Skip to content

Commit cc24b55

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '4.4' into 5.0
* 4.4: [PropertyAccess] fix tests [WebProfilerBundle] fix test remove assertions that can never be reached [PropertyAccess] Improve message of unitialized property in php 7.4 [HttpFoundation] Fixed session migration with custom cookie lifetime [HttpKernel][FrameworkBundle] fix compat with Debug component [Serializer] Remove unused variable Allow URL-encoded special characters in basic auth part of URLs [Serializer] Fix unitialized properties (from PHP 7.4.2) when serializing context for the cache key [Validator] Add missing Ukrainian and Russian translations Track session usage when setting the token [4.4][MonologBridge] Fix $level type No need to reconnect the bags to the session Support for Content Security Policy style-src-elem and script-src-elem in WebProfiler [PropertyInfo][ReflectionExtractor] Check the array mutator prefixes last when the property is singular [Security][Http][SwitchUserListener] Ignore all non existent username protection errors Add installation and minimal example to README
2 parents e0c1ee6 + f72dd9c commit cc24b55

File tree

32 files changed

+237
-46
lines changed

32 files changed

+237
-46
lines changed

‎src/Symfony/Bridge/Monolog/Handler/ElasticsearchLogstashHandler.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,10 @@ class ElasticsearchLogstashHandler extends AbstractHandler
4949
private $client;
5050
private $responses;
5151

52-
public function __construct(string $endpoint = 'http://127.0.0.1:9200', string $index = 'monolog', HttpClientInterface $client = null, int $level = Logger::DEBUG, bool $bubble = true)
52+
/**
53+
* @param string|int $level The minimum logging level at which this handler will be triggered
54+
*/
55+
public function __construct(string $endpoint = 'http://127.0.0.1:9200', string $index = 'monolog', HttpClientInterface $client = null, $level = Logger::DEBUG, bool $bubble = true)
5356
{
5457
if (!interface_exists(HttpClientInterface::class)) {
5558
throw new \LogicException(sprintf('The "%s" handler needs an HTTP client. Try running "composer require symfony/http-client".', __CLASS__));

‎src/Symfony/Bundle/FrameworkBundle/Console/Application.php

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
use Symfony\Component\Console\Output\ConsoleOutputInterface;
2020
use Symfony\Component\Console\Output\OutputInterface;
2121
use Symfony\Component\Console\Style\SymfonyStyle;
22-
use Symfony\Component\Debug\Exception\FatalThrowableError;
2322
use Symfony\Component\DependencyInjection\ContainerAwareInterface;
2423
use Symfony\Component\HttpKernel\Bundle\Bundle;
2524
use Symfony\Component\HttpKernel\Kernel;
@@ -207,15 +206,7 @@ private function renderRegistrationErrors(InputInterface $input, OutputInterface
207206
(new SymfonyStyle($input, $output))->warning('Some commands could not be registered:');
208207

209208
foreach ($this->registrationErrors as $error) {
210-
if (method_exists($this, 'doRenderThrowable')) {
211-
$this->doRenderThrowable($error, $output);
212-
} else {
213-
if (!$error instanceof \Exception) {
214-
$error = new FatalThrowableError($error);
215-
}
216-
217-
$this->doRenderException($error, $output);
218-
}
209+
$this->doRenderThrowable($error, $output);
219210
}
220211
}
221212
}

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/GuardedBundle/AppCustomAuthenticator.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class AppCustomAuthenticator extends AbstractGuardAuthenticator
2323
{
2424
public function supports(Request $request)
2525
{
26-
return true;
26+
return '/manual_login' !== $request->getPathInfo() && '/profile' !== $request->getPathInfo();
2727
}
2828

2929
public function getCredentials(Request $request)

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/GuardedBundle/AuthenticationController.php

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\GuardedBundle;
13+
14+
use Symfony\Component\HttpFoundation\Request;
15+
use Symfony\Component\HttpFoundation\Response;
16+
use Symfony\Component\Security\Core\User\User;
17+
use Symfony\Component\Security\Core\User\UserInterface;
18+
use Symfony\Component\Security\Guard\GuardAuthenticatorHandler;
19+
use Symfony\Component\Security\Guard\Token\PostAuthenticationGuardToken;
20+
21+
class AuthenticationController
22+
{
23+
public function manualLoginAction(GuardAuthenticatorHandler $guardAuthenticatorHandler, Request $request)
24+
{
25+
$guardAuthenticatorHandler->authenticateWithToken(new PostAuthenticationGuardToken(new User('Jane', 'test', ['ROLE_USER']), 'secure', ['ROLE_USER']), $request, 'secure');
26+
27+
return new Response('Logged in.');
28+
}
29+
30+
public function profileAction(UserInterface $user = null)
31+
{
32+
if (null === $user) {
33+
return new Response('Not logged in.');
34+
}
35+
36+
return new Response('Username: '.$user->getUsername());
37+
}
38+
}

