Skip to content

Commit cdb8b24

Browse files
wouterjwouterj
committed
Merge branch '2.8' into 3.0
Conflicts: book/configuration.rst
2 parents 35a520d + eb1c1ae commit cdb8b24

File tree

18 files changed

+415
-105
lines changed

18 files changed

+415
-105
lines changed

‎best_practices/forms.rst‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,9 @@ Registering Forms as Services
7171

7272
You can also
7373
:ref:`register your form type as a service <form-cookbook-form-field-service>`.
74-
But this is *not* recommended unless you plan to reuse the new form type in many
75-
places or embed it in other forms directly or via the
76-
:doc:`CollectionType </reference/forms/types/collection>`.
77-
78-
For most forms that are used only to edit or create something, registering
79-
the form as a service is over-kill, and makes it more difficult to figure
80-
out exactly which form class is being used in a controller.
74+
This is only needed if your form type requires some dependencies to be injected
75+
by the container, otherwise it is unnecessary overhead and therefore *not*
76+
recommended to do this for all form type classes.
8177

8278
Form Button Configuration
8379
-------------------------

‎best_practices/security.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ which uses a login form to load users from the database:
5757
pattern: ^/
5858
anonymous: true
5959
form_login:
60-
check_path: security_login_check
61-
login_path: security_login_form
60+
check_path: login
61+
login_path: login
6262
6363
logout:
6464
path: security_logout

‎book/configuration.rst‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ format you prefer:
8787
8888
.. note::
8989

90-
You'll learn exactly how to load each file/format in the next section
91-
`Environments`_.
90+
You'll learn exactly how to load each file/format in the next section
91+
`Environments`_.
9292

9393
Each top-level entry like ``framework`` or ``twig`` defines the configuration
9494
for a particular bundle. For example, the ``framework`` key defines the configuration
@@ -195,6 +195,12 @@ cached files and allow them to rebuild:
195195
be accessed directly through the browser. See the :doc:`testing chapter </book/testing>`
196196
for more details.
197197

198+
.. tip::
199+
200+
When using the ``server:run`` command to start a server,
201+
``http://localhost:8000/`` will use the dev front controller of your
202+
application.
203+
198204
.. index::
199205
single: Environments; Configuration
200206

‎book/page_creation.rst‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,12 @@ a method inside of it that will be executed when someone goes to ``/lucky/number
6464

6565
Before diving into this, test it out!
6666

67-
http://localhost:8000/app_dev.php/lucky/number
67+
http://localhost:8000/lucky/number
6868

6969
.. tip::
7070

71-
If you setup a proper virtual host in :doc:`Apache or Nginx </cookbook/configuration/web_server_configuration>`,
71+
If you set up a proper virtual host in
72+
:doc:`Apache or Nginx </cookbook/configuration/web_server_configuration>`,
7273
replace ``http://localhost:8000`` with your host name - like
7374
``http://symfony.dev/app_dev.php/lucky/number``.
7475

@@ -85,16 +86,6 @@ and is where you build the page. The only rule is that a controller *must*
8586
return a Symfony :ref:`Response <component-http-foundation-response>` object
8687
(and you'll even learn to bend this rule eventually).
8788

