Skip to content

Commit ec5671d

Browse files
wouterjwouterj
committed
Merge branch '2.8' into 3.0
Conflicts: cookbook/security/_ircmaxwell_password-compat.rst.inc
2 parents 786096e + e67deaa commit ec5671d

File tree

17 files changed

+369
-258
lines changed

17 files changed

+369
-258
lines changed

‎book/forms.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1235,7 +1235,7 @@ Define your form type as a service.
12351235
.. code-block:: php
12361236
12371237
// src/AppBundle/Resources/config/services.php
1238-
use ;
1238+
use Symfony\Component\DependencyInjection\Reference;
12391239
12401240
$container->register('app.form.type.task', 'AppBundle\Form\Type\TaskType')
12411241
->addArgument(new Reference('app.my_service'))

‎book/from_flat_php_to_symfony2.rst‎

Lines changed: 28 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,9 @@ persisted to the database. Writing in flat PHP is quick and dirty:
2929

3030
<?php
3131
// index.php
32-
$link = mysql_connect('localhost', 'myuser', 'mypassword');
33-
mysql_select_db('blog_db', $link);
32+
$link = new PDO("mysql:host=localhost;dbname=blog_db", 'myuser', 'mypassword');
3433

35-
$result = mysql_query('SELECT id, title FROM post', $link);
34+
$result = $link->query('SELECT id, title FROM post');
3635
?>
3736

3837
<!DOCTYPE html>
@@ -43,7 +42,7 @@ persisted to the database. Writing in flat PHP is quick and dirty:
4342
<body>
4443
<h1>List of Posts</h1>
4544
<ul>
46-
<?php while ($row = mysql_fetch_assoc($result)): ?>
45+
<?php while ($row = $result->fetch(PDO::FETCH_ASSOC)): ?>
4746
<li>
4847
<a href="/show.php?id=<?php echo $row['id'] ?>">
4948
<?php echo $row['title'] ?>
@@ -55,7 +54,7 @@ persisted to the database. Writing in flat PHP is quick and dirty:
5554
</html>
5655

