8000 Merge branch '2.7' into 2.8 · symfony/symfony-docs@f1ba10e · GitHub
[go: up one dir, main page]
Skip to content

Commit f1ba10e

Browse files
wouterjwouterj
committed
Merge branch '2.7' into 2.8
Conflicts: components/security/secure_tools.rst cookbook/security/csrf_in_login_form.rst cookbook/security/form_login.rst cookbook/security/form_login_setup.rst cookbook/security/remember_me.rst
2 parents 99c8abe + a5055a5 commit f1ba10e

File tree

14 files changed

+182
-100
lines changed

14 files changed

+182
-100
lines changed

‎best_practices/security.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ which uses a login form to load users from the database:
5757
pattern: ^/
5858
anonymous: true
5959
form_login:
60-
check_path: security_login_check
61-
login_path: security_login_form
60+
check_path: login
61+
login_path: login
6262
6363
logout:
6464
path: security_logout

‎book/configuration.rst

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ format you prefer:
8787
8888
.. note::
8989

90-
You'll learn exactly how to load each file/format in the next section
91-
`Environments`_.
90+
You'll learn exactly how to load each file/format in the next section
91+
`Environments`_.
9292

9393
Each top-level entry like ``framework`` or ``twig`` defines the configuration
9494
for a particular bundle. For example, the ``framework`` key defines the configuration
@@ -122,13 +122,13 @@ FrameworkBundle configuration:
122122

123123
.. code-block:: bash
124124
125-
$ app/console config:dump-reference FrameworkBundle
125+
$ php app/console config:dump-reference FrameworkBundle
126126
127127
The extension alias (configuration key) can also be used:
128128

129129
.. code-block:: bash
130130
131-
$ app/console config:dump-reference framework
131+
$ php app/console config:dump-reference framework
132132
133133
.. note::
134134

@@ -195,6 +195,12 @@ cached files and allow them to rebuild:
195195
be accessed directly through the browser. See the :doc:`testing chapter </book/testing>`
196196
for more details.
197197

198+
.. tip::
199+
200+
When using the ``server:run`` command to start a server,
201+
``http://localhost:8000/`` will use the dev front controller of your
202+
application.
203+
198204
.. index::
199205
single: Environments; Configuration
200206

‎book/page_creation.rst

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,12 @@ a method inside of it that will be executed when someone goes to ``/lucky/number
5959

6060
Before diving into this, test it out!
6161

62-
http://localhost:8000/app_dev.php/lucky/number
62+
http://localhost:8000/lucky/number
6363

6464
.. tip::
6565

66-
If you setup a proper virtual host in :doc:`Apache or Nginx </cookbook/configuration/web_server_configuration>`,
66+
If you set up a proper virtual host in
67+
:doc:`Apache or Nginx </cookbook/configuration/web_server_configuration>`,
6768
replace ``http://localhost:8000`` with your host name - like
6869
``http://symfony.dev/app_dev.php/lucky/number``.
6970

@@ -80,16 +81,6 @@ and is where you build the page. The only rule is that a controller *must*
8081
return a Symfony :ref:`Response <component-http-foundation-response>` object
8182
(and you'll even learn to bend this rule eventually).
8283

