18009af023
Inline variable
2020-08-29 21:16:58 +02:00
e719be501e
Remove unnecessary method call
2020-08-29 21:15:52 +02:00
459e2473c8
Remove unused variable
2020-08-29 21:15:15 +02:00
3f09ae0737
Simplify duplicate case
2020-08-29 21:13:54 +02:00
46cc387598
Split workflows
2020-08-29 21:12:07 +02:00
f18d91bd58
Fix pre/post-package-install/update/uninstall events receiving a partial list of operations, fixes #9079
2020-08-27 11:25:43 +02:00
c3db4614c9
Also remove credentials from cache dirs in git/svn drivers, fixes #7439 , refs #9155
2020-08-27 10:19:23 +02:00
98862f5408
Merge pull request #9155 from Ayesh/hide-passwords-cache
...
Sanitize repo URLs to mask HTTP auth passwords from cache directory
2020-08-27 10:12:56 +02:00
9e77514764
Merge pull request #9156 from Ayesh/gitlab-repos
...
AuthHelper: Allow fall-through GitLab-specific HTTP headers for auth
2020-08-27 10:06:28 +02:00
931a1ff1f8
AuthHelper: Allow fall-through GitLab-specific HTTP headers for auth
...
Previously, `AuthHelper` consumed the authentication credentials for GitLab domains and added access tokens as GitLab-specific headers.
[Composer repositories now supported in GitLab](https://php.watch/articles/composer-gitlab-repositories ) require standard Authorization headers with a personal access to function, which failed to work due to out GitLab-specific headers.
With this commit, AuthHelper checks if the password is an access token, and falls through to HTTP basic authentication even if the domain name is a GitLab domain name.
2020-08-27 12:13:28 +07:00
87573aab27
Sanitize repo URLs to mask HTTP auth passwords from cache directory
...
When a Composer repository is cached, a directory name is generated created stored package meta information fetched from that repository.
The cache directory can contain HTTP basic auth tokens, or access_token query parameters that end up in the directory name of the cache directory.
Discovered when trying out [GitLab composer repository feature](https://php.watch/articles/composer-gitlab-repositories ), and the HTTP password was visible in a `composer update -vvv` command.
Using passwords/tokens in the URL is fundamentally a bad idea, but Composer already has `\Composer\Util\Url::sanitize()` that tries to mitigate such cases, and this same function is applied to the repo URL before deciding the name of the repo cache directory.
2020-08-26 23:01:00 +07:00
dc1fd92b9b
Util/Zip: fix strpos args order
...
`strpos()` first argument is a haystack, not a needle.
`strpos('x', $s)` is identical to `$s === 'x'` which is probably not what we want here.
2020-08-26 17:23:10 +03:00
90332f1dbd
Add a readonly mode to the cache, fixes #9150
2020-08-25 13:55:32 +02:00
875a4784ed
Reorg config class a little
2020-08-25 13:54:29 +02:00
6186c7f36f
Fix handling of root aliases in partial updates, fixes #9110
2020-08-25 11:05:28 +02:00
05e9fe936f
Merge branch '1.10'
2020-08-25 08:59:07 +02:00
b847c4dc3a
Validate licenses correctly even when proprietary is combined with some other license, fixes #9144
2020-08-25 08:58:43 +02:00
d140a842fa
RemoteFilesystem: avoid warning when setting max file size
2020-08-24 13:53:07 +01:00
2bd1bd4194
Merge pull request #9142 from oleg-andreyev/fixing-error-message-for-higher-priority-repo
...
fixing error message for higher repository priority when it provides only a dev-branch
2020-08-23 16:52:55 +02:00
448daea696
Add support for detecting packages not matching only due to minimum stability
2020-08-23 16:48:07 +02:00
e5ba99cf67
Merge branch '1.10'
2020-08-23 15:18:48 +02:00
9ea9d20b21
Merge pull request #9130 from glaubinix/t/max-file-size
...
