Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 6544665

Browse filesBrowse files
wouterjwouterj
committed
Merge branch '2.3' into 2.7
2 parents 3165c70 + 2ab746e commit 6544665
Copy full SHA for 6544665

File tree

Expand file treeCollapse file tree

13 files changed

+151
-106
lines changed
Filter options
Expand file treeCollapse file tree

13 files changed

+151
-106
lines changed

‎best_practices/security.rst

Copy file name to clipboardExpand all lines: best_practices/security.rst
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ which uses a login form to load users from the database:
5757
pattern: ^/
5858
anonymous: true
5959
form_login:
60-
check_path: security_login_check
61-
login_path: security_login_form
60+
check_path: login
61+
login_path: login
6262
6363
logout:
6464
path: security_logout

‎book/configuration.rst

Copy file name to clipboardExpand all lines: book/configuration.rst
+10-4Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ format you prefer:
8787
8888
.. note::
8989

90-
You'll learn exactly how to load each file/format in the next section
91-
`Environments`_.
90+
You'll learn exactly how to load each file/format in the next section
91+
`Environments`_.
9292

9393
Each top-level entry like ``framework`` or ``twig`` defines the configuration
9494
for a particular bundle. For example, the ``framework`` key defines the configuration
@@ -122,13 +122,13 @@ FrameworkBundle configuration:
122122

123123
.. code-block:: bash
124124
125-
$ app/console config:dump-reference FrameworkBundle
125+
$ php app/console config:dump-reference FrameworkBundle
126126
127127
The extension alias (configuration key) can also be used:
128128

129129
.. code-block:: bash
130130
131-
$ app/console config:dump-reference framework
131+
$ php app/console config:dump-reference framework
132132
133133
.. note::
134134

@@ -195,6 +195,12 @@ cached files and allow them to rebuild:
195195
be accessed directly through the browser. See the :doc:`testing chapter </book/testing>`
196196
for more details.
197197

198+
.. tip::
199+
200+
When using the ``server:run`` command to start a server,
201+
``http://localhost:8000/`` will use the dev front controller of your
202+
application.
203+
198204
.. index::
199205
single: Environments; Configuration
200206

‎book/page_creation.rst

Copy file name to clipboardExpand all lines: book/page_creation.rst
+6-15Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,12 @@ a method inside of it that will be executed when someone goes to ``/lucky/number
5959

6060
Before diving into this, test it out!
6161

62-
http://localhost:8000/app_dev.php/lucky/number
62+
http://localhost:8000/lucky/number
6363

6464
.. tip::
6565

66-
If you setup a proper virtual host in :doc:`Apache or Nginx </cookbook/configuration/web_server_configuration>`,
66+
If you set up a proper virtual host in
67+
:doc:`Apache or Nginx </cookbook/configuration/web_server_configuration>`,
6768
replace ``http://localhost:8000`` with your host name - like
6869
``http://symfony.dev/app_dev.php/lucky/number``.
6970

@@ -80,16 +81,6 @@ and is where you build the page. The only rule is that a controller *must*
8081
return a Symfony :ref:`Response <component-http-foundation-response>` object
8182
(and you'll even learn to bend this rule eventually).
8283