83-
.. sidebar:: What's the ``app_dev.php`` in the URL?
84-
85-
Great question! By including ``app_dev.php`` in the URL, you're executing
86-
Symfony through a file - ``web/app_dev.php`` - that boots it in the ``dev``
87-
environment. This enables great debugging tools and rebuilds cached
88-
files automatically. For production, you'll use clean URLs - like
89-
``http://localhost:8000/lucky/number`` - that execute a different file -
90-
``app.php`` - that's optimized for speed. To learn more about this and
91-
environments, see :ref:`book-page-creation-prod-cache-clear`.
92-
9384
Creating a JSON Response
9485
~~~~~~~~~~~~~~~~~~~~~~~~
9586

@@ -126,7 +117,7 @@ Just add a second method to ``LuckyController``::
126117

127118
Try this out in your browser:
128119

129-
http://localhost:8000/app_dev.php/api/lucky/number
120+
http://localhost:8000/api/lucky/number
130121

131122
You can even shorten this with the handy :class:`Symfony\\Component\\HttpFoundation\\JsonResponse`::
132123

@@ -247,7 +238,7 @@ The best part is that you can access this value and use it in your controller::
247238

248239
Try it by going to ``/lucky/number/XX`` - replacing XX with *any* number:
249240

250-
http://localhost:8000/app_dev.php/lucky/number/7
241+
http://localhost:8000/lucky/number/7
251242

252243
You should see *7* lucky numbers printed out! You can get the value of any
253244
``{placeholder}`` in your route by adding a ``$placeholder`` argument to
@@ -404,7 +395,7 @@ to put the content into the middle of the ``base.html.twig`` layout.
404395

405396
Refresh to see your template in action!
406397

407-
http://localhost:8000/app_dev.php/lucky/number/9
398+
http://localhost:8000/lucky/number/9
408399

409400
If you view the source code, you now have a basic HTML structure thanks to
410401
``base.html.twig``.

‎book/security.rst

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1192,6 +1192,14 @@ is defined by the ``target`` parameter above (e.g. the ``homepage``).
11921192
:class:`Symfony\\Component\\Security\\Http\\Logout\\LogoutSuccessHandlerInterface`.
11931193
See :doc:`Security Configuration Reference </reference/configuration/security>`.
11941194

1195+
.. caution::
1196+
1197+
Notice that when using http-basic authenticated firewalls, there is no
1198+
real way to log out : the only way to *log out* is to have the browser
1199+
stop sending your name and password on every request. Clearing your
1200+
browser cache or restarting your browser usually helps. Some web developer
1201+
tools might be helpful here too.
1202+
11951203
.. _`security-encoding-password`:
11961204

11971205
Dynamically Encoding a Password

‎changelog.rst

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,79 @@ documentation.
1313
Do you also want to participate in the Symfony Documentation? Take a look
1414
at the ":doc:`/contributing/documentation/overview`" article.
1515

16+
December, 2015
17+
--------------
18+
19+
New Documentation
20+
~~~~~~~~~~~~~~~~~
21+
22+
* `#5906 <https://github.com/symfony/symfony-docs/pull/5906>`_ Added documentation for choice_translation_domain option (peterrehm)
23+
* `#6017 <https://github.com/symfony/symfony-docs/pull/6017>`_ Documented the Symfony Console Styles (javiereguiluz)
24+
* `#5811 <https://github.com/symfony/symfony-docs/pull/5811>`_ Conversion from mysql to PDO (iqbalmalik89)
25+
* `#5962 <https://github.com/symfony/symfony-docs/pull/5962>`_ Simplify code example in "Adding custom extensions" section (snoek09)
26+
* `#6022 <https://github.com/symfony/symfony-docs/pull/6022>`_ clarify custom route loader documentation (dbu)
27+
* `#5994 <https://github.com/symfony/symfony-docs/pull/5994>`_ Updated the release process for Symfony 3.x and future releases (javiereguiluz)
28+
29+
Fixed Documentation
30+
~~~~~~~~~~~~~~~~~~~
31+
32+
* `#6063 <https://github.com/symfony/symfony-docs/pull/6063>`_ minor #5829 Fix broken composer command (JHGitty)
33+
* `#5904 <https://github.com/symfony/symfony-docs/pull/5904>`_ Update php_soap_extension.rst (xDaizu)
34+
* `#5819 <https://github.com/symfony/symfony-docs/pull/5819>`_ Remove AppBundle (roukmoute)
35+
* `#6001 <https://github.com/symfony/symfony-docs/pull/6001>`_ Fix class name (BlueM)
36+
37+
Minor Documentation Changes
38+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
39+
40+
* `#6043 <https://github.com/symfony/symfony-docs/pull/6043>`_ Mention commiting only bower.json (krike, WouterJ)
41+
* `#5848 <https://github.com/symfony/symfony-docs/pull/5848>`_ Added hints to spool config section (martinczerwi)
42+
* `#6042 <https://github.com/symfony/symfony-docs/pull/6042>`_ some tweaks to unit testing form types (xabbuh)
43+
* `#6059 <https://github.com/symfony/symfony-docs/pull/6059>`_ Add best practice about the Form type namespace (WouterJ)
44+
* `#6068 <https://github.com/symfony/symfony-docs/pull/6068>`_ Remove references to API tagging (dunglas)
45+
* `#6088 <https://github.com/symfony/symfony-docs/pull/6088>`_ Update validation.rst (syedi)
46+
* `#6085 <https://github.com/symfony/symfony-docs/pull/6085>`_ Update validation.rst (syedi)
47+
* `#6094 <https://github.com/symfony/symfony-docs/pull/6094>`_ [Form] Added a missing php opening tag (dev-symfony-void)
48+
* `#5840 <https://github.com/symfony/symfony-docs/pull/5840>`_ [Contributing] [Standards] Add note about `trigger_error()` and deprecation messages (phansys)
49+
* `#6050 <https://github.com/symfony/symfony-docs/pull/6050>`_ Lots of minor fixes & applying best practices to form cookbook doc (ThomasLandauer, WouterJ)
50+
* `#5570 <https://github.com/symfony/symfony-docs/pull/5570>`_ Quick review of 'create framework' tutorial (WouterJ)
51+
* `#5445 <https://github.com/symfony/symfony-docs/pull/5445>`_ Reworded the explanation about the kernel.event_listener tag (javiereguiluz)
52+
* `#6054 <https://github.com/symfony/symfony-docs/pull/6054>`_ Remove 2.8 branch from patch documentation (Triiistan)
53+
