Skip to content

Updated XSSI Json Hijacking explanation #2710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 228 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
228 commits
Select commit Hold shift + click to select a range
c01bc53
Update reference/configuration/framework.rst
humandb Oct 18, 2012
460406e
Update reference/dic_tags.rst
humandb Oct 21, 2012
f723940
Update reference/configuration/framework.rst
humandb Oct 21, 2012
70ca20c
Update reference/configuration/framework.rst
humandb Oct 29, 2012
6533268
Add note about console autocompletion
lmcd Dec 20, 2012
dbfcaff
Adapted the docs to the rename of the "virtual" form option to "inher…
webmozart Jan 5, 2013
700f529
Update reference/configuration/framework.rst
humandb Jan 20, 2013
63fae5b
Update reference/configuration/framework.rst
humandb Jan 20, 2013
f3c431f
[#2283] Updating URL from 2.1 to master on master branch
weaverryan Mar 15, 2013
eae1566
added a note about the new setCurrent method on the progress helper
fabpot Mar 23, 2013
441e766
removed deprecated trust_proxy_headers docs
fabpot Mar 23, 2013
74f9a1f
removed docs on PHP parsing in YAML files
fabpot Mar 23, 2013
f886afc
updated deprecated usage of flash bags
fabpot Mar 23, 2013
6e7c0cd
removed deprecated min/max/minlength/maxlength constraints
fabpot Mar 23, 2013
ac9fbcd
updated the way form errors are customized
fabpot Mar 23, 2013
2521b05
Added documentation to cover PR #6951 on serializer component.
marcosQuesada Feb 26, 2013
d879786
Document new framework option http_method_override
hacfi Mar 25, 2013
7b06db8
Merge pull request #2342 from fabpot/progress-helper
weaverryan Mar 25, 2013
784b611
added documentation for the dispatchable console application
fabpot Mar 24, 2013
f9bbfcd
updated documentation for synchronized services
fabpot Mar 23, 2013
2821a55
Merge pull request #2343 from fabpot/synchronized-services
weaverryan Mar 26, 2013
35fff77
[#2343] Minor tweaks to synchronized services section
weaverryan Mar 26, 2013
bf4ce18
removed deprecated cookie config options
fabpot Mar 23, 2013
a786941
removed deprecated auto_start setting
fabpot Mar 23, 2013
934531c
removed deprecated charset setting
fabpot Mar 23, 2013
18f4575
Merge branch 'patch-1' of github.com:loalf/symfony-docs into loalf-pa…
weaverryan Mar 30, 2013
a9c8ed6
[#1829] Moving serializer framework docs around - added a new cookboo…
weaverryan Mar 30, 2013
bbdc8ce
Merge branch '2.2'
weaverryan Mar 30, 2013
232525f
Merge branch '2.2'
weaverryan Mar 30, 2013
381e578
Merge branch 'deprecated' of github.com:fabpot/symfony-docs into fabp…
weaverryan Mar 30, 2013
3f481a9
Merge branch '2.2'
weaverryan Mar 30, 2013
1a41cf4
Merge branch '2.2'
weaverryan Mar 30, 2013
c7c215f
Merge pull request #2352 from fabpot/console-events
weaverryan Mar 30, 2013
5e502ea
[#2352] Minor tweaks to new console events section
weaverryan Mar 30, 2013
5f0aba7
[SecurityBundle] Document multiple IP matching in rules
danfinnie Mar 31, 2013
87dd61e
Merge branch '2.2'
weaverryan Mar 31, 2013
de47600
Merge branch 'http_method_override' of github.com:hacfi/symfony-docs …
weaverryan Mar 31, 2013
67cc5d1
Merge branch '2.2'
weaverryan Mar 31, 2013
647fd97
[#2355] Updating note about _method activation for 2.3
weaverryan Mar 31, 2013
cf5683a
[TwigBundle] document new autoescape features
Apr 3, 2013
6b4794c
Merge branch '2.2'
weaverryan Apr 4, 2013
4c9b689
Added documentation for the Intl component
webmozart Mar 15, 2013
cfea950
