[Security] fixed session creation when none is needed (closes #6917) #6964
Conversation
fabpot
commented
Feb 4, 2013
| Q | A |
|---|---|
| Bug fix? | yes |
| New feature? | no |
| BC breaks? | no |
| Deprecations? | no |
| Tests pass? | yes |
| Fixed tickets | #6917 |
| License | MIT |
| Doc PR | n/a |
|
That looks good. Maybe we need a test for this logic to prevent any regression in the future? |
|
Yep, this was exactly what i tried locally, but really wasn't familiar enough with it to be confident enough to submit it as a fix. Works for me! |
|
A few test failures which were added by the breaking PR #2414 in the first place. |
|
I've fixed the tests which now really test that the session is not started. |
This PR was merged into the 2.1 branch. Commits ------- 8ca00c5 [Security] fixed session creation when none is needed (closes #6917) Discussion ---------- [Security] fixed session creation when none is needed (closes #6917) | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #6917 | License | MIT | Doc PR | n/a --------------------------------------------------------------------------- by drak at 2013-02-04T16:24:49Z That looks good. Maybe we need a test for this logic to prevent any regression in the future? --------------------------------------------------------------------------- by bendavies at 2013-02-04T16:30:38Z Yep, this was exactly what i tried locally, but really wasn't familiar enough with it to be confident enough to submit it as a fix. Works for me! --------------------------------------------------------------------------- by bendavies at 2013-02-04T17:19:32Z A few test failures which were added by the breaking PR #2414 in the first place. --------------------------------------------------------------------------- by fabpot at 2013-02-04T18:00:31Z I've fixed the tests which now really test that the session is not started.
|
Awesome, thanks. |
|
@fabpot what is the process for this being merged to 2.2/master etc.? |
|
it has been merged to 2.1 and will eventually be merged to 2.2 and master (probably in the next couple of days). |
|
saw 2.1. wasn't sure about 2.2 and master. thanks! |
| $listener->onKernelResponse($event); | ||
|
|
||
| return $session; | ||
| }} |
|
This commit breaks an API where the first request is a "POST /login", in this case the authentication always fails, but on the second request it works. |
|
@can you create a proper ticket so that we don't loose this regression? Thanks. |
|
@fabpot Done and adriensamson already implemented a fix. |