88-
.. sidebar:: What's the ``app_dev.php`` in the URL?
89-
90-
Great question! By including ``app_dev.php`` in the URL, you're executing
91-
Symfony through a file - ``web/app_dev.php`` - that boots it in the ``dev``
92-
environment. This enables great debugging tools and rebuilds cached
93-
files automatically. For production, you'll use clean URLs - like
94-
``http://localhost:8000/lucky/number`` - that execute a different file -
95-
``app.php`` - that's optimized for speed. To learn more about this and
96-
environments, see :ref:`book-page-creation-prod-cache-clear`.
97-
9889
Creating a JSON Response
9990
~~~~~~~~~~~~~~~~~~~~~~~~
10091

@@ -131,7 +122,7 @@ Just add a second method to ``LuckyController``::
131122

132123
Try this out in your browser:
133124

134-
http://localhost:8000/app_dev.php/api/lucky/number
125+
http://localhost:8000/api/lucky/number
135126

136127
You can even shorten this with the handy :class:`Symfony\\Component\\HttpFoundation\\JsonResponse`::
137128

@@ -252,7 +243,7 @@ The best part is that you can access this value and use it in your controller::
252243

253244
Try it by going to ``/lucky/number/XX`` - replacing XX with *any* number:
254245

255-
http://localhost:8000/app_dev.php/lucky/number/7
246+
http://localhost:8000/lucky/number/7
256247

257248
You should see *7* lucky numbers printed out! You can get the value of any
258249
``{placeholder}`` in your route by adding a ``$placeholder`` argument to
@@ -409,7 +400,7 @@ to put the content into the middle of the ``base.html.twig`` layout.
409400

410401
Refresh to see your template in action!
411402

412-
http://localhost:8000/app_dev.php/lucky/number/9
403+
http://localhost:8000/lucky/number/9
413404

414405
If you view the source code, you now have a basic HTML structure thanks to
415406
``base.html.twig``.

‎book/security.rst‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1190,6 +1190,14 @@ is defined by the ``target`` parameter above (e.g. the ``homepage``).
11901190
:class:`Symfony\\Component\\Security\\Http\\Logout\\LogoutSuccessHandlerInterface`.
11911191
See :doc:`Security Configuration Reference </reference/configuration/security>`.
11921192

1193+
.. caution::
1194+
1195+
Notice that when using http-basic authenticated firewalls, there is no
1196+
real way to log out : the only way to *log out* is to have the browser
1197+
stop sending your name and password on every request. Clearing your
1198+
browser cache or restarting your browser usually helps. Some web developer
1199+
tools might be helpful here too.
1200+
11931201
.. _`security-encoding-password`:
11941202

11951203
Dynamically Encoding a Password

‎changelog.rst‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,93 @@ documentation.
1313
Do you also want to participate in the Symfony Documentation? Take a look
1414
at the ":doc:`/contributing/documentation/overview`" article.
1515

16+
December, 2015
17+
--------------
18+
19+
New Documentation
20+
~~~~~~~~~~~~~~~~~
21+
22+
* `#5906 <https://github.com/symfony/symfony-docs/pull/5906>`_ Added documentation for choice_translation_domain option (peterrehm)
23+
* `#6017 <https://github.com/symfony/symfony-docs/pull/6017>`_ Documented the Symfony Console Styles (javiereguiluz)
24+
* `#5811 <https://github.com/symfony/symfony-docs/pull/5811>`_ Conversion from mysql to PDO (iqbalmalik89)
25+
* `#5966 <https://github.com/symfony/symfony-docs/pull/5966>`_ Remove deprecated StringUtils from WSSE custom auth provider (pimpreneil)
26+
* `#5962 <https://github.com/symfony/symfony-docs/pull/5962>`_ Simplify code example in "Adding custom extensions" section (snoek09)
27+
* `#5977 <https://github.com/symfony/symfony-docs/pull/5977>`_ RequestStack parameter is required since 3.0 (leunggamciu)
28+
* `#6022 <https://github.com/symfony/symfony-docs/pull/6022>`_ clarify custom route loader documentation (dbu)
29+
* `#5994 <https://github.com/symfony/symfony-docs/pull/5994>`_ Updated the release process for Symfony 3.x and future releases (javiereguiluz)
30+
* `#5954 <https://github.com/symfony/symfony-docs/pull/5954>`_ Fix #5236 [2.8][Translation] specify additional translation loading paths (Pierre Maraitre, Balamung)
31+
32+
Fixed Documentation
33+
~~~~~~~~~~~~~~~~~~~
34+
35+
* `#6086 <https://github.com/symfony/symfony-docs/pull/6086>`_ Update form_customization.rst (vudaltsov)
36+
* `#6063 <https://github.com/symfony/symfony-docs/pull/6063>`_ minor #5829 Fix broken composer command (JHGitty)
37+
* `#5904 <https://github.com/symfony/symfony-docs/pull/5904>`_ Update php_soap_extension.rst (xDaizu)