Fixed quirks in the Intl documentation
webmozart Mar 17, 2013
5921a7b
Document PhpSessionStorage
Apr 6, 2013
0437733
Update index
Apr 6, 2013
5f41570
Document start on demand feature.
Apr 6, 2013
9d7cab4
Correct markup
Apr 6, 2013
67a5ecd
Added nortes as per @stof's recommendation.
Apr 6, 2013
793e570
Style fixes
Apr 6, 2013
6374b08
Console table helper
umpirsky Apr 6, 2013
e9ee243
Update values.
Apr 6, 2013
bdc8378
formatting
Apr 6, 2013
852a205
formatting
Apr 6, 2013
df35697
added documentation for the new Debug component
fabpot Apr 7, 2013
35513bc
Fix type and clarify behaviour
Apr 11, 2013
64da9d7
Improved Intl documentation based on the PR comments
webmozart Apr 11, 2013
38bbca1
Merge branch '2.2'
weaverryan Apr 11, 2013
6c88364
Added documentation for buttons in forms
webmozart Apr 11, 2013
8c270f7
Merge pull request #2479 from fabpot/debug-component
weaverryan Apr 11, 2013
af19a75
Merge branch '2.2'
weaverryan Apr 11, 2013
1dcfe8d
[#2479] Minor tweak for new debug article
weaverryan Apr 11, 2013
8899b92
Previous session options to security configuration
fredjiles Apr 12, 2013
beaf27c
Add space after #
fredjiles Apr 12, 2013
88b88e5
Fixed spelling and grammar errors
webmozart Apr 13, 2013
318ba88
Added information about the new form(), form_start() and form_end() h…
webmozart Jan 2, 2013
39c66ce
Sync with PR class name change.
Apr 13, 2013
ae77706
Add cookbook entry.
Apr 13, 2013
6364989
[Process] Add documentation about `signal` and `getPid` methods
romainneutron Apr 14, 2013
c28c3ae
document the doctrine compiler pass
dbu Apr 15, 2013
b0ad44d
Merge branch '2.2'
weaverryan Apr 15, 2013
a0ba793
Merge branch '2.2'
weaverryan Apr 15, 2013
b26c323
[#1465] Re-adding debug component note
weaverryan Apr 15, 2013
2b235f9
cs cleanup
dbu Apr 16, 2013
d0cdd65
Merge branch '2.2'
weaverryan Apr 17, 2013
106cbef
Merge pull request #2473 from umpirsky/feature/console-helper-table
weaverryan Apr 17, 2013
ed05a78
[#2473] Minor tweaks to new console table helper
weaverryan Apr 17, 2013
cab63ca
Documented that the Optional and Required constraints were moved to t…
webmozart Apr 17, 2013
794fc5d
adding doc for mongodb
dbu Apr 17, 2013
fee3675
Renamed TypeTestCase namespace
wouterj Apr 13, 2013
0763900
Documented the usage of FormInterface::handleRequest
webmozart Apr 20, 2013
330b388
Added Iban constraint documentation
sprain Apr 20, 2013
8015ed6
[Process] Add documentation about ProcessBuilder::setPrefix method
romainneutron Apr 20, 2013
d79e7df
[reference][constraints] Adding documentation for the Isbn validation.
aitboudad Apr 21, 2013
0591adf
Added Some updates
aitboudad Apr 21, 2013
95389db
Add information about CIDR notation support in trusted proxy list
lazyhammer Mar 9, 2013
7f89c45
Merge pull request #2092 from bschussek/issue5493
weaverryan Apr 21, 2013
adf8989
[#2092] Minor tweaks to new form request handlers and corresponding t…
weaverryan Apr 21, 2013
926b7d3
[#2092] Tweaks thanks to @bschussek
weaverryan Apr 22, 2013
8040775
[#2092] Tweaks thanks to @bschussek
weaverryan Apr 22, 2013
838bb8b
[2.3] Add note about implemented version
aitboudad Apr 22, 2013
1d1e77c
Define missed $command variable
Apr 22, 2013
230b1f9
Merge branch '2.2'
weaverryan Apr 24, 2013
48e7ded
[Intl] Making changes related to the new Intl component and form type…
weaverryan Apr 24, 2013
fc33816
Added missing reference configuration
Apr 24, 2013
4346f75
Removed versionadded:: 2.1 directives
wouterj Apr 24, 2013
