Skip to content

Commit d3c31d7

Browse files
weaverryanweaverryan
committed
Merge branch '4.1'
* 4.1: removing old reference Fixing missing link Tweaks based on feedback Reword Teak Fix some bugs, added missing note, removed dead code and revamping code Some punctuation stuff Many changes thanks for GREAT feedback from various people Overhauling the security section Update conditions.rst Update conditions.rst Update conditions.rst Update conditions.rst
2 parents 5d5da2f + 76a6c65 commit d3c31d7

39 files changed

+1683
-3616
lines changed

‎_build/redirection_map

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -390,3 +390,11 @@
390390
/quick_tour/the_view /quick_tour/flex_recipes
391391
/service_container/service_locators /service_container/service_subscribers_locators
392392
/templating/overriding /bundles/override
393+
/security/custom_provider /security/user_provider
394+
/security/multiple_user_providers /security/user_provider
395+
/security/custom_password_authenticator /security/guard_authentication
396+
/security/api_key_authentication /security/api_key_authentication
397+
/security/pre_authenticated /security/auth_providers
398+
/security/host_restriction /security/firewall_restriction
399+
/security/acl_advanced /security/acl
400+
/security/password_encoding /security

‎_images/security/http_basic_popup.png

-38.6 KB
Binary file not shown.

‎_images/security/symfony_loggedin_wdt.png

61 KB
Loading

‎best_practices/security.rst

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -376,26 +376,6 @@ via the even easier shortcut in a controller::
376376
// ...
377377
}
378378

379-
Learn More
380-
----------
381-
382-
The `FOSUserBundle`_, developed by the Symfony community, adds support for a
383-
database-backed user system in Symfony. It also handles common tasks like
384-
user registration and forgotten password functionality.
385-
386-
Enable the :doc:`Remember Me feature </security/remember_me>` to
387-
allow your users to stay logged in for a long period of time.
388-
389-
When providing customer support, sometimes it's necessary to access the application
390-
as some *other* user so that you can reproduce the problem. Symfony provides
391-
the ability to :doc:`impersonate users </security/impersonating_user>`.
392-
393-
If your company uses a user login method not supported by Symfony, you can
394-
develop :doc:`your own user provider </security/custom_provider>` and
395-
:doc:`your own authentication provider </security/custom_authentication_provider>`.
396-
397-
----
398-
399379
Next: :doc:`/best_practices/web-assets`
400380

401381
.. _`ParamConverter`: https://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/annotations/converters.html

‎configuration/micro_kernel_trait.rst

Lines changed: 26 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -55,13 +55,13 @@ Next, create an ``index.php`` file that defines the kernel class and executes it
5555
{
5656
// kernel is a service that points to this class
5757
// optional 3rd argument is the route name
58-
$routes->add('/random/{limit}', 'kernel:randomNumber');
58+
$routes->add('/random/{limit}', 'Kernel::randomNumber');
5959
}
6060

6161
public function randomNumber($limit)
6262
{
6363
return new JsonResponse(array(
64-
'number' => rand(0, $limit)
64+
'number' => random_int(0, $limit),
6565
));
6666
}
6767
}
@@ -136,11 +136,6 @@ hold the kernel. Now it looks like this::
136136
use Symfony\Component\DependencyInjection\ContainerBuilder;
137137
use Symfony\Component\HttpKernel\Kernel as BaseKernel;
138138
use Symfony\Component\Routing\RouteCollectionBuilder;
139-
use Doctrine\Common\Annotations\AnnotationRegistry;
140-
141-
$loader = require __DIR__.'/../vendor/autoload.php';
142-
// auto-load annotations
143-
AnnotationRegistry::registerLoader(array($loader, 'loadClass'));
144139

145140
class Kernel extends BaseKernel
146141
{
@@ -149,8 +144,8 @@ hold the kernel. Now it looks like this::
149144
public function registerBundles()
150145
{
151146
$bundles = array(
152-
new Symfony\Bundle\FrameworkBundle\FrameworkBundle(),
153-
new Symfony\Bundle\TwigBundle\TwigBundle(),
147+
new \Symfony\Bundle\FrameworkBundle\FrameworkBundle(),
148+
new \Symfony\Bundle\TwigBundle\TwigBundle(),
154149
);
155150

