Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logout #2606

Closed
wants to merge 82 commits into from
Closed

Logout #2606

wants to merge 82 commits into from

Conversation

ChoboHub
Copy link
Contributor

No description provided.

nitriques and others added 30 commits February 11, 2016 13:39
They are not needed anymore since we use a auto loader
This commit adds a grunt task (named `php`) that will run phpcs with the PSR-2 standard.

Note that you have to install php_codesniffer which has been added as a require-dev lib.

Doing `composer install` will mess up Symphony's auto loader, so please `git checkout vendor` after the composer call
This commit introduce a new jQuery plugin called Default Value, which
gives a input a source element to value its value from, when a specified
event occurs on this source element.

This behaviour is switched to off when the users focuses on the input
field and then blurs out, leaving a value in the input.

This commit also hooks this behaviours on the Data Source name input and
on the Event name input.

Closes symphonycms#2511
This function should be checking new value for emptiness, but it was checking
the database value instead. Additionally, at this point, the database value
would always be `NULL`. Changed to use the correct variable.
When there is no data written to the database, return `true` instead of `false`.
Logically, the operation is successful.

See: http://php.net/manual/en/sessionhandlerinterface.write.php

When no data has been read, the read method should return an emtpy string, but
it was returning NULL instead.

See: http://php.net/manual/en/sessionhandlerinterface.read.php
This way, developer can change the sorting order, which is Symphony's order by default
This change is primarly to make sure we do not have to url encode the xsrf token.

Also, the default value for the method is now 30 instead of 20. (the magic 20 number was undocumented). The magic number used in the for loop for the fallback is also replace by the length parameter value: the sorter the nonce, the more iteration we have to make to shuffle things more.

Finally the method will now throw an Exception if the length is smaller than 1.

Fixes symphonycms#2567
Added support for PHP 7 random_bytes() and the mcrypt package.

Re symphonycms#2567
The two SQL statements where mostly the same so they got refactored out.

Also, this will provide another extension point for extension developers that inherits from the file upload.
This fixes a fatal error on the install page when the extension folder does not exists
First of all there's a big 'error' on the namespace which never matched as there was a typo.

Second if a hash exists; the namespace query is run for no reason as data is overwritten by the if statement underneath.
Fix Namespace Cache Typo & remove useless query
Url seems to be case sensitive now.

Closes symphonycms#2580
…onycms#2530)

* Set "Sections Index" as default area of default (first) author

Because not having a default area isn’t considered in the UI.

* Set "/blueprints/sections/" as default area fallback for developers

symphonycms#2529

* Fix Whitespace
A very small formatting fix.
In MySQL 5.7 a datetime field cannot have a default value of "0000-00-00" for the date, the minimum value is "1000-01-01".
This thing really complicates things and should have been removed
earlier
This change is to protect our users against a poorly setup server. PHP
can allow pretty scary things security-wise, so it's best to make sure
things that can only have one valid setting should be enforced.

Thanks to @hyp3rlinx for this.
nitriques and others added 25 commits June 4, 2016 16:35
This issue has been discovered by @hyp3rlinx

Script and html injection was possible, when the user was authenticated
This prevents XSS from error message, which can be remote messages
Exceptions can come from remote servers (like MySQL or SMTP) and can
contain invalid xml data.

User exceptions can also break this rule. As a safety precaution, we
will wrap message just before ouput.

Also, it's worthy to say that multiple calls to
General::General::wrapInCDATA() is safe.

Fixes symphonycms#2518
It does not have any purpose now since we do not even have a
with-selected dropdown anymore on the index page.

Fixes symphonycms#2573
This will prevent overwriting the previous values
Not visible element should be made readonly, since the user can't edit
them anyways.

This fixes a problem where Chrome would auto-fill hidden input and the
value would be saved without the user ever seeing it.

We already tried to fix the problem usign a standard solution
(auto-complete="off", symphonycms#1843 and symphonycms#1841) but it does not work. We also tried a non-standard
solution (symphonycms#2258) which was rejected.