40d32d5
updated documentation for BrowserKit
fabpot Apr 25, 2013
9147740
Add note about the additional verbosity flags
Seldaek Apr 25, 2013
bb48899
Update verbosity docs
Seldaek Apr 25, 2013
b654800
Removed notion "bind" from the documentation
webmozart Apr 25, 2013
0c53c5e
Renamed PropertyAccess::getPropertyAccessor to createPropertyAccessor
webmozart Apr 25, 2013
7b3e12c
Merge branch 'patch-1' of github.com:lmcd/symfony-docs into lmcd-patch-1
weaverryan Apr 25, 2013
f9b8d1a
Merge branch 'issue5899' of github.com:bschussek/symfony-docs into bs…
weaverryan Apr 25, 2013
b7bb147
[#2107] Adding redirect map for moved entry
weaverryan Apr 25, 2013
9855c3a
Validation Constraints Reference: Isbn
aitboudad Apr 25, 2013
6b087ee
[#2107] Fixing a few more references to the old "virtual" option and …
weaverryan Apr 25, 2013
a66f99b
Merge pull request #2270 from marcosQuesada/serializer/denormalize-ca…
weaverryan Apr 26, 2013
047b9fe
[#2270] Tweaks to new serializer features in 2.3
weaverryan Apr 26, 2013
8a03f2e
Merge branch 'remove-bind' of github.com:bschussek/symfony-docs into …
weaverryan Apr 26, 2013
50cd5c3
[#2557] Minor tweaks to bind -> submit change
weaverryan Apr 26, 2013
718764a
Merge branch '2.2'
weaverryan Apr 26, 2013
d9210db
updated route
bamarni Feb 6, 2013
6ff4b1b
fixed typo
bamarni Feb 6, 2013
cd824e0
[#2221] More tweaks to routing movement in standard distribution
weaverryan Apr 26, 2013
af8bd77
Merge pull request #2287 from lazyhammer/trusted-proxies-cidr
weaverryan Apr 26, 2013
5c262d0
Merge pull request #2442 from danfinnie/multiple_ip_matching
weaverryan Apr 26, 2013
450cecd
added the new collect flag for the profiler
fabpot Apr 26, 2013
9aaab74
Merge pull request #2459 from maxbeutel/pr/custom-template-escaping
weaverryan Apr 27, 2013
ba4eadf
[#2459] Adding notes about new autoescape feature
weaverryan Apr 27, 2013
c1142dc
Merge pull request #2474 from drak/session_php
weaverryan Apr 27, 2013
7948332
Merge branch '2.2'
weaverryan Apr 27, 2013
73e5095
[#2474] Tweaks to new legacy session feature
weaverryan Apr 27, 2013
337707f
Add versionadded
Seldaek Apr 27, 2013
cce4b51
Added a sidebar about potential deployment problems with ICU
webmozart Apr 28, 2013
2bc754d
Document ignoreUnreadableDirs
tvlooy Apr 29, 2013
bd3e58e
Merge pull request #2475 from drak/session_demand
weaverryan Apr 29, 2013
7f288dc
[#2475] Tweaks to new session on-demand docs
weaverryan Apr 29, 2013
7992c57
Merge branch 'intl' of github.com:bschussek/symfony-docs into bschuss…
weaverryan Apr 29, 2013
019bed7
[#2312] Minor tweaks for new intl component documentation
weaverryan Apr 30, 2013
c2bb5a0
Revert "[#2475] Tweaks to new session on-demand docs"
weaverryan Apr 30, 2013
94d11ef
Revert "Merge pull request #2475 from drak/session_demand"
weaverryan Apr 30, 2013
786b530
Merge branch 'bschussek-intl'
weaverryan Apr 30, 2013
9262923
Merge pull request #2549 from fabpot/browserkit-client
weaverryan Apr 30, 2013
fa46c13
Merge branch '2.2'
weaverryan Apr 30, 2013
dbe0e62
Merge remote-tracking branch 'origin/master'
weaverryan Apr 30, 2013
227ba82
removed non-MIT/BSD licensed code from Symfony SE
fabpot Apr 26, 2013
543ea76
Adds documentation for the new ISSN validator
ajgarlag May 1, 2013
69d65a7
Merge pull request #2500 from WouterJ/form_type_test
weaverryan May 3, 2013
4c5b0c4
Merge branch '2.2'
weaverryan May 3, 2013
40af9fa
Merge remote-tracking branch 'origin/master'
weaverryan May 3, 2013
727dcf6