5756
<?php
58-
mysql_close($link);
57+
$link = null;
5958
?>
6059

6160
That's quick to write, fast to execute, and, as your app grows, impossible
@@ -81,26 +80,24 @@ Isolating the Presentation
8180
~~~~~~~~~~~~~~~~~~~~~~~~~~
8281

8382
The code can immediately gain from separating the application "logic" from
84-
the code that prepares the HTML "presentation":
85-
86-
.. code-block:: html+php
83+
the code that prepares the HTML "presentation"::
8784

8885
// index.php
89-
$link = mysql_connect('localhost', 'myuser', 'mypassword');
90-
mysql_select_db('blog_db', $link);
86+
$link = new PDO("mysql:host=localhost;dbname=blog_db", 'myuser', 'mypassword');
9187

92-
$result = mysql_query('SELECT id, title FROM post', $link);
88+
$result = $link->query('SELECT id, title FROM post');
9389

9490
$posts = array();
95-
while ($row = mysql_fetch_assoc($result)) {
91+
while ($row = $result->fetch(PDO::FETCH_ASSOC)) {
9692
$posts[] = $row;
9793
}
9894

99-
mysql_close($link);
95+
$link = null;
10096

10197
// include the HTML presentation code
10298
require 'templates/list.php';
10399

100+
104101
The HTML code is now stored in a separate file (``templates/list.php``), which
105102
is primarily an HTML file that uses a template-like PHP syntax:
106103

@@ -141,31 +138,29 @@ Isolating the Application (Domain) Logic
141138
So far the application contains only one page. But what if a second page
142139
needed to use the same database connection, or even the same array of blog
143140
posts? Refactor the code so that the core behavior and data-access functions
144-
of the application are isolated in a new file called ``model.php``:
145-
146-
.. code-block:: html+php
141+
of the application are isolated in a new file called ``model.php``::
147142

148143
// model.php
149144
function open_database_connection()
150145
{
151-
$link = mysql_connect('localhost', 'myuser', 'mypassword');
152-
mysql_select_db('blog_db', $link);
146+
$link = new PDO("mysql:host=localhost;dbname=blog_db", 'myuser', 'mypassword');
153147

154148
return $link;
155149
}
156150

157151
function close_database_connection($link)
158152
{
159-
mysql_close($link);
153+
$link = null;
160154
}
161155

162156
function get_all_posts()
163157
{
164158
$link = open_database_connection();
165159

166-
$result = mysql_query('SELECT id, title FROM post', $link);
160+
$result = $link->query('SELECT id, title FROM post');
161+
167162
$posts = array();
168-
while ($row = mysql_fetch_assoc($result)) {
163+
while ($row = $result->fetch(PDO::FETCH_ASSOC)) {
169164
$posts[] = $row;
170165
}
171166
close_database_connection($link);
@@ -182,9 +177,7 @@ of the application are isolated in a new file called ``model.php``:
182177
in this example, only a portion (or none) of the model is actually concerned
183178
with accessing a database.
184179

185-
The controller (``index.php``) is now very simple:
186-
187-
.. code-block:: html+php
180+
The controller (``index.php``) is now very simple::
188181

189182
require_once 'model.php';
190183

@@ -261,21 +254,17 @@ an individual blog result based on a given id::
261254
function get_post_by_id($id)
262255
{
263256
$link = open_database_connection();
264-
265257
$id = intval($id);
266-
$query = 'SELECT created_at, title, body FROM post WHERE id = '.$id;
267-
$result = mysql_query($query);
268-
$row = mysql_fetch_assoc($result);
258+
$result = $link->query('SELECT created_at, title, body FROM post WHERE id = '.$id);
259+
$row = $result->fetch(PDO::FETCH_ASSOC);
269260

270261
close_database_connection($link);
271262

272263
return $row;
273264
}
274265

275266
Next, create a new file called ``show.php`` - the controller for this new
276-
page:
277-
278-
.. code-block:: html+php
267+
page::
279268

280269
require_once 'model.php';
281270

@@ -353,9 +342,7 @@ You're about to take a **big** step with the application. With one file handling
353342
all requests, you can centralize things such as security handling, configuration
354343
loading, and routing. In this application, ``index.php`` must now be smart
355344
enough to render the blog post list page *or* the blog post show page based
356-
on the requested URI:
357-
358-
.. code-block:: html+php
345+
on the requested URI::
359346

360347
// index.php
361348

@@ -365,19 +352,17 @@ on the requested URI:
365352

366353
// route the request internally
367354
$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
368-
if ('/index.php' == $uri) {
355+
if ('/index.php' === $uri) {
369356
list_action();
370-
} elseif ('/index.php/show' == $uri && isset($_GET['id'])) {
357+
} elseif ('/index.php/show' === $uri && isset($_GET['id'])) {
371358
show_action($_GET['id']);
372359
} else {
373360
header('Status: 404 Not Found');
374361
echo '<html><body><h1>Page Not Found</h1></body></html>';
375362
}
376363

377364
For organization, both controllers (formerly ``index.php`` and ``show.php``)
378-
are now PHP functions and each has been moved into a separate file, ``controllers.php``:
379-
380-
.. code-block:: php
365+
are now PHP functions and each has been moved into a separate file, ``controllers.php``::
381366

382367
function list_action()
383368
{
@@ -455,9 +440,7 @@ to interpret each request and return a response. To this end, Symfony provides
455440
both a :class:`Symfony\\Component\\HttpFoundation\\Request` and a
456441
:class:`Symfony\\Component\\HttpFoundation\\Response` class. These classes are
457442
object-oriented representations of the raw HTTP request being processed and
458-
the HTTP response being returned. Use them to improve the blog:
459-
460-
.. code-block:: html+php
443+
the HTTP response being returned. Use them to improve the blog::
461444

462445
// index.php
463446
require_once 'vendor/autoload.php';
@@ -468,9 +451,9 @@ the HTTP response being returned. Use them to improve the blog:
468451
$request = Request::createFromGlobals();
469452

470453
$uri = $request->getPathInfo();
471-
if ('/' == $uri) {
454+
if ('/' === $uri) {
472455
$response = list_action();
473-
} elseif ('/show' == $uri && $request->query->has('id')) {
456+
} elseif ('/show' === $uri && $request->query->has('id')) {
474457
$response = show_action($request->query->get('id'));
475458
} else {
476459
$html = '<html><body><h1>Page Not Found</h1></body></html>';
@@ -482,9 +465,7 @@ the HTTP response being returned. Use them to improve the blog:
482465

483466
The controllers are now responsible for returning a ``Response`` object.
484467
To make this easier, you can add a new ``render_template()`` function, which,
485-
incidentally, acts quite a bit like the Symfony templating engine:
486-
487-
.. code-block:: php
468+
incidentally, acts quite a bit like the Symfony templating engine::
488469

489470
// controllers.php
490471
use Symfony\Component\HttpFoundation\Response;

‎components/security/secure_tools.rst‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,10 @@
1-
Securely Comparing Strings and Generating Random Numbers
2-
========================================================
1+
Securely Generating Random Numbers
2+
==================================
33

44
The Symfony Security component comes with a collection of nice utilities
55
related to security. These utilities are used by Symfony, but you should
66
also use them if you want to solve the problem they address.
77

8-
Comparing Strings
9-
~~~~~~~~~~~~~~~~~
10-
11-
The time it takes to compare two strings depends on their differences. This
12-
can be used by an attacker when the two strings represent a password for
13-
instance; it is known as a `Timing attack`_.
14-
15-
Internally, when comparing two passwords, Symfony uses a constant-time
16-
algorithm; you can use the same strategy in your own code thanks to the
17-
:class:`Symfony\\Component\\Security\\Core\\Util\\StringUtils` class::
18-
19-
use Symfony\Component\Security\Core\Util\StringUtils;
20-
21-
// is some known string (e.g. password) equal to some user input?
22-
$bool = StringUtils::equals($knownString, $userInput);
23-
248
Generating a Secure random Number
259
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2610