This change only uses standard solution, even thought it relies on
javascript to make things works (it should not be a problem since the
backend now heavily relies on javascript)
Also added a grunt task to get the current commit id we have building on
* Accept an array of tags 189b387

While the tag list field always returned string (parameter pool) and array values (XML) in the output, it did only accept a string of tags on post. This commit extends the field to accept an array of tags as well which is helpful, if you are building a tag list widget on the front-end and would like to post back to the system.

This change is supposed to be backwards compatible (it doesn't change the behaviour for posted string values).

* Fix whitespace 49a5200
The SQL generated by the code introduce in
786d1cc contained errors:

1. A superflous ' was present arount the $bit part twice
2. A opening parenthesis ( was missing at the start of the WHERE clause

Re symphonycms#2602

Found when reviewing 7e9c94e
Removing code duplication

Re symphonycms#2602
It's redundant and totally not needed.
Reduces possible reuse.
chmod can fail for numerous reason, like when the user running php does
not have proper rights on the filesystem.
0777 is a dangerous settings and should try to be avoided as a default
value.

Re: symphonycms/jit_image_manipulation#131
@michael-e
Copy link
Member

What's going on here? Dozens of commits? Somebody messing up the Git repo? I just received the following email:

You can view, comment on, or merge this pull request online at:

#2606

Commit Summary

Added link to MIT licence
remove require_once call
added missing doc
removed include_once calls
Updated grunt deps
Added a grunt task to run phpcs
Added github specific files for contribution
Added Default Value plugin
new assets build
Fix usage of Session::unserialize()
Update Session class to PHP 7 specification
Added custom sort parameter
Added section id to the output
splitted the DOMAIN constant to create the DIRROOT constant
added DIRROOT as root-dir parameter
Made generateNonce() return value url safe
Add more random sources
Refactored how the field gets it current values
Prevent errors if EXTENSIONS is un readable
Fix Namespace Cache Typo & remove useless query
Merge pull request #2582 from jonmifsud/patch-1
Fix storage warnings on MySQL 5.7
Fix broken MySQL doc link
Set "Sections Index" as default area of default (first) author (#2530)
Fix code formatting (#2586)
mt_srand function argument must be an integer
Datetime field cannot have a default value of "0000-00-00"
Prevent cookie issues when running behind a proxy (#2590)
Deprecated $_SESSION copy into $_COOKIE
Better php.ini overrides for insecure setups
Allow install in folders with special chars
Make sure the process is at the right place
Use HTTP_HOST constant instead of reading $_SERVER
Make sure user can delete the author (#2572)
Only request the needed schema in table view (#2568)
Added ticks around table in DELETE statement
Add support for tag negation and filterable ops
Add delegate prior to checking a field's post data (#2549)
Add data-attributes to publish filtering interface (#2577)
Lock/unlock tables when editing entries (#2585)
Use $_SERVER[] instead of getenv()
Provide an extension point to $_SERVER reads
Whitespace fixes
Make sure the DIRROOT constant ends with a /
Fix root-dir parameter potential double /
Added workspace-dir parameter
Use DIRROOT for cookie path
Fix cookie safe url creation
Split out the http protocol logic into a constant
Restore sanity in url paths
Fixed double ticks in SQL query
Remove trailing slash from safe cookie path
Remove mcrypt as it is not maintained
Fix stupid typo
Make sure we are dealing with arrays
Added missing $_REQUEST when fixing magic_quotes
Fixing potential XSS
Added 2.7.0 migration file
Added migration_270 to autoloader
Sanitize error message
Wrap exceptions xml message in CDATA
Delete __actionIndex from authors content page
Output password and email even when auth == 0
Call static methods from static context
Make pickable hidden forms elements readonly
Make email prefs pane inputs readonly by default
Updated grunt deps
Added a grunt banner
New assets build
Tag list field: accept an array of tags (#2602)
Fix SQL problem with AND (+) operation
Refactored user data parsing
Fix broken alignment
Removed unecessary div. qualifier
New assets build
Fix #2603 for real
new assets build, re #2603
Standardize EOL in build
Supress warning when chmod does not work
Change default permission in uploadFile to 0644
File Changes