[#2571] Documented multiselect feature
wouterj May 3, 2013
789b8f8
Updated sidebar to use Debug component
wouterj May 3, 2013
635c8c8
Added documentation for the EqualConstraint
wouterj May 3, 2013
48ca4f0
Added docs for NotEqualTo validator
wouterj May 3, 2013
372e800
Added docs for IdenticalTo validator
wouterj May 3, 2013
f901935
Added docs for NotIdenticalTo validator
wouterj May 3, 2013
7793b2b
[#2531] Documented dumpFile
wouterj May 3, 2013
d963be9
Merge branch 'issue5383' of github.com:bschussek/symfony-docs into bs…
weaverryan May 3, 2013
bdb3715
[#2489] Minor tweaks to new buttons functionality
weaverryan May 3, 2013
5b8119d
Merge pull request #2561 from fabpot/symfony-se
weaverryan May 3, 2013
a21215f
[#2561] Removing one more reference to JMSSecurityExtraBundle
weaverryan May 3, 2013
ae82f73
Merge pull request #2498 from fredjiles/auth-previous-session
weaverryan May 3, 2013
bfebe0d
[#2498] Adding a few more details about new require_previous_session …
weaverryan May 3, 2013
58d4341
Merge branch 'process-signal-pid' of github.com:romainneutron/symfony…
weaverryan May 3, 2013
fb26a8f
[#2504] Tweaks to new Process signal and pid docs
weaverryan May 3, 2013
790cbf2
Merge branch '2.2'
weaverryan May 3, 2013
40ff3cb
Merge branch 'master' into romainneutron-process-signal-pid
weaverryan May 3, 2013
23a28d7
Merge branch '2.2'
weaverryan May 3, 2013
46f3ffb
Merge branch 'master' into romainneutron-process-signal-pid
weaverryan May 3, 2013
bf18528
Merge pull request #2507 from dbu/document-reusable-bundle-model
weaverryan May 3, 2013
95b28fa
Merge branch '2.2'
weaverryan May 3, 2013
b596c88
Merge remote-tracking branch 'origin/master'
weaverryan May 3, 2013
91fce06
[#2507] Tweaks for new compiler pass entry
weaverryan May 3, 2013
ea25d7c
Merge pull request #2512 from bschussek/move-existence-constraints
weaverryan May 3, 2013
a848e7b
Merge pull request #2521 from sprain/IbanConstraint
weaverryan May 3, 2013
57b4b00
[#2521] Adding versionadded note to Iban
weaverryan May 3, 2013
e6efa63
Merge pull request #2524 from romainneutron/processbuilder-setprefix
weaverryan May 3, 2013
77d72a9
[#2524] Minor tweak for ProcessBuilder::setPrefix
weaverryan May 3, 2013
e0c7c13
Merge branch 'master' of github.com:Aitboudad/symfony-docs into Aitbo…
weaverryan May 3, 2013
4ec619a
[#2528] Minor tweaks for new Isbn constraint documentation
weaverryan May 3, 2013
860f814
Merge pull request #2540 from unkind/master
weaverryan May 3, 2013
b6c36d2
Merge pull request #2539 from ajgarlag/issn-validator
weaverryan May 4, 2013
5821250
[#2539] Minor tweaks for new Issn constraint
weaverryan May 4, 2013
d0b29cc
Merge pull request #2546 from blaugueux/patch-1
weaverryan May 4, 2013
eb11780
Merge branch 'versionadded_23' of github.com:WouterJ/symfony-docs int…
weaverryan May 4, 2013
300b71a
Merge branch '2.2'
weaverryan May 4, 2013
bf1e064
[#2548] Removing some more 2.1 references
weaverryan May 4, 2013
0f745f4
Merge pull request #2554 from Seldaek/verbosityflags
weaverryan May 4, 2013
2fe611b
Merge pull request #2558 from bschussek/issue7854
weaverryan May 4, 2013
f04c2db
Merge pull request #2565 from fabpot/profiler-activation
weaverryan May 4, 2013
77d920f
[#2565] Tweaks to new profiler.collect options
weaverryan May 4, 2013
2d79a32
Merge branch '2.2'
weaverryan May 4, 2013
c0a09d2
Merge pull request #2576 from tvlooy/patch-8
weaverryan May 4, 2013
71b44c8
Merge remote-tracking branch 'origin/master'