83-
.. sidebar:: What's the ``app_dev.php`` in the URL?
84-
85-
Great question! By including ``app_dev.php`` in the URL, you're executing
86-
Symfony through a file - ``web/app_dev.php`` - that boots it in the ``dev``
87-
environment. This enables great debugging tools and rebuilds cached
88-
files automatically. For production, you'll use clean URLs - like
89-
``http://localhost:8000/lucky/number`` - that execute a different file -
90-
``app.php`` - that's optimized for speed. To learn more about this and
91-
environments, see :ref:`book-page-creation-prod-cache-clear`.
92-
9384
Creating a JSON Response
9485
~~~~~~~~~~~~~~~~~~~~~~~~
9586

@@ -126,7 +117,7 @@ Just add a second method to ``LuckyController``::
126117

127118
Try this out in your browser:
128119

129-
http://localhost:8000/app_dev.php/api/lucky/number
120+
http://localhost:8000/api/lucky/number
130121

131122
You can even shorten this with the handy :class:`Symfony\\Component\\HttpFoundation\\JsonResponse`::
132123

@@ -247,7 +238,7 @@ The best part is that you can access this value and use it in your controller::
247238

248239
Try it by going to ``/lucky/number/XX`` - replacing XX with *any* number:
249240

250-
http://localhost:8000/app_dev.php/lucky/number/7
241+
http://localhost:8000/lucky/number/7
251242

252243
You should see *7* lucky numbers printed out! You can get the value of any
253244
``{placeholder}`` in your route by adding a ``$placeholder`` argument to
@@ -404,7 +395,7 @@ to put the content into the middle of the ``base.html.twig`` layout.
404395

405396
Refresh to see your template in action!
406397

407-
http://localhost:8000/app_dev.php/lucky/number/9
398+
http://localhost:8000/lucky/number/9
408399

409400
If you view the source code, you now have a basic HTML structure thanks to
410401
``base.html.twig``.

‎book/security.rst

Copy file name to clipboardExpand all lines: book/security.rst
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1207,6 +1207,14 @@ is defined by the ``target`` parameter above (e.g. the ``homepage``).
12071207
:class:`Symfony\\Component\\Security\\Http\\Logout\\LogoutSuccessHandlerInterface`.
12081208
See :doc:`Security Configuration Reference </reference/configuration/security>`.
12091209

1210+
.. caution::
1211+
1212+
Notice that when using http-basic authenticated firewalls, there is no
1213+
real way to log out : the only way to *log out* is to have the browser
1214+
stop sending your name and password on every request. Clearing your
1215+
browser cache or restarting your browser usually helps. Some web developer
1216+
tools might be helpful here too.
1217+
12101218
.. _`security-encoding-password`:
12111219

12121220
Dynamically Encoding a Password

‎changelog.rst

Copy file name to clipboardExpand all lines: changelog.rst
+65Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,71 @@ documentation.
1313
Do you also want to participate in the Symfony Documentation? Take a look
1414
at the ":doc:`/contributing/documentation/overview`" article.
1515

16+
December, 2015
17+
--------------
18+
19+
New Documentation
20+
~~~~~~~~~~~~~~~~~
21+
22+
* `#5811 <https://github.com/symfony/symfony-docs/pull/5811>`_ Conversion from mysql to PDO (iqbalmalik89)
23+
* `#5962 <https://github.com/symfony/symfony-docs/pull/5962>`_ Simplify code example in "Adding custom extensions" section (snoek09)
24+
* `#6022 <https://github.com/symfony/symfony-docs/pull/6022>`_ clarify custom route loader documentation (dbu)
25+
* `#5994 <https://github.com/symfony/symfony-docs/pull/5994>`_ Updated the release process for Symfony 3.x and future releases (javiereguiluz)
26+
27+
Fixed Documentation
28+
~~~~~~~~~~~~~~~~~~~
29+
30+
* `#6063 <https://github.com/symfony/symfony-docs/pull/6063>`_ minor #5829 Fix broken composer command (JHGitty)
31+
* `#5904 <https://github.com/symfony/symfony-docs/pull/5904>`_ Update php_soap_extension.rst (xDaizu)
32+
* `#5819 <https://github.com/symfony/symfony-docs/pull/5819>`_ Remove AppBundle (roukmoute)
33+
34+
Minor Documentation Changes
35+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
36+
37+
* `#6043 <https://github.com/symfony/symfony-docs/pull/6043>`_ Mention commiting only bower.json (krike, WouterJ)
38+
* `#5848 <https://github.com/symfony/symfony-docs/pull/5848>`_ Added hints to spool config section (martinczerwi)
39+
* `#6042 <https://github.com/symfony/symfony-docs/pull/6042>`_ some tweaks to unit testing form types (xabbuh)
40+
* `#6059 <https://github.com/symfony/symfony-docs/pull/6059>`_ Add best practice about the Form type namespace (WouterJ)
41+
* `#6068 <https://github.com/symfony/symfony-docs/pull/6068>`_ Remove references to API tagging (dunglas)
42+
* `#6088 <https://github.com/symfony/symfony-docs/pull/6088>`_ Update validation.rst (syedi)
43+
* `#6085 <https://github.com/symfony/symfony-docs/pull/6085>`_ Update validation.rst (syedi)
44+
* `#6094 <https://github.com/symfony/symfony-docs/pull/6094>`_ [Form] Added a missing php opening tag (dev-symfony-void)
