuilder from the ORM (xabbuh)
+ * bug #34627 [Security/Http] call auth listeners/guards eagerly when they "support" the request (nicolas-grekas)
+ * bug #34671 [Security] Fix clearing remember-me cookie after deauthentication (chalasr)
+ * bug #34711 Fix the translation commands when a template contains a syntax error (fabpot)
+ * bug #34032 [Mime] Fixing multidimensional array structure with FormDataPart (jvahldick)
+ * bug #34560 [Config][ReflectionClassResource] Handle parameters with undefined constant as their default values (fancyweb)
+ * bug #34695 [Config] don't break on virtual stack frames in ClassExistenceResource (nicolas-grekas)
+ * bug #34716 [DependencyInjection] fix dumping number-like string parameters (xabbuh)
+ * bug #34558 [Console] Fix autocomplete multibyte input support (fancyweb)
+ * bug #34130 [Console] Fix commands description with numeric namespaces (fancyweb)
+ * bug #34562 [DI] Skip unknown method calls for factories in check types pass (fancyweb)
+ * bug #34677 [EventDispatcher] Better error reporting when arguments to dispatch() are swapped (rimas-kudelis)
+ * bug #33573 [TwigBridge] Add row_attr to all form themes (fancyweb)
+ * bug #34019 [Serializer] CsvEncoder::NO_HEADERS_KEY ignored when used in constructor (Dario Savella)
+ * bug #34083 [Form] Keep preferred_choices order for choice groups (vilius-g)
+ * bug #34091 [Debug] work around failing chdir() on Darwin (mary2501)
+ * bug #34305 [PhpUnitBridge] Read configuration CLI directive (ro0NL)
+ * bug #34490 [Serializer] Fix MetadataAwareNameConverter usage with string group (antograssiot)
+ * bug #34632 [Console] Fix trying to access array offset on value of type int (Tavafi)
+ * bug #34669 [HttpClient] turn exception into log when the request has no content-type (nicolas-grekas)
+ * bug #34662 [HttpKernel] Support typehint to deprecated FlattenException in controller (andrew-demb)
+ * bug #34619 Restores preview mode support for Html and Serializer error renderers (yceruto)
+ * bug #34636 [VarDumper] notice on potential undefined index (sylvainmetayer)
+ * bug #34668 [Cache] Make sure we get the correct number of values from redis::mget() (thePanz)
+ * bug #34621 [Routing] Continue supporting single colon in object route loaders (fancyweb)
+ * bug #34554 [HttpClient] Fix early cleanup of pushed HTTP/2 responses (lyrixx)
+ * bug #34607 [HttpKernel] Ability to define multiple kernel.reset tags (rmikalkenas)
+ * bug #34599 [Mailer][Mailchimp Bridge] Throwing undefined index _id when setting message id (monteiro)
+ * bug #34569 [Workflow] Apply the same logic of precedence between the apply() and the buildTransitionBlockerList() method (lyrixx)
+ * bug #34580 [HttpKernel] Don't cache "not-fresh" state (nicolas-grekas)
+ * bug #34577 [FrameworkBundle][Cache] Don't deep-merge cache pools configuration (alxndrbauer)
+ * bug #34515 [DependencyInjection] definitions are valid objects (xabbuh)
+ * bug #34536 [SecurityBundle] Don't require a user provider for the anonymous listener (chalasr)
+ * bug #34533 [Monolog Bridge] Fixed accessing static property as non static. (Sander-Toonen)
+ * bug #34502 [FrameworkBundle][ContainerLint] Keep "removing" compiler passes (fancyweb)
+ * bug #34552 [Dotenv] don't fail when referenced env var does not exist (xabbuh)
+ * bug #34546 [Serializer] Add DateTimeZoneNormalizer into Dependency Injection (jewome62)
+ * bug #34547 [Messenger] Error when specified default bus is not among the configured (vudaltsov)
+ * bug #34513 [Validator] remove return type declaration from __sleep() (xabbuh)
+ * bug #34551 [Security] SwitchUser is broken when the User Provider always returns a valid user (tucksaun)
+ * bug #34385 Avoid empty "If-Modified-Since" header in validation request (mpdude)
+ * bug #34458 [Validator] ConstraintValidatorTestCase: add missing return value to mocked validate method calls (ogizanagi)
+ * bug #34516 [HttpKernel] drop return type declaration (xabbuh)
+ * bug #34474 [Messenger] Ignore stamps in in-memory transport (tienvx)
+
 * 4.4.0 (2019-11-21)
 