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/GuardedTest.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,14 @@ public function testGuarded()
2121

2222
$this->assertSame(418, $client->getResponse()->getStatusCode());
2323
}
24+
25+
public function testManualLogin()
26+
{
27+
$client = $this->createClient(['debug' => true, 'test_case' => 'Guarded', 'root_config' => 'config.yml']);
28+
29+
$client->request('GET', '/manual_login');
30+
$client->request('GET', '/profile');
31+
32+
$this->assertSame('Username: Jane', $client->getResponse()->getContent());
33+
}
2434
}

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Guarded/config.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,19 @@ framework:
1010
services:
1111
logger: { class: Psr\Log\NullLogger }
1212
Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\GuardedBundle\AppCustomAuthenticator: ~
13+
Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\GuardedBundle\AuthenticationController:
14+
tags: [controller.service_arguments]
1315

1416
security:
17+
encoders:
18+
Symfony\Component\Security\Core\User\User: plaintext
19+
20+
providers:
21+
in_memory:
22+
memory:
23+
users:
24+
Jane: { password: test, roles: [ROLE_USER] }
25+
1526
firewalls:
1627
secure:
1728
pattern: ^/

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Guarded/routing.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,12 @@ main:
33
defaults:
44
_controller: Symfony\Bundle\FrameworkBundle\Controller\RedirectController::urlRedirectAction
55
path: /app
6+
profile:
7+
path: /profile
8+
defaults:
9+
_controller: Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\GuardedBundle\AuthenticationController::profileAction
10+
11+
manual_login:
12+
path: /manual_login
13+
defaults:
14+
_controller: Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\GuardedBundle\AuthenticationController::manualLoginAction

‎src/Symfony/Bundle/WebProfilerBundle/Csp/ContentSecurityPolicyHandler.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ private function updateCspHeaders(Response $response, array $nonces = []): array
124124
$headers = $this->getCspHeaders($response);
125125

126126
foreach ($headers as $header => $directives) {
127-
foreach (['script-src' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce'] as $type => $tokenName) {
127+
foreach (['script-src' => 'csp_script_nonce', 'script-src-elem' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce', 'style-src-elem' => 'csp_style_nonce'] as $type => $tokenName) {
128128
if ($this->authorizesInline($directives, $type)) {
129129
continue;
130130
}

‎src/Symfony/Bundle/WebProfilerBundle/Tests/Csp/ContentSecurityPolicyHandlerTest.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ public function testOnKernelResponse($nonce, $expectedNonce, Request $request, R
4141
$this->assertFalse($response->headers->has('X-SymfonyProfiler-Style-Nonce'));
4242

4343
foreach ($expectedCsp as $header => $value) {
44-
$this->assertSame($value, $response->headers->get($header));
44+
$this->assertSame($value, $response->headers->get($header), $header);
4545
}
4646
}
4747

@@ -131,7 +131,7 @@ public function provideRequestAndResponsesForOnKernelResponse()
131131
['csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce],
132132
$this->createRequest(),
133133
$this->createResponse(['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'']),
134-
['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; style-src \'self\' domain.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; style-src \'self\' domain-report-only.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null],
134+
['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\' domain.com \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'self\' domain.com \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src-elem \'self\' domain.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\' domain-report-only.com \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'self\' domain-report-only.com \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src-elem \'self\' domain-report-only.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null],
135135
],
136136
[
137137
$nonce,

‎src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -215,8 +215,10 @@ public function regenerate(bool $destroy = false, int $lifetime = null)
215215
return false;
216216
}
217217

218-
if (null !== $lifetime) {
218+
if (null !== $lifetime && $lifetime != ini_get('session.cookie_lifetime')) {
219+
$this->save();
219220
ini_set('session.cookie_lifetime', $lifetime);
221+
$this->start();
220222
}
221223

222224
if ($destroy) {
@@ -225,10 +227,6 @@ public function regenerate(bool $destroy = false, int $lifetime = null)
225227

226228
$isRegenerated = session_regenerate_id($destroy);
227229

228-
// The reference to $_SESSION in session bags is lost in PHP7 and we need to re-create it.
229-
// @see https://bugs.php.net/70013
230-
$this->loadSession();
231-
232230
if (null !== $this->emulateSameSite) {
233231
$originalCookie = SessionUtils::popSessionCookie(session_name(), session_id());
234232
if (null !== $originalCookie) {

0 commit comments

Comments
 (0)