weaverryan May 4, 2013
27dbceb
[#2576] Tweaks to Finder::ignoreUnreadableDirs docs
weaverryan May 4, 2013
80a0264
Merge branch '2.2'
weaverryan May 4, 2013
fef0195
Added docs for LessThan validator
wouterj May 4, 2013
030d05c
Added docs for LessThanOrEqual validator
wouterj May 4, 2013
956f5fc
Added docs for GreaterThan validator
wouterj May 4, 2013
6f261f4
Added docs for GreaterThanOrEqual validator
wouterj May 4, 2013
3bea05d
documented Crawler::html()
pvolok May 5, 2013
1ebbe71
Merge pull request #2589 from WouterJ/issue_2571
weaverryan May 5, 2013
50d6886
[#2589] Minor tweaks to DialogHelper multi-select changes
weaverryan May 5, 2013
05f1aaf
Merge pull request #2592 from WouterJ/issue_2531
weaverryan May 5, 2013
80c3fb3
[#2592] Minor tweaks for Filesystem::dumpFile
weaverryan May 5, 2013
1d50d04
Merge pull request #2593 from WouterJ/issue_2569
weaverryan May 5, 2013
8a026ea
Merge pull request #2599 from WouterJ/document_equal_validators
weaverryan May 5, 2013
98c0ff6
[#2565] Fixing a bad merge conflict
weaverryan May 5, 2013
e7d1a58
Merge branch '2.2'
weaverryan May 6, 2013
83046d3
Fixing duplicate target "enabled"
weaverryan May 6, 2013
4542e06
[#2599] Minor tweaks to a bunch of new constraints documented by @Wou…
weaverryan May 6, 2013
c9b65d0
Merge pull request #2602 from pvolok/crawler_html
weaverryan May 6, 2013
e76f69f
Merge branch '2.2'
weaverryan May 6, 2013
9dc1b5f
[#2602] Adding 2.3 note about new Crawler::html method
weaverryan May 6, 2013
50905ff
Adding lazy services documentation as of symfony/symfony#7890
Ocramius May 7, 2013
c3c3e98
[Components][Console] Fixed typos for table helper
pierredup May 8, 2013
f546b9e
Merge branch '2.2'
weaverryan May 9, 2013
931091d
Applying changes suggested by @WouterJ, adding lazy_services to compo…
Ocramius May 9, 2013
abe537f
Merge pull request #2624 from pierredup/master
weaverryan May 10, 2013
438c824
Made the Icu component compatible with ICU 3.8
webmozart May 15, 2013
a981ae7
Merge pull request #2640 from bschussek/icu-3.8
weaverryan May 16, 2013
a2bc822
Merge pull request #2619 from Ocramius/feature/proxy-manager-bridge
weaverryan May 16, 2013
d7ea3a5
[#2619] Tweaks for new proxy/lazy services entry
weaverryan May 16, 2013
2b7dcf9
Merge branch '2.2'
weaverryan May 16, 2013
ca6d87a
Formatting fix and additional example
mpdude May 14, 2013
1c2ff32
removed double "the"
mpdude May 14, 2013
f20b2e3
Capitalization
mpdude May 14, 2013
59d6e6e
Merge branch '2.2' into 2.3
weaverryan May 18, 2013
4c06860
Merge branch '2.3'
weaverryan May 18, 2013
86d7d76
[Book/Form] minor fix, superfluous word
gregquat May 21, 2013
754adc9
removed unneeded block
bamarni May 23, 2013
b140d5c
add documentation for the use of __call with propertyAccess
jaugustin Apr 6, 2013
b1e5180
Fixed actual symfony number
falinsky May 19, 2013
50147d9
Merge pull request #2648 from gregquat/patch-13
weaverryan May 26, 2013
ddb2b9d
Merge pull request #2659 from bamarni/patch-8
weaverryan May 26, 2013
23a016c
[#2312] Fixing typo thanks to @staabm
weaverryan May 28, 2013
bf67517
Merge branch '2.2' into 2.3
weaverryan May 29, 2013
030a6f8
Merge branch '2.3'
weaverryan May 29, 2013
068cfd8
Updated XSSI Json Hijacking Caution
J7mbo Jun 7, 2013
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions book/controller.rst
Original file line number Diff line number Diff line change
Expand Up @@ -325,7 +325,7 @@ working with forms, for example::
{
$form = $this->createForm(...);