* `#6057 <https://github.com/symfony/symfony-docs/pull/6057>`_ Fix PHP code for registering service (WouterJ)
54+
* `#6067 <https://github.com/symfony/symfony-docs/pull/6067>`_ improve phrasing (greg0ire)
55+
* `#6063 <https://github.com/symfony/symfony-docs/pull/6063>`_ minor #5829 Fix broken composer command (JHGitty)
56+
* `#6041 <https://github.com/symfony/symfony-docs/pull/6041>`_ Fixed misspelling of human in glossary.rst YAML (Wasserschlange)
57+
* `#6049 <https://github.com/symfony/symfony-docs/pull/6049>`_ Finish #5798 Add app_ prefix to form type names (OskarStark, WouterJ)
58+
* `#5829 <https://github.com/symfony/symfony-docs/pull/5829>`_ use composer command instead of editing json file (OskarStark)
59+
* `#6046 <https://github.com/symfony/symfony-docs/pull/6046>`_ Update framework.rst (typo in sesssion) (patrick-mota)
60+
* `#5662 <https://github.com/symfony/symfony-docs/pull/5662>`_ Fixed wrong version of symfony with composer install (Nek-)
61+
* `#5890 <https://github.com/symfony/symfony-docs/pull/5890>`_ Updated article for modern Symfony practices and the use of bcrypt (javiereguiluz)
62+
* `#6015 <https://github.com/symfony/symfony-docs/pull/6015>`_ [Assetic] complete XML configuration examples (xabbuh)
63+
* `#5963 <https://github.com/symfony/symfony-docs/pull/5963>`_ Add note about 'phar extension' dependency (snoek09)
64+
* `#6006 <https://github.com/symfony/symfony-docs/pull/6006>`_ [Book] use AppBundle examples and follow best practices (xabbuh)
65+
* `#6016 <https://github.com/symfony/symfony-docs/pull/6016>`_ Corrected the line references for the basic controller example (theTeddyBear)
66+
* `#5446 <https://github.com/symfony/symfony-docs/pull/5446>`_ [Contributing] [Standards] Added note about phpdoc_separation (phansys)
67+
* `#5820 <https://github.com/symfony/symfony-docs/pull/5820>`_ Fixed an issue with command option shortcuts (javiereguiluz)
68+
* `#6033 <https://github.com/symfony/symfony-docs/pull/6033>`_ Fix Typo (Shine-neko)
69+
* `#6011 <https://github.com/symfony/symfony-docs/pull/6011>`_ Fixed formatting issues (javiereguiluz)
70+
* `#6012 <https://github.com/symfony/symfony-docs/pull/6012>`_ Use HTTPS for downloading the Symfony Installer (javiereguiluz)
71+
* `#6009 <https://github.com/symfony/symfony-docs/pull/6009>`_ Fix missing constant usage for generating urls (Tobion)
72+
* `#5965 <https://github.com/symfony/symfony-docs/pull/5965>`_ Removing php opening tags (Deamon)
73+
* `#6003 <https://github.com/symfony/symfony-docs/pull/6003>`_ #5999 fix files names (vincentaubert)
74+
* `#5996 <https://github.com/symfony/symfony-docs/pull/5996>`_ Clarify example for SUBMIT form event (bkosborne)
75+
* `#6000 <https://github.com/symfony/symfony-docs/pull/6000>`_ Update registration_form.rst (afurculita)
76+
* `#5989 <https://github.com/symfony/symfony-docs/pull/5989>`_ Fix words according context (richardpq)
77+
* `#5992 <https://github.com/symfony/symfony-docs/pull/5992>`_ More use single quotes for YAML strings (snoek09)
78+
* `#5957 <https://github.com/symfony/symfony-docs/pull/5957>`_ mark deep option as deprecated (snoek09)
79+
* `#5943 <https://github.com/symfony/symfony-docs/pull/5943>`_ Add tip for when returning `null` from `createToken()` (jeroenseegers)
80+
* `#5956 <https://github.com/symfony/symfony-docs/pull/5956>`_ Update security.rst (mpaquet)
81+
* `#5959 <https://github.com/symfony/symfony-docs/pull/5959>`_ Fix #5912 Ambiguity on Access Decision Manager's Strategy (Pierre Maraitre)
82+
* `#5955 <https://github.com/symfony/symfony-docs/pull/5955>`_ use single quotes for YAML strings (snoek09)
83+
* `#5979 <https://github.com/symfony/symfony-docs/pull/5979>`_ [Book] Do not extend the base controller before introducing it (ogizanagi)
84+
* `#5970 <https://github.com/symfony/symfony-docs/pull/5970>`_ Remove isSubmitted call (DanielSiepmann)
85+
* `#5972 <https://github.com/symfony/symfony-docs/pull/5972>`_ Add isSubmitted call (DanielSiepmann)
86+
* `#5961 <https://github.com/symfony/symfony-docs/pull/5961>`_ update from_flat_php_to_symfony2.rst (thao-witkam)
87+
88+
1689
November, 2015
1790
--------------
1891

‎components/expression_language/syntax.rst

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,18 @@ The component supports:
2020
* **booleans** - ``true`` and ``false``
2121
* **null** - ``null``
2222

23+
.. caution::
24+
25+
A backslash (``\``) must be escaped by 4 backslashes (``\\\\``) in a string
26+
and 8 backslashes (``\\\\\\\\``) in a regex::
27+
28+
echo $language->evaluate('"\\\\"'); // prints \
29+
$language->evaluate('"a\\\\b" matches "/^a\\\\\\\\b$/"'); // returns true
30+
31+
Control characters (e.g. ``\n``) in expressions are replaced with
32+
whitespace. To avoid this, escape the sequence with a single backslash
33+
(e.g. ``\\n``).
34+
2335
.. _component-expression-objects:
2436

2537
Working with Objects

‎components/security/secure_tools.rst

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,27 @@ The Symfony Security component comes with a collection of nice utilities
55
related to security. These utilities are used by Symfony, but you should
66
also use them if you want to solve the problem they address.
77

8-
Generating a Secure random String
8+
.. note::
9+
10+
The functions described in this article were introduced in PHP 5.6 or 7.
11+
For older PHP versions, a polyfill is provided by the
12+
`Symfony Polyfill Component`_.
13+
14+
Comparing Strings
15+
~~~~~~~~~~~~~~~~~
16+
17+
The time it takes to compare two strings depends on their differences. This
18+
can be used by an attacker when the two strings represent a password for
19+
instance; it is known as a `Timing attack`_.
20+
21+
When comparing two passwords, you should use the :phpfunction:`hash_equals`
22+
function::
23+
24+
if (hash_equals($knownString, $userInput)) {
25+
// ...
26+
}
27+
28+
Generating a Secure Random String
929
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1030