45+
* `#5840 <https://github.com/symfony/symfony-docs/pull/5840>`_ [Contributing] [Standards] Add note about `trigger_error()` and deprecation messages (phansys)
46+
* `#6050 <https://github.com/symfony/symfony-docs/pull/6050>`_ Lots of minor fixes & applying best practices to form cookbook doc (ThomasLandauer, WouterJ)
47+
* `#5570 <https://github.com/symfony/symfony-docs/pull/5570>`_ Quick review of 'create framework' tutorial (WouterJ)
48+
* `#5445 <https://github.com/symfony/symfony-docs/pull/5445>`_ Reworded the explanation about the kernel.event_listener tag (javiereguiluz)
49+
* `#6054 <https://github.com/symfony/symfony-docs/pull/6054>`_ Remove 2.8 branch from patch documentation (Triiistan)
50+
* `#6057 <https://github.com/symfony/symfony-docs/pull/6057>`_ Fix PHP code for registering service (WouterJ)
51+
* `#6063 <https://github.com/symfony/symfony-docs/pull/6063>`_ minor #5829 Fix broken composer command (JHGitty)
52+
* `#6041 <https://github.com/symfony/symfony-docs/pull/6041>`_ Fixed misspelling of human in glossary.rst YAML (Wasserschlange)
53+
* `#6049 <https://github.com/symfony/symfony-docs/pull/6049>`_ Finish #5798 Add app_ prefix to form type names (OskarStark, WouterJ)
54+
* `#5829 <https://github.com/symfony/symfony-docs/pull/5829>`_ use composer command instead of editing json file (OskarStark)
55+
* `#6046 <https://github.com/symfony/symfony-docs/pull/6046>`_ Update framework.rst (typo in sesssion) (patrick-mota)
56+
* `#5890 <https://github.com/symfony/symfony-docs/pull/5890>`_ Updated article for modern Symfony practices and the use of bcrypt (javiereguiluz)
57+
* `#6015 <https://github.com/symfony/symfony-docs/pull/6015>`_ [Assetic] complete XML configuration examples (xabbuh)
58+
* `#5963 <https://github.com/symfony/symfony-docs/pull/5963>`_ Add note about 'phar extension' dependency (snoek09)
59+
* `#6006 <https://github.com/symfony/symfony-docs/pull/6006>`_ [Book] use AppBundle examples and follow best practices (xabbuh)
60+
* `#6016 <https://github.com/symfony/symfony-docs/pull/6016>`_ Corrected the line references for the basic controller example (theTeddyBear)
61+
* `#5446 <https://github.com/symfony/symfony-docs/pull/5446>`_ [Contributing] [Standards] Added note about phpdoc_separation (phansys)
62+
* `#5820 <https://github.com/symfony/symfony-docs/pull/5820>`_ Fixed an issue with command option shortcuts (javiereguiluz)
63+
* `#6033 <https://github.com/symfony/symfony-docs/pull/6033>`_ Fix Typo (Shine-neko)
64+
* `#6011 <https://github.com/symfony/symfony-docs/pull/6011>`_ Fixed formatting issues (javiereguiluz)
65+
* `#6012 <https://github.com/symfony/symfony-docs/pull/6012>`_ Use HTTPS for downloading the Symfony Installer (javiereguiluz)
66+
* `#6009 <https://github.com/symfony/symfony-docs/pull/6009>`_ Fix missing constant usage for generating urls (Tobion)
67+
* `#5965 <https://github.com/symfony/symfony-docs/pull/5965>`_ Removing php opening tags (Deamon)
68+
* `#6003 <https://github.com/symfony/symfony-docs/pull/6003>`_ #5999 fix files names (vincentaubert)
69+
* `#5996 <https://github.com/symfony/symfony-docs/pull/5996>`_ Clarify example for SUBMIT form event (bkosborne)
70+
* `#6000 <https://github.com/symfony/symfony-docs/pull/6000>`_ Update registration_form.rst (afurculita)
71+
* `#5989 <https://github.com/symfony/symfony-docs/pull/5989>`_ Fix words according context (richardpq)
72+
* `#5992 <https://github.com/symfony/symfony-docs/pull/5992>`_ More use single quotes for YAML strings (snoek09)
73+
* `#5959 <https://github.com/symfony/symfony-docs/pull/5959>`_ Fix #5912 Ambiguity on Access Decision Manager's Strategy (Pierre Maraitre)
74+
* `#5955 <https://github.com/symfony/symfony-docs/pull/5955>`_ use single quotes for YAML strings (snoek09)
75+
* `#5979 <https://github.com/symfony/symfony-docs/pull/5979>`_ [Book] Do not extend the base controller before introducing it (ogizanagi)
76+
* `#5970 <https://github.com/symfony/symfony-docs/pull/5970>`_ Remove isSubmitted call (DanielSiepmann)
77+
* `#5972 <https://github.com/symfony/symfony-docs/pull/5972>`_ Add isSubmitted call (DanielSiepmann)
78+
* `#5961 <https://github.com/symfony/symfony-docs/pull/5961>`_ update from_flat_php_to_symfony2.rst (thao-witkam)
79+
80+
1681
November, 2015
1782
--------------
1883

‎components/security/secure_tools.rst

Copy file name to clipboardExpand all lines: components/security/secure_tools.rst
+11-14Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,25 @@ The Symfony Security component comes with a collection of nice utilities
55
related to security. These utilities are used by Symfony, but you should
66
also use them if you want to solve the problem they address.
77

8+
.. note::
9+
10+
The functions described in this article were introduced in PHP 5.6 or 7.
11+
For older PHP versions, a polyfill is provided by the
12+
`Symfony Polyfill Component`_.
13+
814
Comparing Strings
915
~~~~~~~~~~~~~~~~~
1016