38+
* `#5819 <https://github.com/symfony/symfony-docs/pull/5819>`_ Remove AppBundle (roukmoute)
39+
* `#6001 <https://github.com/symfony/symfony-docs/pull/6001>`_ Fix class name (BlueM)
40+
41+
Minor Documentation Changes
42+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
43+
44+
* `#6043 <https://github.com/symfony/symfony-docs/pull/6043>`_ Mention commiting only bower.json (krike, WouterJ)
45+
* `#5848 <https://github.com/symfony/symfony-docs/pull/5848>`_ Added hints to spool config section (martinczerwi)
46+
* `#5586 <https://github.com/symfony/symfony-docs/pull/5586>`_ [2.8] Remove 2.6 versionaddeds as version reached eom (WouterJ)
47+
* `#6042 <https://github.com/symfony/symfony-docs/pull/6042>`_ some tweaks to unit testing form types (xabbuh)
48+
* `#6059 <https://github.com/symfony/symfony-docs/pull/6059>`_ Add best practice about the Form type namespace (WouterJ)
49+
* `#6068 <https://github.com/symfony/symfony-docs/pull/6068>`_ Remove references to API tagging (dunglas)
50+
* `#6088 <https://github.com/symfony/symfony-docs/pull/6088>`_ Update validation.rst (syedi)
51+
* `#6085 <https://github.com/symfony/symfony-docs/pull/6085>`_ Update validation.rst (syedi)
52+
* `#6094 <https://github.com/symfony/symfony-docs/pull/6094>`_ [Form] Added a missing php opening tag (dev-symfony-void)
53+
* `#5840 <https://github.com/symfony/symfony-docs/pull/5840>`_ [Contributing] [Standards] Add note about `trigger_error()` and deprecation messages (phansys)
54+
* `#6050 <https://github.com/symfony/symfony-docs/pull/6050>`_ Lots of minor fixes & applying best practices to form cookbook doc (ThomasLandauer, WouterJ)
55+
* `#5993 <https://github.com/symfony/symfony-docs/pull/5993>`_ [Cookbook] [Security] Use UserLoaderInterface instead of UserProviderInterface (ogizanagi)
56+
* `#6071 <https://github.com/symfony/symfony-docs/pull/6071>`_ Fix syntax (WouterJ)
57+
* `#5570 <https://github.com/symfony/symfony-docs/pull/5570>`_ Quick review of 'create framework' tutorial (WouterJ)
58+
* `#5445 <https://github.com/symfony/symfony-docs/pull/5445>`_ Reworded the explanation about the kernel.event_listener tag (javiereguiluz)
59+
* `#6054 <https://github.com/symfony/symfony-docs/pull/6054>`_ Remove 2.8 branch from patch documentation (Triiistan)
60+
* `#6057 <https://github.com/symfony/symfony-docs/pull/6057>`_ Fix PHP code for registering service (WouterJ)
61+
* `#6067 <https://github.com/symfony/symfony-docs/pull/6067>`_ improve phrasing (greg0ire)
62+
* `#6063 <https://github.com/symfony/symfony-docs/pull/6063>`_ minor #5829 Fix broken composer command (JHGitty)
63+
* `#6041 <https://github.com/symfony/symfony-docs/pull/6041>`_ Fixed misspelling of human in glossary.rst YAML (Wasserschlange)
64+
* `#6049 <https://github.com/symfony/symfony-docs/pull/6049>`_ Finish #5798 Add app_ prefix to form type names (OskarStark, WouterJ)
65+
* `#5829 <https://github.com/symfony/symfony-docs/pull/5829>`_ use composer command instead of editing json file (OskarStark)
66+
* `#6046 <https://github.com/symfony/symfony-docs/pull/6046>`_ Update framework.rst (typo in sesssion) (patrick-mota)
67+
* `#5662 <https://github.com/symfony/symfony-docs/pull/5662>`_ Fixed wrong version of symfony with composer install (Nek-)
68+
* `#5890 <https://github.com/symfony/symfony-docs/pull/5890>`_ Updated article for modern Symfony practices and the use of bcrypt (javiereguiluz)
69+
* `#6015 <https://github.com/symfony/symfony-docs/pull/6015>`_ [Assetic] complete XML configuration examples (xabbuh)
70+
* `#5963 <https://github.com/symfony/symfony-docs/pull/5963>`_ Add note about 'phar extension' dependency (snoek09)
71+
* `#6006 <https://github.com/symfony/symfony-docs/pull/6006>`_ [Book] use AppBundle examples and follow best practices (xabbuh)
72+
* `#6016 <https://github.com/symfony/symfony-docs/pull/6016>`_ Corrected the line references for the basic controller example (theTeddyBear)
73+
* `#5446 <https://github.com/symfony/symfony-docs/pull/5446>`_ [Contributing] [Standards] Added note about phpdoc_separation (phansys)
74+
* `#6027 <https://github.com/symfony/symfony-docs/pull/6027>`_ Update guard-authentication.rst (rvanginneken)
75+
* `#6025 <https://github.com/symfony/symfony-docs/pull/6025>`_ Update guard-authentication.rst (rvanginneken)
76+
* `#5820 <https://github.com/symfony/symfony-docs/pull/5820>`_ Fixed an issue with command option shortcuts (javiereguiluz)
77+
* `#6033 <https://github.com/symfony/symfony-docs/pull/6033>`_ Fix Typo (Shine-neko)