A CONTRIBUTING.md (15)
A ISSUE_TEMPLATE.md (3)
A PULL_REQUEST_TEMPLATE.md (5)
M README.markdown (1)
M composer.json (3)
M gruntfile.js (57)
M index.php (3)
M install/includes/htaccess.txt (2)
M install/includes/install.sql (2)
M install/lib/class.installer.php (2)
A install/migrations/2.7.0.php (21)
M package.json (17)
M symphony/assets/css/devkit.min.css (9)
M symphony/assets/css/installer.min.css (9)
M symphony/assets/css/src/admin.css (13)
M symphony/assets/css/src/symphony.drawers.css (18)
M symphony/assets/css/symphony.min.css (9)
M symphony/assets/js/src/backend.views.js (8)
A symphony/assets/js/src/symphony.defaultvalue.js (95)
M symphony/assets/js/src/symphony.filtering.js (15)
M symphony/assets/js/src/symphony.pickable.js (4)
M symphony/assets/js/symphony.min.js (4393)
M symphony/content/content.ajaxquery.php (9)
M symphony/content/content.ajaxsections.php (7)
M symphony/content/content.blueprintsdatasources.php (2)
M symphony/content/content.login.php (2)
M symphony/content/content.publish.php (63)
M symphony/content/content.systemauthors.php (91)
M symphony/content/content.systempreferences.php (9)
M symphony/lib/boot/bundle.php (2)
M symphony/lib/boot/defines.php (43)
M symphony/lib/boot/func.utilities.php (22)
M symphony/lib/core/class.administration.php (15)
M symphony/lib/core/class.cookie.php (1)
M symphony/lib/core/class.session.php (43)
M symphony/lib/core/class.symphony.php (14)
M symphony/lib/toolkit/cache/cache.database.php (10)
M symphony/lib/toolkit/class.cryptography.php (2)
M symphony/lib/toolkit/class.datasource.php (2)
M symphony/lib/toolkit/class.email.php (2)
M symphony/lib/toolkit/class.entry.php (27)
M symphony/lib/toolkit/class.entrymanager.php (49)
M symphony/lib/toolkit/class.extensionmanager.php (5)
M symphony/lib/toolkit/class.field.php (4)
M symphony/lib/toolkit/class.fieldmanager.php (2)
M symphony/lib/toolkit/class.frontendpage.php (3)
M symphony/lib/toolkit/class.general.php (10)
M symphony/lib/toolkit/class.lang.php (4)
M symphony/lib/toolkit/class.mysql.php (4)
M symphony/lib/toolkit/class.page.php (8)
M symphony/lib/toolkit/class.sectionmanager.php (2)
M symphony/lib/toolkit/class.xsrf.php (56)
M symphony/lib/toolkit/data-sources/class.datasource.static.php (2)
M symphony/lib/toolkit/email-gateways/email.sendmail.php (6)
M symphony/lib/toolkit/email-gateways/email.smtp.php (32)
M symphony/lib/toolkit/events/class.event.section.php (2)
M symphony/lib/toolkit/fields/field.date.php (4)
M symphony/lib/toolkit/fields/field.input.php (2)
M symphony/lib/toolkit/fields/field.taglist.php (159)
M symphony/lib/toolkit/fields/field.textarea.php (2)
M symphony/lib/toolkit/fields/field.upload.php (32)
M symphony/template/blueprints.datasource.tpl (6)
M symphony/template/usererror.database.php (2)
M symphony/template/usererror.generic.php (2)
M symphony/template/usererror.missing_extension.php (2)
M symphony/template/usererror.xslt.php (2)
M vendor/composer/autoload_classmap.php (5)
Patch Links:

https://github.com/symphonycms/symphony-2/pull/2606.patch
https://github.com/symphonycms/symphony-2/pull/2606.diff

You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

@nitriques
Copy link
Member

What's going on here?

LOL Sorry @michael-e ! @ChoboHub is working with me and looks like he made a mistake! Haha

We can close this, we'll figure things out!

Sorry again ;)

@nitriques nitriques closed this Jul 20, 2016
@nitriques
Copy link
Member

BTW: the problem is: this PR wants to merge 2.7.x + 1 commit to master.

@ChoboHub The PR must be submitted against the 2.7.x branch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

9 participants