Downloader: add a max_file_size option to prevent too big files to be downloaded
2020-08-23 13:37:12 +02:00
a16f32484b
Downloader: add a max_file_size to prevent too big files to be downloaded
2020-08-22 19:37:42 +01:00
f262feebec
fixing error message for higher repository priority, when higher repo has only a dev-branch
2020-08-22 20:07:13 +03:00
a83588f568
The proper fix
2020-08-18 16:30:47 +02:00
4e06aa051a
Check if inet_pton() exists
2020-08-18 16:00:44 +02:00
3be62a9fda
Fix openssl_free_key deprecation notice in PHP 8
2020-08-14 17:45:41 +01:00
fdff3aeaba
emit github action formatted error messages ( #9120 )
2020-08-13 16:37:32 +02:00
c845d66818
Lowercase ext- package names, refs #9093
2020-08-13 15:48:41 +02:00
4d20e6f5d6
Move Version util to Platform namespace, fix CS nitpicks, make regexes case insensitive for robustness, refs #9093
2020-08-13 15:48:41 +02:00
7e1ef19a5a
Expand library version checking capabilities ( closes #9093 )
2020-08-13 15:48:41 +02:00
657ae5519e
Add support for TAR in Artifact packages ( #9105 )
2020-08-12 20:30:58 +02:00
ff757e649c
Use pool to match packages to avoid getting packages without ids, fixes #9094
2020-08-12 12:41:19 +02:00
826db3db5e
Used locked repo only if it is present
2020-08-12 11:11:37 +02:00
c0eb9834fe
Merge pull request #9116 from ryanaslett/patch-1
...
Update PathDownloader.php
2020-08-11 09:54:09 +02:00
51b1a752e3
Merge pull request #9098 from GrahamCampbell/patch-1
...
Use consistent phpdoc nullable syntax
2020-08-11 09:52:09 +02:00
7649c8438d
Fix exception when using create-project in current directory, fixes #9073
2020-08-11 09:42:42 +02:00
c0309f22d7
Update PathDownloader.php
...
If a path repository points at a directory that is managed by composer installers, the path that gets set ends up being relative, and this check fails to see that the source is already present, and therefore removes it.
Since ->install is already using realpath around the $path argument, remove should as well.
For an example repository that demonstrates this bug See: https://github.com/ryanaslett/pathrepotestcase
2020-08-10 12:51:48 -07:00
019febb5fa
Use consistent phpdoc nullable syntax
2020-08-02 15:10:54 +01:00
2d3905157d
Merge branch '1.10'
2020-07-30 21:06:51 +02:00
00f712a7c4
Revert "Allow specifying a version requirement for CLDR"
2020-07-30 21:00:43 +02:00
387e828993
Promote next major version when running stable self-update, and prevent self-update from automatically upgrading to the next major release
2020-07-30 16:32:29 +02:00
5bd61ac55c
Cache versions data to avoid redownloading it twice during self-update
2020-07-30 16:32:29 +02:00
7028d0ce27
Merge pull request #9077 from glaubinix/f/api-data-detection
...
Driver: only cache composer.json file without API data to disk
2020-07-30 15:32:10 +02:00
daae46e1e0
Merge pull request #9085 from lstrojny/lib-cldr
...
Allow specifying a version requirement for CLDR
2020-07-30 14:53:46 +02:00
12d6759888
Fail hard instead of skipping branches/tags quietly when parsing VCS repos if 401/403 are returned, fixes #9087
2020-07-30 14:38:49 +02:00
7bcde1481d
Fix git downloader syntax for windows cmd when updating packages, fixes #9089
2020-07-30 14:38:48 +02:00
79813b2f77
Fix detection of git refs to be more strict
2020-07-30 14:38:48 +02:00
5a02ea6a96
Check that class exists
2020-07-30 14:29:48 +02:00
404dea61c2
Allow specifying a version requirement for the relevant CLDR
2020-07-29 19:32:53 +02:00
username