1117
The time it takes to compare two strings depends on their differences. This
1218
can be used by an attacker when the two strings represent a password for
1319
instance; it is known as a `Timing attack`_.
1420

15-
Internally, when comparing two passwords, Symfony uses a constant-time
16-
algorithm; you can use the same strategy in your own code thanks to the
17-
:class:`Symfony\\Component\\Security\\Core\\Util\\StringUtils` class::
18-
19-
use Symfony\Component\Security\Core\Util\StringUtils;
21+
When comparing two passwords, you should use the :phpfunction:`hash_equals`
22+
function::
2023

21-
// is some known string (e.g. password) equal to some user input?
22-
$bool = StringUtils::equals($knownString, $userInput);
24+
if (hash_equals($knownString, $userInput)) {
25+
// ...
26+
}
2327

2428
Generating a Secure Random String
2529
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -49,12 +53,5 @@ use the :phpfunction:`random_int` function::
4953

5054
$random = random_int(1, 10);
5155

52-
.. note::
53-
54-
PHP 7 and up provide the ``random_bytes()`` and ``random_int()`` functions
55-
natively, for older versions of PHP a polyfill is provided by the
56-
`Symfony Polyfill Component`_ and the `paragonie/random_compat package`_.
57-
5856
.. _`Timing attack`: https://en.wikipedia.org/wiki/Timing_attack
5957
.. _`Symfony Polyfill Component`: https://github.com/symfony/polyfill
60-
.. _`paragonie/random_compat package`: https://github.com/paragonie/random_compat

‎cookbook/controller/error_pages.rst

Copy file name to clipboardExpand all lines: cookbook/controller/error_pages.rst
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ In that case, you might want to override one or both of the ``showAction()`` and
289289
# app/config/services.yml
290290
services:
291291
app.exception_controller:
292-
class: AppBundle\CustomExceptionController
292+
class: AppBundle\Controller\CustomExceptionController
293293
arguments: ['@twig', '%kernel.debug%']
294294
295295
.. code-block:: xml
@@ -320,6 +320,7 @@ In that case, you might want to override one or both of the ``showAction()`` and
320320
new Reference('twig'),
321321
'%kernel.debug%'
322322
));
323+
$container->setDefinition('app.exception_controller', $definition);
323324
324325
And then configure ``twig.exception_controller`` using the controller as
325326
services syntax (e.g. ``app.exception_controller:showAction``).