  * bug #34464 [Form] group constraints when calling the validator (nicolas-grekas)
diff --git a/src/Symfony/Component/Cache/Tests/Adapter/PdoAdapterTest.php b/src/Symfony/Component/Cache/Tests/Adapter/PdoAdapterTest.php
@@ -94,9 +94,9 @@ public function testDsn(string $dsn, string $file = null)
     public function provideDsn()
     {
         $dbFile = tempnam(sys_get_temp_dir(), 'sf_sqlite_cache');
-        yield ['sqlite://localhost/'.$dbFile, ''.$dbFile];
-        yield ['sqlite:'.$dbFile, ''.$dbFile];
-        yield ['sqlite3:///'.$dbFile, ''.$dbFile];
+        yield ['sqlite://localhost/'.$dbFile.'1', $dbFile.'1'];
+        yield ['sqlite:'.$dbFile.'2', $dbFile.'2'];
+        yield ['sqlite3:///'.$dbFile.'3', $dbFile.'3'];
         yield ['sqlite://localhost/:memory:'];
         yield ['sqlite::memory:'];
     }
diff --git a/src/Symfony/Component/Lock/Tests/Store/PdoStoreTest.php b/src/Symfony/Component/Lock/Tests/Store/PdoStoreTest.php
@@ -97,9 +97,9 @@ public function testDsn(string $dsn, string $file = null)
     public function provideDsn()
     {
         $dbFile = tempnam(sys_get_temp_dir(), 'sf_sqlite_cache');
-        yield ['sqlite://localhost/'.$dbFile, ''.$dbFile];
-        yield ['sqlite:'.$dbFile, ''.$dbFile];
-        yield ['sqlite3:///'.$dbFile, ''.$dbFile];
+        yield ['sqlite://localhost/'.$dbFile.'1', $dbFile.'1'];
+        yield ['sqlite:'.$dbFile.'2', $dbFile.'2'];
+        yield ['sqlite3:///'.$dbFile.'3', $dbFile.'3'];
         yield ['sqlite://localhost/:memory:'];
         yield ['sqlite::memory:'];
     }
diff --git a/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php
@@ -80,9 +80,9 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo
             return false;
         }
 
-        if (0 === strpos($encoded, '$2')) {
+        if (0 !== strpos($encoded, '$argon')) {
             // BCrypt encodes only the first 72 chars
-            return 72 >= \strlen($raw) && password_verify($raw, $encoded);
+            return (72 >= \strlen($raw) || 0 !== strpos($encoded, '$2')) && password_verify($raw, $encoded);
         }
 
         if (\extension_loaded('sodium') && version_compare(\SODIUM_LIBRARY_VERSION, '1.0.14', '>=')) {
diff --git a/src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php
@@ -80,9 +80,9 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo
             return false;
         }
 
-        if (72 >= \strlen($raw) && 0 === strpos($encoded, '$2')) {
-            // Accept validating BCrypt passwords for seamless migrations
-            return password_verify($raw, $encoded);
+        if (0 !== strpos($encoded, '$argon')) {
+            // Accept validating non-argon passwords for seamless migrations
+            return (72 >= \strlen($raw) || 0 !== strpos($encoded, '$2')) && password_verify($raw, $encoded);
         }
 
         if (\function_exists('sodium_crypto_pwhash_str_verify')) {
diff --git a/src/Symfony/Component/Security/Core/Tests/Encoder/NativePasswordEncoderTest.php b/src/Symfony/Component/Security/Core/Tests/Encoder/NativePasswordEncoderTest.php
@@ -55,6 +55,15 @@ public function testValidation()
         $this->assertFalse($encoder->isPasswordValid($result, 'anotherPassword', null));
     }
 
+    public function testNonArgonValidation()
+    {
+        $encoder = new NativePasswordEncoder();
+        $this->assertTrue($encoder->isPasswordValid('$5$abcdefgh$ZLdkj8mkc2XVSrPVjskDAgZPGjtj1VGVaa1aUkrMTU/', 'password', null));
+        $this->assertFalse($encoder->isPasswordValid('$5$abcdefgh$ZLdkj8mkc2XVSrPVjskDAgZPGjtj1VGVaa1aUkrMTU/', 'anotherPassword', null));
+        $this->assertTrue($encoder->isPasswordValid('$6$abcdefgh$yVfUwsw5T.JApa8POvClA1pQ5peiq97DUNyXCZN5IrF.BMSkiaLQ5kvpuEm/VQ1Tvh/KV2TcaWh8qinoW5dhA1', 'password', null));
+        $this->assertFalse($encoder->isPasswordValid('$6$abcdefgh$yVfUwsw5T.JApa8POvClA1pQ5peiq97DUNyXCZN5IrF.BMSkiaLQ5kvpuEm/VQ1Tvh/KV2TcaWh8qinoW5dhA1', 'anotherPassword', null));
+    }
+
     public function testConfiguredAlgorithm()
     {
         $encoder = new NativePasswordEncoder(null, null, null, PASSWORD_BCRYPT);
diff --git a/src/Symfony/Component/Security/Core/Tests/Encoder/SodiumPasswordEncoderTest.php b/src/Symfony/Component/Security/Core/Tests/Encoder/SodiumPasswordEncoderTest.php
@@ -37,6 +37,15 @@ public function testBCryptValidation()
         $this->assertTrue($encoder->isPasswordValid('$2y$04$M8GDODMoGQLQRpkYCdoJh.lbiZPee3SZI32RcYK49XYTolDGwoRMm', 'abc', null));
     }
 