1131
Whenever you need to generate a secure random string, you are highly
@@ -33,11 +53,5 @@ use the :phpfunction:`random_int` function::
3353

3454
$random = random_int(1, 10);
3555

36-
.. note::
37-
38-
PHP 7 and up provide the ``random_bytes()`` and ``random_int()`` functions
39-
natively, for older versions of PHP a polyfill is provided by the
40-
`Symfony Polyfill Component`_ and the `paragonie/random_compat package`_.
41-
56+
.. _`Timing attack`: https://en.wikipedia.org/wiki/Timing_attack
4257
.. _`Symfony Polyfill Component`: https://github.com/symfony/polyfill
43-
.. _`paragonie/random_compat package`: https://github.com/paragonie/random_compat

‎cookbook/controller/error_pages.rst

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ In that case, you might want to override one or both of the ``showAction()`` and
267267
# app/config/services.yml
268268
services:
269269
app.exception_controller:
270-
class: AppBundle\CustomExceptionController
270+
class: AppBundle\Controller\CustomExceptionController
271271
arguments: ['@twig', '%kernel.debug%']
272272
273273
.. code-block:: xml
@@ -298,6 +298,7 @@ In that case, you might want to override one or both of the ``showAction()`` and
298298
new Reference('twig'),
299299
'%kernel.debug%'
300300
));
301+
$container->setDefinition('app.exception_controller', $definition);
301302
302303
And then configure ``twig.exception_controller`` using the controller as
303304
services syntax (e.g. ``app.exception_controller:showAction``).