$form->bind($request);
$form->handleRequest($request);
// ...
}

Expand Down Expand Up @@ -663,7 +663,8 @@ For example, imagine you're processing a form submit::
{
$form = $this->createForm(...);

$form->bind($this->getRequest());
$form->handleRequest($this->getRequest());

if ($form->isValid()) {
// do some sort of processing

Expand Down
422 changes: 293 additions & 129 deletions book/forms.rst

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion book/from_flat_php_to_symfony2.rst
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@ content:

{
"require": {
"symfony/symfony": "2.2.*"
"symfony/symfony": "2.3.*"
},
"autoload": {
"files": ["model.php","controllers.php"]
Expand Down
3 changes: 0 additions & 3 deletions book/internals.rst
Original file line number Diff line number Diff line change
Expand Up @@ -367,9 +367,6 @@ The ``FrameworkBundle`` registers several listeners:
``kernel.terminate`` Event
..........................

.. versionadded:: 2.1
The ``kernel.terminate`` event is new since Symfony 2.1.

The purpose of this event is to perform "heavier" tasks after the response
was already served to the client.

Expand Down
4 changes: 0 additions & 4 deletions book/page_creation.rst
Original file line number Diff line number Diff line change
Expand Up @@ -586,7 +586,6 @@ method of the ``AppKernel`` class::
new Symfony\Bundle\DoctrineBundle\DoctrineBundle(),
new Symfony\Bundle\AsseticBundle\AsseticBundle(),
new Sensio\Bundle\FrameworkExtraBundle\SensioFrameworkExtraBundle(),
new JMS\SecurityExtraBundle\JMSSecurityExtraBundle(),
);