156151
if ($this->getEnvironment() == 'dev') {
@@ -162,7 +157,7 @@ hold the kernel. Now it looks like this::
162157

163158
protected function configureContainer(ContainerBuilder $c, LoaderInterface $loader)
164159
{
165-
$loader->load(__DIR__.'/config/framework.yaml');
160+
$loader->load(__DIR__.'/../config/framework.yaml');
166161

167162
// configure WebProfilerBundle only if the bundle is enabled
168163
if (isset($this->bundles['WebProfilerBundle'])) {
@@ -198,6 +193,12 @@ hold the kernel. Now it looks like this::
198193
}
199194
}
200195

196+
Before continuing, run this command to add support for the new dependencies:
197+
198+
.. code-block:: terminal
199+
200+
$ composer require symfony/yaml symfony/twig-bundle symfony/web-profiler-bundle doctrine/annotations
201+
201202
Unlike the previous kernel, this loads an external ``config/framework.yaml`` file,
202203
because the configuration started to get bigger:
203204

@@ -208,8 +209,6 @@ because the configuration started to get bigger:
208209
# config/framework.yaml
209210
framework:
210211
secret: S0ME_SECRET
211-
templating:
212-
engines: ['twig']
213212
profiler: { only_exceptions: false }
214213
215214
.. code-block:: xml
@@ -223,9 +222,6 @@ because the configuration started to get bigger:
223222
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
224223
225224
<framework:config secret="S0ME_SECRET">
226-
<framework:templating>
227-
<framework:engine>twig</framework:engine>
228-
</framework:templating>
229225
<framework:profiler only-exceptions="false" />
230226
</framework:config>
231227
</container>
@@ -235,9 +231,6 @@ because the configuration started to get bigger:
235231
// config/framework.php
236232
$container->loadFromExtension('framework', array(
237233
'secret' => 'S0ME_SECRET',
238-
'templating' => array(
239-
'engines' => array('twig'),
240-
),
241234
'profiler' => array(
242235
'only_exceptions' => false,
243236
),
@@ -259,21 +252,20 @@ has one file in it::
259252
*/
260253
public function randomNumber($limit)
261254
{
262-
$number = rand(0, $limit);
255+
$number = random_int(0, $limit);
263256

264257
return $this->render('micro/random.html.twig', array(
265-
'number' => $number
258+
'number' => $number,
266259
));
267260
}
268261
}
269262

270-
Template files should live in the ``Resources/views/`` directory of whatever directory
271-
your *kernel* lives in. Since ``Kernel`` lives in ``src/``, this template lives
272-
at ``src/Resources/views/micro/random.html.twig``:
263+
Template files should live in the ``templates/`` directory at the root of your project.
264+
This template lives at ``templates/micro/random.html.twig``:
273265

274266
.. code-block:: html+twig
275267

276-
<!-- src/Resources/views/micro/random.html.twig -->
268+
<!-- templates/micro/random.html.twig -->
277269
<!DOCTYPE html>
278270
<html>
279271
<head>
@@ -289,9 +281,13 @@ Finally, you need a front controller to boot and run the application. Create a
289281

290282
// public/index.php
291283

284+
use App\Kernel;
285+
use Doctrine\Common\Annotations\AnnotationRegistry;
292286
use Symfony\Component\HttpFoundation\Request;
293287

294-
require __DIR__.'/../src/Kernel.php';
288+
$loader = require __DIR__.'/../vendor/autoload.php';
289+
// auto-load annotations
290+
AnnotationRegistry::registerLoader(array($loader, 'loadClass'));
295291