‎cookbook/email/dev_environment.rst

Lines changed: 9 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -141,12 +141,9 @@ by adding the ``delivery_whitelist`` option:
141141
swiftmailer:
142142
delivery_address: dev@example.com
143143
delivery_whitelist:
144-
# all email addresses matching this regex will *not* be
145-
# redirected to dev@example.com
144+
# all email addresses matching these regexes will be delivered
145+
# like normal, as well as being sent to dev@example.com
146146
- '/@specialdomain\.com$/'
147-
148-
# all emails sent to admin@mydomain.com won't
149-
# be redirected to dev@example.com too
150147
- '/^admin@mydomain\.com$/'
151148
152149
.. code-block:: xml
@@ -162,10 +159,9 @@ by adding the ``delivery_whitelist`` option:
162159
http://symfony.com/schema/dic/swiftmailer http://symfony.com/schema/dic/swiftmailer/swiftma 538E iler-1.0.xsd">
163160
164161
<swiftmailer:config delivery-address="dev@example.com">
165-
<!-- all email addresses matching this regex will *not* be redirected to dev@example.com -->
162+
<!-- all email addresses matching these regexes will be delivered
163+
like normal, as well as being sent to dev@example.com -->
166164
<swiftmailer:delivery-whitelist-pattern>/@specialdomain\.com$/</swiftmailer:delivery-whitelist-pattern>
167-
168-
<!-- all emails sent to admin@mydomain.com won't be redirected to dev@example.com too -->
169165
<swiftmailer:delivery-whitelist-pattern>/^admin@mydomain\.com$/</swiftmailer:delivery-whitelist-pattern>
170166
</swiftmailer:config>
171167
</container>
@@ -176,19 +172,16 @@ by adding the ``delivery_whitelist`` option:
176172
$container->loadFromExtension('swiftmailer', array(
177173
'delivery_address' => "dev@example.com",
178174
'delivery_whitelist' => array(
179-
// all email addresses matching this regex will *not* be
180-
// redirected to dev@example.com
175+
// all email addresses matching these regexes will be delivered
176+
// like normal, as well as being sent to dev@example.com
181177
'/@specialdomain\.com$/',
182-
183-
// all emails sent to admin@mydomain.com won't be
184-
// redirected to dev@example.com too
185178
'/^admin@mydomain\.com$/',
186179
),
187180
));
188181
189-
In the above example all email messages will be redirected to ``dev@example.com``,
190-
except messages sent to the ``admin@mydomain.com`` address or to any email
191-
address belonging to the domain ``specialdomain.com``, which will be delivered as normal.
182+
In the above example all email messages will be redirected to ``dev@example.com``
183+
and messages sent to the ``admin@mydomain.com`` address or to any email address
184+
belonging to the domain ``specialdomain.com`` will also be delivered as normal.
192185

193186
Viewing from the Web Debug Toolbar
194187
----------------------------------

‎cookbook/security/csrf_in_login_form.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ using the login form:
9292
{# src/AppBundle/Resources/views/Security/login.html.twig #}
9393

9494
{# ... #}
95-
<form action="{{ path('login_check') }}" method="post">
95+
<form action="{{ path('login') }}" method="post">
9696
{# ... the login fields #}
9797

9898
<input type="hidden" name="_csrf_token"
@@ -109,7 +109,7 @@ using the login form:
109109
<!-- ... -->
110110
<!-- The path() method was introduced in Symfony 2.8. Prior to 2.8, you
111111
had to use generate(). -->
112-
<form action="<?php echo $view['router']->path('login_check') ?>" method="post">
112+
<form action="<?php echo $view['router']->path('login') ?>" method="post">
113113
<!-- ... the login fields -->
114114

115115
<input type="hidden" name="_csrf_token"

‎cookbook/security/form_login.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ redirect to the URL defined by some ``account`` route, use the following:
234234
<div>{{ error.message }}</div>
235235
{% endif %}
236236

237-
<form action="{{ path('login_check') }}" method="post">
237+
<form action="{{ path('login') }}" method="post">
238238
<label for="username">Username:</label>
239239
<input type="text" id="username" name="_username" value="{{ last_username }}" />
240240

@@ -255,7 +255,7 @@ redirect to the URL defined by some ``account`` route, use the following:
255255

256256
<!-- The path() method was introduced in Symfony 2.8. Prior to 2.8, you
257257
had to use generate(). -->
258-
<form action="<?php echo $view['router']->path('login_check') ?>" method="post">
258+
<form action="<?php echo $view['router']->path('login') ?>" method="post">
259259
<label for="username">Username:</label>
260260
<input type="text" id="username" name="_username" value="<?php echo $last_username ?>" />
261261

0 commit comments

Comments
 (0)
0