@@ -61,5 +45,3 @@ to work correctly. Just pass a file name to enable it::
6145
as storing this value in a database or including it as part of the URL. The
6246
solution is to hash the value returned by ``nextBytes()`` (to do that, you
6347
can use a simple ``md5()`` PHP function).
64-
65-
.. _`Timing attack`: https://en.wikipedia.org/wiki/Timing_attack

‎cookbook/assetic/apply_to_option.rst‎

Lines changed: 36 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,24 @@ An example configuration might look like this:
2929
.. code-block:: xml
3030
3131
<!-- app/config/config.xml -->
32-
<assetic:config>
33-
<assetic:filter
34-
name="coffee"
35-
bin="/usr/bin/coffee/"
36-
node="/usr/bin/node/">
37-
<assetic:node-path>/usr/lib/node_modules/</assetic:node-path>
38-
</assetic:filter>
39-
</assetic:config>
32+
<?xml version="1.0" encoding="UTF-8"?>
33+
<container xmlns="http://symfony.com/schema/dic/services"
34+
xmlns:assetic="http://symfony.com/schema/dic/assetic"
35+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
36+
xsi:schemaLocation="http://symfony.com/schema/dic/services
37+
http://symfony.com/schema/dic/services/services-1.0.xsd
38+
http://symfony.com/schema/dic/assetic
39+
http://symfony.com/schema/dic/assetic/assetic-1.0.xsd">
40+
41+
<assetic:config>
42+
<assetic:filter
43+
name="coffee"
44+
bin="/usr/bin/coffee/"
45+
node="/usr/bin/node/">
46+
<assetic:node-path>/usr/lib/node_modules/</assetic:node-path>
47+
</assetic:filter>
48+
</assetic:config>
49+
</container>
4050
4151
.. code-block:: php
4252
@@ -139,14 +149,24 @@ In this case you can specify that the ``coffee`` filter is applied to all
139149
.. code-block:: xml
140150
141151
<!-- app/config/config.xml -->
142-
<assetic:config>
143-
<assetic:filter
144-
name="coffee"
145-
bin="/usr/bin/coffee"
146-
node="/usr/bin/node"
147-
apply_to="\.coffee$" />
148-
<assetic:node-paths>/usr/lib/node_modules/</assetic:node-path>
149-
</assetic:config>
152+
<?xml version="1.0" encoding="UTF-8"?>
153+
<container xmlns="http://symfony.com/schema/dic/services"
154+
xmlns:assetic="http://symfony.com/schema/dic/assetic"
155+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
156+
xsi:schemaLocation="http://symfony.com/schema/dic/services
157+
http://symfony.com/schema/dic/services/services-1.0.xsd
158+
http://symfony.com/schema/dic/assetic
159+
http://symfony.com/schema/dic/assetic/assetic-1.0.xsd">
160+
161+
<assetic:config>
162+
<assetic:filter
163+
name="coffee"
164+
bin="/usr/bin/coffee"
165+
node="/usr/bin/node"
166+
apply_to="\.coffee$" />
167+
<assetic:node-paths>/usr/lib/node_modules/</assetic:node-path>
168+
</assetic:config>
169+
</container>
150170
151171
.. code-block:: php
152172