if (in_array($this->getEnvironment(), array('dev', 'test'))) {
Expand Down Expand Up @@ -813,9 +812,6 @@ options of each feature.
Default Configuration Dump
~~~~~~~~~~~~~~~~~~~~~~~~~~

.. versionadded:: 2.1
The ``config:dump-reference`` command was added in Symfony 2.1

You can dump the default configuration for a bundle in yaml to the console using
the ``config:dump-reference`` command. Here is an example of dumping the default
FrameworkBundle configuration:
Expand Down
2 changes: 1 addition & 1 deletion book/routing.rst
Original file line number Diff line number Diff line change
Expand Up @@ -788,7 +788,7 @@ a slash. URLs matching this route might look like:
.. note::

Sometimes you want to make certain parts of your routes globally configurable.
Symfony2.1 provides you with a way to do this by leveraging service container
Symfony provides you with a way to do this by leveraging service container
parameters. Read more about this in ":doc:`/cookbook/routing/service_container_parameters`.

Special Routing Parameters
Expand Down
29 changes: 12 additions & 17 deletions book/security.rst
Original file line number Diff line number Diff line change
Expand Up @@ -410,11 +410,6 @@ submission (i.e. ``/login_check``):
URL as the firewall will automatically catch and process any form submitted
to this URL.

.. versionadded:: 2.1
As of Symfony 2.1, you *must* have routes configured for your ``login_path``,
``check_path`` ``logout`` keys. These keys can be route names (as shown
in this example) or URLs that have routes configured for them.

Notice that the name of the ``login`` route matches the``login_path`` config
value, as that's where the security system will redirect users that need
to login.
Expand Down Expand Up @@ -770,7 +765,7 @@ access control should be used on this request. The following ``access_control``
options are used for matching:

* ``path``
* ``ip``
* ``ip`` or ``ips``
* ``host``
* ``methods``

Expand Down Expand Up @@ -877,6 +872,11 @@ prevent any direct access to these resources from a web browser (by guessing the
ESI URL pattern), the ESI route **must** be secured to be only visible from
the trusted reverse proxy cache.

.. versionadded:: 2.3
Version 2.3 allows multiple IP addresses in a single rule with the ``ips: [a, b]``
construct. Prior to 2.3, users should create one rule per IP address to match and
use the ``ip`` key instead of ``ips``.

Here is an example of how you might secure all ESI routes that start with a
given prefix, ``/esi``, from outside access:

Expand All @@ -888,36 +888,37 @@ given prefix, ``/esi``, from outside access:
security:
# ...
access_control:
- { path: ^/esi, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 }
- { path: ^/esi, roles: IS_AUTHENTICATED_ANONYMOUSLY, ips: [127.0.0.1, ::1] }
- { path: ^/esi, roles: ROLE_NO_ACCESS }

.. code-block:: xml

<access-control>
<rule path="^/esi" role="IS_AUTHENTICATED_ANONYMOUSLY" ip="127.0.0.1" />
<rule path="^/esi" role="IS_AUTHENTICATED_ANONYMOUSLY" ips="127.0.0.1, ::1" />
<rule path="^/esi" role="ROLE_NO_ACCESS" />
</access-control>

.. code-block:: php

'access_control' => array(
array('path' => '^/esi', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY', 'ip' => '127.0.0.1'),
array('path' => '^/esi', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY', 'ips' => '127.0.0.1, ::1'),
array('path' => '^/esi', 'role' => 'ROLE_NO_ACCESS'),
),

Here is how it works when the path is ``/esi/something`` coming from the
``10.0.0.1`` IP:

* The first access control rule is ignored as the ``path`` matches but the
``ip`` does not;
``ip`` does not match either of the IPs listed;

* The second access control rule is enabled (the only restriction being the
``path`` and it matches): as the user cannot have the ``ROLE_NO_ACCESS``
role as it's not defined, access is denied (the ``ROLE_NO_ACCESS`` role can
be anything that does not match an existing role, it just serves as a trick
to always deny access).

Now, if the same request comes from ``127.0.0.1``:
Now, if the same request comes from ``127.0.0.1`` or ``::1`` (the IPv6 loopback
address):

* Now, the first access control rule is enabled as both the ``path`` and the
``ip`` match: access is allowed as the user always has the
Expand Down Expand Up @@ -1161,12 +1162,6 @@ custom user class is that it implements the :class:`Symfony\\Component\\Security
interface. This means that your concept of a "user" can be anything, as long
as it implements this interface.

.. versionadded:: 2.1
In Symfony 2.1, the ``equals`` method was removed from ``UserInterface``.
If you need to override the default implementation of comparison logic,
implement the new :class:`Symfony\\Component\\Security\\Core\\User\\EquatableInterface`
interface.

.. note::

The user object will be serialized and saved in the session during requests,
Expand Down
4 changes: 0 additions & 4 deletions book/service_container.rst
Original file line number Diff line number Diff line change
Expand Up @@ -227,10 +227,6 @@ The end result is exactly the same as before - the difference is only in
to look for parameters with those names. When the container is built, it
looks up the value of each parameter and uses it in the service definition.

.. versionadded:: 2.1
Escaping the ``@`` character in YAML parameter values is new in Symfony 2.1.9
and Symfony 2.2.1.

.. note::

If you want to use a string that starts with an ``@`` sign as a parameter
Expand Down
6 changes: 0 additions & 6 deletions book/templating.rst
Original file line number Diff line number Diff line change
Expand Up @@ -665,9 +665,6 @@ Controllers are fast to execute and promote good code organization and reuse.
Asynchronous Content with hinclude.js
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.. versionadded:: 2.1
hinclude.js support was added in Symfony 2.1

Controllers can be embedded asynchronously using the hinclude.js_ javascript library.
As the embedded content comes from another page (or controller for that matter),
Symfony2 uses the standard ``render`` helper to configure ``hinclude`` tags:
Expand Down Expand Up @@ -1409,9 +1406,6 @@ is ``true``. By default this means that the variables will be dumped in the
Syntax Checking
---------------

.. versionadded:: 2.1
The ``twig:lint`` command was added in Symfony 2.1

You can check for syntax errors in Twig templates using the ``twig:lint``
console command:

Expand Down
14 changes: 14 additions & 0 deletions book/testing.rst
Original file line number Diff line number Diff line change
Expand Up @@ -401,6 +401,10 @@ The Client supports many operations that can be done in a real browser::
Accessing Internal Objects
~~~~~~~~~~~~~~~~~~~~~~~~~~

.. versionadded:: 2.3
The ``getInternalRequest()`` and ``getInternalResponse()`` method were
added in Symfony 2.3.