+    public function testNonArgonValidation()
+    {
+        $encoder = new SodiumPasswordEncoder();
+        $this->assertTrue($encoder->isPasswordValid('$5$abcdefgh$ZLdkj8mkc2XVSrPVjskDAgZPGjtj1VGVaa1aUkrMTU/', 'password', null));
+        $this->assertFalse($encoder->isPasswordValid('$5$abcdefgh$ZLdkj8mkc2XVSrPVjskDAgZPGjtj1VGVaa1aUkrMTU/', 'anotherPassword', null));
+        $this->assertTrue($encoder->isPasswordValid('$6$abcdefgh$yVfUwsw5T.JApa8POvClA1pQ5peiq97DUNyXCZN5IrF.BMSkiaLQ5kvpuEm/VQ1Tvh/KV2TcaWh8qinoW5dhA1', 'password', null));
+        $this->assertFalse($encoder->isPasswordValid('$6$abcdefgh$yVfUwsw5T.JApa8POvClA1pQ5peiq97DUNyXCZN5IrF.BMSkiaLQ5kvpuEm/VQ1Tvh/KV2TcaWh8qinoW5dhA1', 'anotherPassword', null));
+    }
+
     public function testEncodePasswordLength()
     {
         $this->expectException('Symfony\Component\Security\Core\Exception\BadCredentialsException');

Original file line number	Diff line number	Diff line change
`@@ -94,9 +94,9 @@ public function testDsn(string $dsn, string $file = null)`
`94`	`94`	`public function provideDsn()`
`95`	`95`	`{`
`96`	`96`	`$dbFile = tempnam(sys_get_temp_dir(), 'sf_sqlite_cache');`
`97`		`- yield ['sqlite://localhost/'.$dbFile, ''.$dbFile];`
`98`		`- yield ['sqlite:'.$dbFile, ''.$dbFile];`
`99`		`- yield ['sqlite3:///'.$dbFile, ''.$dbFile];`
	`97`	`+ yield ['sqlite://localhost/'.$dbFile.'1', $dbFile.'1'];`
	`98`	`+ yield ['sqlite:'.$dbFile.'2', $dbFile.'2'];`
	`99`	`+ yield ['sqlite3:///'.$dbFile.'3', $dbFile.'3'];`
`100`	`100`	`yield ['sqlite://localhost/:memory:'];`
`101`	`101`	`yield ['sqlite::memory:'];`
`102`	`102`	`}`
Original file line number	Diff line number	Diff line change
`@@ -97,9 +97,9 @@ public function testDsn(string $dsn, string $file = null)`
`97`	`97`	`public function provideDsn()`
`98`	`98`	`{`
`99`	`99`	`$dbFile = tempnam(sys_get_temp_dir(), 'sf_sqlite_cache');`
`100`		`- yield ['sqlite://localhost/'.$dbFile, ''.$dbFile];`
`101`		`- yield ['sqlite:'.$dbFile, ''.$dbFile];`
`102`		`- yield ['sqlite3:///'.$dbFile, ''.$dbFile];`
	`100`	`+ yield ['sqlite://localhost/'.$dbFile.'1', $dbFile.'1'];`
	`101`	`+ yield ['sqlite:'.$dbFile.'2', $dbFile.'2'];`
	`102`	`+ yield ['sqlite3:///'.$dbFile.'3', $dbFile.'3'];`
`103`	`103`	`yield ['sqlite://localhost/:memory:'];`
`104`	`104`	`yield ['sqlite::memory:'];`
`105`	`105`	`}`
Original file line number	Diff line number	Diff line change
`@@ -80,9 +80,9 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo`
`80`	`80`	`return false;`
`81`	`81`	`}`
`82`	`82`
`83`		`- if (0 === strpos($encoded, '$2')) {`
	`83`	`+ if (0 !== strpos($encoded, '$argon')) {`
`84`	`84`	`// BCrypt encodes only the first 72 chars`
`85`		`- return 72 >= \strlen($raw) && password_verify($raw, $encoded);`
	`85`	`+ return (72 >= \strlen($raw) \|\| 0 !== strpos($encoded, '$2')) && password_verify($raw, $encoded);`
`86`	`86`	`}`
`87`	`87`
`88`	`88`	`if (\extension_loaded('sodium') && version_compare(\SODIUM_LIBRARY_VERSION, '1.0.14', '>=')) {`