296292
$kernel = new Kernel('dev', true);
297293
$request = Request::createFromGlobals();
@@ -311,13 +307,12 @@ this:
311307
├─ public/
312308
| └─ index.php
313309
├─ src/
314-
| ├─ Kernel.php
315310
| ├─ Controller
316311
| | └─ MicroController.php
317-
│ └─ Resources
318-
| └─ views
319-
| └─ micro
320-
| └─ random.html.twig
312+
| └─ Kernel.php
313+
├─ templates/
314+
| └─ micro/
315+
| └─ random.html.twig
321316
├─ var/
322317
| ├─ cache/
323318
│ └─ log/
@@ -331,7 +326,7 @@ As before you can use PHP built-in server:
331326
.. code-block:: terminal
332327
333328
cd public/
334-
$ php -S localhost:8000
329+
$ php -S localhost:8000 -t public/
335330
336331
Then see webpage in browser:
337332

‎controller/error_pages.rst

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ logic to determine the template filename:
6060
a generic template for the given format (like ``error.json.twig`` or
6161
``error.xml.twig``);
6262

63-
#. If none of the previous template exist, fall back to the generic HTML template
63+
#. If none of the previous templates exist, fall back to the generic HTML template
6464
(``error.html.twig``).
6565

6666
.. _overriding-or-adding-templates:
@@ -69,7 +69,7 @@ To override these templates, rely on the standard Symfony method for
6969
:ref:`overriding templates that live inside a bundle <override-templates>` and
7070
put them in the ``templates/bundles/TwigBundle/Exception/`` directory.
7171

72-
A typical project that returns HTML and JSON pages, might look like this:
72+
A typical project that returns HTML and JSON pages might look like this:
7373

7474
.. code-block:: text
7575
@@ -122,6 +122,13 @@ store the HTTP status code and message respectively.
122122
for the standard HTML exception page or ``exception.json.twig`` for the JSON
123123
exception page.
124124

125+
Security & 404 Pages
126+
--------------------
127+
128+
Due to the order of how routing and security are loaded, security information will
129+
*not* be available on your 404 pages. This means that it will appear as if your
130+
user is logged out on the 404 page (it will work while testing, but not on production).
131+
125132
.. _testing-error-pages:
126133

127134
Testing Error Pages during Development

‎doctrine.rst

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,8 @@ This command executes all migration files that have not already been run against
228228
your database. You should run this command on production when you deploy to keep
229229
your production database up-to-date.
230230

231+
.. _doctrine-add-more-fields:
232+
231233
Migrations & Adding more Fields
232234
-------------------------------
233235

@@ -715,12 +717,58 @@ relationships.
715717

716718
For info, see :doc:`/doctrine/associations`.
717719

720+
.. _doctrine-fixtures:
721+
718722
Dummy Data Fixtures
719723
-------------------
720724

721725
Doctrine provides a library that allows you to programmatically load testing
722-
data into your project (i.e. "fixture data"). For information, see
723-
the "`DoctrineFixturesBundle`_" documentation.
726+
data into your project (i.e. "fixture data"). Install it with:
727+
728+
.. code-block:: terminal
729+
730+
$ composer require doctrine/doctrine-fixtures-bundle --dev
731+
732+
Then, use the ``make:fixtures`` command to generate an empty fixture class:
733+
734+
.. code-block:: terminal
735+
736+
$ php bin/console make:fixtures
737+
738+
The class name of the fixtures to create (e.g. AppFixtures):
739+
> ProductFixture
740+
741+
Customize the new class to load ``Product`` objects into Doctrine::
742+
743+
// src/DataFixtures/ProductFixture.php
744+
namespace App\DataFixtures;
745+
746+
use Doctrine\Bundle\FixturesBundle\Fixture;
747+
use Doctrine\Common\Persistence\ObjectManager;
748+
749+
class ProductFixture extends Fixture
750+
{
751+
public function load(ObjectManager $manager)
752+
{
753+
$product = new Product();
754+
$product->setName('Priceless widget!');
755+
$product->setPrice(14.50);
756+
$product->setDescription('Ok, I guess it *does* have a price');
757+
$manager->persist($product);
758+
759+
// add more products
760+
761+
$manager->flush();
762+
}
763+
}
764+
765+
Empty the database and reload *all* the fixture classes with:
766+
767+
.. code-block:: terminal
768+
769+
$ php bin/console doctrine:fixtures:load
770+
771+
For information, see the "`DoctrineFixturesBundle`_" documentation.
724772