78+
* `#6011 <https://github.com/symfony/symfony-docs/pull/6011>`_ Fixed formatting issues (javiereguiluz)
79+
* `#6012 <https://github.com/symfony/symfony-docs/pull/6012>`_ Use HTTPS for downloading the Symfony Installer (javiereguiluz)
80+
* `#6009 <https://github.com/symfony/symfony-docs/pull/6009>`_ Fix missing constant usage for generating urls (Tobion)
81+
* `#5965 <https://github.com/symfony/symfony-docs/pull/5965>`_ Removing php opening tags (Deamon)
82+
* `#6003 <https://github.com/symfony/symfony-docs/pull/6003>`_ #5999 fix files names (vincentaubert)
83+
* `#6004 <https://github.com/symfony/symfony-docs/pull/6004>`_ Fix for small typo (djoos)
84+
* `#5996 <https://github.com/symfony/symfony-docs/pull/5996>`_ Clarify example for SUBMIT form event (bkosborne)
85+
* `#6000 <https://github.com/symfony/symfony-docs/pull/6000>`_ Update registration_form.rst (afurculita)
86+
* `#5989 <https://github.com/symfony/symfony-docs/pull/5989>`_ Fix words according context (richardpq)
87+
* `#5992 <https://github.com/symfony/symfony-docs/pull/5992>`_ More use single quotes for YAML strings (snoek09)
88+
* `#5957 <https://github.com/symfony/symfony-docs/pull/5957>`_ mark deep option as deprecated (snoek09)
89+
* `#5943 <https://github.com/symfony/symfony-docs/pull/5943>`_ Add tip for when returning `null` from `createToken()` (jeroenseegers)
90+
* `#5940 <https://github.com/symfony/symfony-docs/pull/5940>`_ [Cookbook][ServiceContainer] move filename comment to the top of the code block (xabbuh)
91+
* `#5956 <https://github.com/symfony/symfony-docs/pull/5956>`_ Update security.rst (mpaquet)
92+
* `#5959 <https://github.com/symfony/symfony-docs/pull/5959>`_ Fix #5912 Ambiguity on Access Decision Manager's Strategy (Pierre Maraitre)
93+
* `#5955 <https://github.com/symfony/symfony-docs/pull/5955>`_ use single quotes for YAML strings (snoek09)
94+
* `#5979 <https://github.com/symfony/symfony-docs/pull/5979>`_ [Book] Do not extend the base controller before introducing it (ogizanagi)
95+
* `#5970 <https://github.com/symfony/symfony-docs/pull/5970>`_ Remove isSubmitted call (DanielSiepmann)
96+
* `#5972 <https://github.com/symfony/symfony-docs/pull/5972>`_ Add isSubmitted call (DanielSiepmann)
97+
* `#5964 <https://github.com/symfony/symfony-docs/pull/5964>`_ Missing n in Column (joshuataylor)
98+
* `#5961 <https://github.com/symfony/symfony-docs/pull/5961>`_ update from_flat_php_to_symfony2.rst (thao-witkam)
99+
* `#5924 <https://github.com/symfony/symfony-docs/pull/5924>`_ Removed note about removed content (WouterJ)
100+
* `#5938 <https://github.com/symfony/symfony-docs/pull/5938>`_ Add proper use of the password type (themccallister)
101+
102+
16103
November, 2015
17104
--------------
18105

‎components/expression_language/syntax.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,18 @@ The component supports:
2020
* **booleans** - ``true`` and ``false``
2121
* **null** - ``null``
2222

23+
.. caution::
24+
25+
A backslash (``\``) must be escaped by 4 backslashes (``\\\\``) in a string
26+
and 8 backslashes (``\\\\\\\\``) in a regex::
27+
28+
echo $language->evaluate('"\\\\"'); // prints \
29+
$language->evaluate('"a\\\\b" matches "/^a\\\\\\\\b$/"'); // returns true
30+
31+
Control characters (e.g. ``\n``) in expressions are replaced with
32+
whitespace. To avoid this, escape the sequence with a single backslash
33+
(e.g. ``\\n``).
34+
2335
.. _component-expression-objects:
2436

2537
Working with Objects

‎components/security/secure_tools.rst‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,27 @@ The Symfony Security component comes with a collection of nice utilities
55
related to security. These utilities are used by Symfony, but you should
66
also use them if you want to solve the problem they address.
77

8-
Generating a Secure random String
8+
.. note::
9+
10+
The functions described in this article were introduced in PHP 5.6 or 7.
11+
For older PHP versions, a polyfill is provided by the
12+
`Symfony Polyfill Component`_.
13+
14+
Comparing Strings
15+
~~~~~~~~~~~~~~~~~
16+
17+
The time it takes to compare two strings depends on their differences. This
18+
can be used by an attacker when the two strings represent a password for
19+
instance; it is known as a `Timing attack`_.
20+
21+
When comparing two passwords, you should use the :phpfunction:`hash_equals`
22+
function::
23+
24+
if (hash_equals($knownString, $userInput)) {
25+
// ...
26+
}
27+
28+
Generating a Secure Random String
929
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1030