‎cookbook/assetic/asset_management.rst‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,12 @@ configuration under the ``assetic`` section. Read more in the
384384
<!-- app/config/config.xml -->
385385
<?xml version="1.0" encoding="UTF-8"?>
386386
<container xmlns="http://symfony.com/schema/dic/services"
387-
xmlns:assetic="http://symfony.com/schema/dic/assetic">
387+
xmlns:assetic="http://symfony.com/schema/dic/assetic"
388+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
389+
xsi:schemaLocation="http://symfony.com/schema/dic/services
390+
http://symfony.com/schema/dic/services/services-1.0.xsd
391+
http://symfony.com/schema/dic/assetic
392+
http://symfony.com/schema/dic/assetic/assetic-1.0.xsd">
388393
389394
<assetic:config>
390395
<assetic:asset name="jquery_and_ui">
@@ -471,11 +476,21 @@ should be defined:
471476
.. code-block:: xml
472477
473478
<!-- app/config/config.xml -->
474-
<assetic:config>
475-
<assetic:filter
476-
name="uglifyjs2"
477-
bin="/usr/local/bin/uglifyjs" />
478-
</assetic:config>
479+
<?xml version="1.0" encoding="UTF-8"?>
480+
<container xmlns="http://symfony.com/schema/dic/services"
481+
xmlns:assetic="http://symfony.com/schema/dic/assetic"
482+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
483+
xsi:schemaLocation="http://symfony.com/schema/dic/services
484+
http://symfony.com/schema/dic/services/services-1.0.xsd
485+
http://symfony.com/schema/dic/assetic
486+
http://symfony.com/schema/dic/assetic/assetic-1.0.xsd">
487+
488+
<assetic:config>
489+
<assetic:filter
490+
name="uglifyjs2"
491+
bin="/usr/local/bin/uglifyjs" />
492+
</assetic:config>
493+
</container>
479494
480495
.. code-block:: php
481496
@@ -611,7 +626,17 @@ the following change in your ``config_dev.yml`` file:
611626
.. code-block:: xml
612627
613628
<!-- app/config/config_dev.xml -->
614-
<assetic:config use-controller="false" />
629+
<?xml version="1.0" encoding="UTF-8"?>
630+
<container xmlns="http://symfony.com/schema/dic/services"
631+
xmlns:assetic="http://symfony.com/schema/dic/assetic"
632+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
633+
xsi:schemaLocation="http://symfony.com/schema/dic/services
634+
http://symfony.com/schema/dic/services/services-1.0.xsd
635+
http://symfony.com/schema/dic/assetic
636+
http://symfony.com/schema/dic/assetic/assetic-1.0.xsd">
637+
638+
<assetic:config use-controller="false" />
639+
</container>
615640
616641
.. code-block:: php
617642

0 commit comments

Comments
 (0)