‎cookbook/email/dev_environment.rst

Copy file name to clipboardExpand all lines: cookbook/email/dev_environment.rst
+9-16Lines changed: 9 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -141,12 +141,9 @@ by adding the ``delivery_whitelist`` option:
141141
swiftmailer:
142142
delivery_address: dev@example.com
143143
delivery_whitelist:
144-
# all email addresses matching this regex will *not* be
145-
# redirected to dev@example.com
144+
# all email addresses matching these regexes will be delivered
145+
# like normal, as well as being sent to dev@example.com
146146
- '/@specialdomain\.com$/'
147-
148-
# all emails sent to admin@mydomain.com won't
149-
# be redirected to dev@example.com too
150147
- '/^admin@mydomain\.com$/'
151148
152149
.. code-block:: xml
@@ -162,10 +159,9 @@ by adding the ``delivery_whitelist`` option:
162159
http://symfony.com/schema/dic/swiftmailer http://symfony.com/schema/dic/swiftmailer/swiftmailer-1.0.xsd">
163160
164161
<swiftmailer:config delivery-address="dev@example.com">
165-
<!-- all email addresses matching this regex will *not* be redirected to dev@example.com -->
162+
<!-- all email addresses matching these regexes will be delivered
163+
like normal, as well as being sent to dev@example.com -->
166164
<swiftmailer:delivery-whitelist-pattern>/@specialdomain\.com$/</swiftmailer:delivery-whitelist-pattern>
167-
168-
<!-- all emails sent to admin@mydomain.com won't be redirected to dev@example.com too -->
169165
<swiftmailer:delivery-whitelist-pattern>/^admin@mydomain\.com$/</swiftmailer:delivery-whitelist-pattern>
170166
</swiftmailer:config>
171167
</container>
@@ -176,19 +172,16 @@ by adding the ``delivery_whitelist`` option:
176172
$container->loadFromExtension('swiftmailer', array(
177173
'delivery_address' => "dev@example.com",
178174
'delivery_whitelist' => array(
179-
// all email addresses matching this regex will *not* be
180-
// redirected to dev@example.com
175+
// all email addresses matching these regexes will be delivered
176+
// like normal, as well as being sent to dev@example.com
181177
'/@specialdomain\.com$/',
182-
183-
// all emails sent to admin@mydomain.com won't be
184-
// redirected to dev@example.com too
185178
'/^admin@mydomain\.com$/',
186179
),
187180
));
188181
189-
In the above example all email messages will be redirected to ``dev@example.com``,
190-
except messages sent to the ``admin@mydomain.com`` address or to any email
191-
address belonging to the domain ``specialdomain.com``, which will be delivered as normal.
182+
In the above example all email messages will be redirected to ``dev@example.com``
183+
and messages sent to the ``admin@mydomain.com`` address or to any email address
184+
belonging to the domain ``specialdomain.com`` will also be delivered as normal.
192185

193186
Viewing from the Web Debug Toolbar
194187
----------------------------------

‎cookbook/security/csrf_in_login_form.rst

Copy file name to clipboardExpand all lines: cookbook/security/csrf_in_login_form.rst
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ using the login form:
9292
{# src/AppBundle/Resources/views/Security/login.html.twig #}
9393

9494
{# ... #}
95-
<form action="{{ path('login_check') }}" method="post">
95+
<form action="{{ path('login') }}" method="post">
9696
{# ... the login fields #}
9797

9898
<input type="hidden" name="_csrf_token"
@@ -107,7 +107,7 @@ using the login form:
107107
<!-- src/AppBundle/Resources/views/Security/login.html.php -->
108108

109109
<!-- ... -->
110-
<form action="<?php echo $view['router']->generate('login_check') ?>" method="post">
110+
<form action="<?php echo $view['router']->generate('login') ?>" method="post">
111111
<!-- ... the login fields -->
112112

113113
<input type="hidden" name="_csrf_token"

‎cookbook/security/form_login.rst

Copy file name to clipboardExpand all lines: cookbook/security/form_login.rst
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ redirect to the URL defined by some ``account`` route, use the following:
234234
<div>{{ error.message }}</div>
235235
{% endif %}
236236

237-
<form action="{{ path('login_check') }}" method="post">
237+
<form action="{{ path('login') }}" method="post">
238238
<label for="username">Username:</label>
239239
<input type="text" id="username" name="_username" value="{{ last_username }}" />
240240

@@ -253,7 +253,7 @@ redirect to the URL defined by some ``account`` route, use the following:
253253
<div><?php echo $error->getMessage() ?></div>
254254
<?php endif ?>
255255

256-
<form action="<?php echo $view['router']->generate('login_check') ?>" method="post">
256+
<form action="<?php echo $view['router']->generate('login') ?>" method="post">
257257
<label for="username">Username:</label>
258258
<input type="text" id="username" name="_username" value="<?php echo $last_username ?>" />
259259

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.