1131
Whenever you need to generate a secure random string, you are highly
@@ -33,11 +53,5 @@ use the :phpfunction:`random_int` function::
3353

3454
$random = random_int(1, 10);
3555

36-
.. note::
37-
38-
PHP 7 and up provide the ``random_bytes()`` and ``random_int()`` functions
39-
natively, for older versions of PHP a polyfill is provided by the
40-
`Symfony Polyfill Component`_ and the `paragonie/random_compat package`_.
41-
56+
.. _`Timing attack`: https://en.wikipedia.org/wiki/Timing_attack
4257
.. _`Symfony Polyfill Component`: https://github.com/symfony/polyfill
43-
.. _`paragonie/random_compat package`: https://github.com/paragonie/random_compat

‎cookbook/controller/error_pages.rst‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ In that case, you might want to override one or both of the ``showAction()`` and
267267
# app/config/services.yml
268268
services:
269269
app.exception_controller:
270-
class: AppBundle\CustomExceptionController
270+
class: AppBundle\Controller\CustomExceptionController
271271
arguments: ['@twig', '%kernel.debug%']
272272
273273
.. code-block:: xml
@@ -298,6 +298,7 @@ In that case, you might want to override one or both of the ``showAction()`` and
298298
new Reference('twig'),
299299
'%kernel.debug%'
300300
));
301+
$container->setDefinition('app.exception_controller', $definition);
301302
302303
And then configure ``twig.exception_controller`` using the controller as
303304
services syntax (e.g. ``app.exception_controller:showAction``).

‎cookbook/email/dev_environment.rst‎

Lines changed: 9 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -141,12 +141,9 @@ by adding the ``delivery_whitelist`` option:
141141
swiftmailer:
142142
delivery_address: [email protected]
143143
delivery_whitelist:
144-
# all email addresses matching this regex will *not* be
145-
# redirected to [email protected]
144+
# all email addresses matching these regexes will be delivered
145+
# like normal, as well as being sent to [email protected]
146146
- '/@specialdomain\.com$/'
147-
148-
# all emails sent to [email protected] won't
149-
# be redirected to [email protected] too
150147
- '/^admin@mydomain\.com$/'
151148
152149
.. code-block:: xml
@@ -162,10 +159,9 @@ by adding the ``delivery_whitelist`` option:
162159
http://symfony.com/schema/dic/swiftmailer http://symfony.com/schema/dic/swiftmailer/swiftmailer-1.0.xsd">
163160
164161
<swiftmailer:config delivery-address="[email protected]">
165-
<!-- all email addresses matching this regex will *not* be redirected to [email protected] -->
162+
<!-- all email addresses matching these regexes will be delivered
163+
like normal, as well as being sent to [email protected] -->
166164
<swiftmailer:delivery-whitelist-pattern>/@specialdomain\.com$/</swiftmailer:delivery-whitelist-pattern>
167-
168-
<!-- all emails sent to [email protected] won't be redirected to [email protected] too -->
169165
<swiftmailer:delivery-whitelist-pattern>/^admin@mydomain\.com$/</swiftmailer:delivery-whitelist-pattern>
170166
</swiftmailer:config>
171167
</container>
@@ -176,19 +172,16 @@ by adding the ``delivery_whitelist`` option:
176172
$container->loadFromExtension('swiftmailer', array(
177173
'delivery_address' => "[email protected]",
178174
'delivery_whitelist' => array(
179-
// all email addresses matching this regex will *not* be
180-
// redirected to [email protected]
175+
// all email addresses matching these regexes will be delivered
176+
// like normal, as well as being sent to [email protected]
181177
'/@specialdomain\.com$/',
182-
183-
// all emails sent to [email protected] won't be
184-
// redirected to [email protected] too
185178
'/^admin@mydomain\.com$/',
186179
),
187180
));
188181
189-
In the above example all email messages will be redirected to ``[email protected]``,
190-
except messages sent to the ``[email protected]`` address or to any email
191-
address belonging to the domain ``specialdomain.com``, which will be delivered as normal.
182+
In the above example all email messages will be redirected to ``[email protected]``
183+
and messages sent to the ``[email protected]`` address or to any email address
184+
belonging to the domain ``specialdomain.com`` will also be delivered as normal.
192185

193186
Viewing from the Web Debug Toolbar
194187
----------------------------------

0 commit comments

Comments
 (0)