If you use the client to test your application, you might want to access the
client's internal objects::

Expand All @@ -409,8 +413,18 @@ client's internal objects::

You can also get the objects related to the latest request::

// the HttpKernel request instance
$request = $client->getRequest();

// the BrowserKit request instance
$request = $client->getInternalRequest();

// the HttpKernel response instance
$response = $client->getResponse();

// the BrowserKit response instance
$response = $client->getInternalResponse();

$crawler = $client->getCrawler();

If your requests are not insulated, you can also access the ``Container`` and
Expand Down
8 changes: 0 additions & 8 deletions book/translation.rst
Original file line number Diff line number Diff line change
Expand Up @@ -554,11 +554,6 @@ by defining a ``default_locale`` for the framework:
'default_locale' => 'en',
));

.. versionadded:: 2.1
The ``default_locale`` parameter was defined under the session key
originally, however, as of 2.1 this has been moved. This is because the
locale is now set on the request instead of the session.

.. _book-translation-locale-url:

The Locale and the URL
Expand Down Expand Up @@ -825,9 +820,6 @@ texts* and complex expressions:
Note that this only influences the current template, not any "included"
templates (in order to avoid side effects).

.. versionadded:: 2.1
The ``trans_default_domain`` tag is new in Symfony2.1

PHP Templates
~~~~~~~~~~~~~

Expand Down
14 changes: 6 additions & 8 deletions book/validation.rst
Original file line number Diff line number Diff line change
Expand Up @@ -205,8 +205,8 @@ Validation and Forms
The ``validator`` service can be used at any time to validate any object.
In reality, however, you'll usually work with the ``validator`` indirectly
when working with forms. Symfony's form library uses the ``validator`` service
internally to validate the underlying object after values have been submitted
and bound. The constraint violations on the object are converted into ``FieldError``
internally to validate the underlying object after values have been submitted.
The constraint violations on the object are converted into ``FieldError``
objects that can easily be displayed with your form. The typical form submission
workflow looks like the following from inside a controller::

Expand All @@ -220,14 +220,12 @@ workflow looks like the following from inside a controller::
$author = new Author();
$form = $this->createForm(new AuthorType(), $author);

if ($request->isMethod('POST')) {
$form->bind($request);
$form->handleRequest($request);

if ($form->isValid()) {
// the validation passed, do something with the $author object
if ($form->isValid()) {
// the validation passed, do something with the $author object

return $this->redirect($this->generateUrl(...));
}
return $this->redirect($this->generateUrl(...));
}

return $this->render('BlogBundle:Author:form.html.twig', array(
Expand Down
5 changes: 0 additions & 5 deletions bundles/map.rst.inc
Original file line number Diff line number Diff line change
@@ -1,10 +1,5 @@
* :doc:`SensioFrameworkExtraBundle </bundles/SensioFrameworkExtraBundle/index>`
* :doc:`SensioGeneratorBundle </bundles/SensioGeneratorBundle/index>`
* `JMSSecurityExtraBundle`_
* `JMSDiExtraBundle`_
* :doc:`DoctrineFixturesBundle </bundles/DoctrineFixturesBundle/index>`
* :doc:`DoctrineMigrationsBundle </bundles/DoctrineMigrationsBundle/index>`
* :doc:`DoctrineMongoDBBundle </bundles/DoctrineMongoDBBundle/index>`

.. _`JMSSecurityExtraBundle`: http://jmsyst.com/bundles/JMSSecurityExtraBundle/1.2
.. _`JMSDiExtraBundle`: http://jmsyst.com/bundles/JMSDiExtraBundle/1.1
3 changes: 0 additions & 3 deletions components/class_loader.rst
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,6 @@ You can install the component in many different ways:
Usage
-----

.. versionadded:: 2.1
The ``useIncludePath`` method was added in Symfony 2.1.

Registering the :class:`Symfony\\Component\\ClassLoader\\UniversalClassLoader`
autoloader is straightforward::

Expand Down
2 changes: 1 addition & 1 deletion components/config/definition.rst
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ node definition. Node type are available for:
* scalar
* boolean
* array
* enum (new in 2.1)
* enum
* integer (new in 2.2)
* float (new in 2.2)
* variable (no validation)
Expand Down
Loading