725773
Learn more
726774
----------

‎doctrine/registration_form.rst

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,19 @@ First, make sure you have all the dependencies you need installed:
1616
1717
$ composer require symfony/orm-pack symfony/form symfony/security-bundle symfony/validator
1818
19-
.. tip::
20-
21-
The popular `FOSUserBundle`_ provides a registration form, reset password
22-
form and other user management functionality.
23-
2419
If you don't already have a ``User`` entity and a working login system,
25-
first start with :doc:`/security/entity_provider`.
20+
first start by following :doc:`/security`.
2621

2722
Your ``User`` entity will probably at least have the following fields:
2823

2924
``username``
3025
This will be used for logging in, unless you instead want your user to
31-
:ref:`login via email <registration-form-via-email>` (in that case, this
26+
:ref:`log in via email <registration-form-via-email>` (in that case, this
3227
field is unnecessary).
3328

3429
``email``
3530
A nice piece of information to collect. You can also allow users to
36-
:ref:`login via email <registration-form-via-email>`.
31+
:ref:`log in via email <registration-form-via-email>`.
3732

3833
``password``
3934
The encoded password.
@@ -166,7 +161,7 @@ With some validation added, your class may look something like this::
166161
The :class:`Symfony\\Component\\Security\\Core\\User\\UserInterface` requires
167162
a few other methods and your ``security.yaml`` file needs to be configured
168163
properly to work with the ``User`` entity. For a more complete example, see
169-
the :ref:`Entity Provider <security-crete-user-entity>` article.
164+
the :doc:`Security Guide </security>`.
170165

171166
.. _registration-password-max:
172167

@@ -420,6 +415,11 @@ To do this, add a ``termsAccepted`` field to your form, but set its
420415
The :ref:`constraints <form-option-constraints>` option is also used, which allows
421416
us to add validation, even though there is no ``termsAccepted`` property on ``User``.
422417

418+
Manually Authenticating after Success
419+
-------------------------------------
420+
421+
If you're using Guard authentication, you can :ref:`automatically authenticate <guard-manual-auth>`
422+
after registration is successful.
423+
423424
.. _`CVE-2013-5750`: https://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form
424-
.. _`FOSUserBundle`: https://github.com/FriendsOfSymfony/FOSUserBundle
425425
.. _`bcrypt`: https://en.wikipedia.org/wiki/Bcrypt

‎frontend/encore/simple-example.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ your layout. In Symfony, use the ``asset()`` helper:
9898
Requiring JavaScript Modules
9999
----------------------------
100100

101-
Webpack is a module bundler... which means that you can ``require`` other JavaScript
101+
Webpack is a module bundler, which means that you can ``require`` other JavaScript
102102
files. First, create a file that exports a function:
103103

104104
.. code-block:: javascript
@@ -139,9 +139,9 @@ The import and export Statements
139139

140140
Instead of using ``require`` and ``module.exports`` like shown above, JavaScript
141141
has an alternate syntax, which is a more accepted standard. Choose whichever you
142-
want: they function identically:
142+
want, they function identically.
143143

144-
To export values, use ``exports``:
144+
To export values using the alternate syntax, use ``exports``:
145145

146146
.. code-block:: diff
147147
@@ -168,7 +168,7 @@ Page-Specific JavaScript or CSS (Multiple Entries)
168168
--------------------------------------------------
169169

170170
So far, you only have one final JavaScript file: ``app.js``. For simple apps or
171-
SPA's (Single Page Applications), that might be fine! However, as your app grows,
171+
SPAs (Single Page Applications), that might be fine! However, as your app grows,
172172
you may want to have page-specific JavaScript or CSS (e.g. homepage, blog, store,
173173
etc.). To handle this, add a new "entry" for each page that needs custom JavaScript
174174
or CSS:

‎reference/configuration/security.rst

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ is set to ``true``) when they try to access a protected resource but isn't
4848
fully authenticated.
4949

5050
This path **must** be accessible by a normal, un-authenticated user, else
51-
you may create a redirect loop. For details, see
52-
":ref:`Avoid Common Pitfalls <security-common-pitfalls>`".
51+
you may create a redirect loop.
5352

5453
check_path
5554
..........

0 commit comments

Comments
 (0)