e719be501e
Remove unnecessary method call
4 years ago
459e2473c8
Remove unused variable
4 years ago
3f09ae0737
Simplify duplicate case
4 years ago
46cc387598
Split workflows
4 years ago
f18d91bd58
Fix pre/post-package-install/update/uninstall events receiving a partial list of operations, fixes #9079
4 years ago
c3db4614c9
Also remove credentials from cache dirs in git/svn drivers, fixes #7439 , refs #9155
4 years ago
98862f5408
Merge pull request #9155 from Ayesh/hide-passwords-cache
...
Sanitize repo URLs to mask HTTP auth passwords from cache directory
4 years ago
9e77514764
Merge pull request #9156 from Ayesh/gitlab-repos
...
AuthHelper: Allow fall-through GitLab-specific HTTP headers for auth
4 years ago
931a1ff1f8
AuthHelper: Allow fall-through GitLab-specific HTTP headers for auth
...
Previously, `AuthHelper` consumed the authentication credentials for GitLab domains and added access tokens as GitLab-specific headers.
[Composer repositories now supported in GitLab](https://php.watch/articles/composer-gitlab-repositories ) require standard Authorization headers with a personal access to function, which failed to work due to out GitLab-specific headers.
With this commit, AuthHelper checks if the password is an access token, and falls through to HTTP basic authentication even if the domain name is a GitLab domain name.
4 years ago
87573aab27
Sanitize repo URLs to mask HTTP auth passwords from cache directory
...
When a Composer repository is cached, a directory name is generated created stored package meta information fetched from that repository.
The cache directory can contain HTTP basic auth tokens, or access_token query parameters that end up in the directory name of the cache directory.
Discovered when trying out [GitLab composer repository feature](https://php.watch/articles/composer-gitlab-repositories ), and the HTTP password was visible in a `composer update -vvv` command.
Using passwords/tokens in the URL is fundamentally a bad idea, but Composer already has `\Composer\Util\Url::sanitize()` that tries to mitigate such cases, and this same function is applied to the repo URL before deciding the name of the repo cache directory.
4 years ago
dc1fd92b9b
Util/Zip: fix strpos args order
...
`strpos()` first argument is a haystack, not a needle.
`strpos('x', $s)` is identical to `$s === 'x'` which is probably not what we want here.
4 years ago
90332f1dbd
Add a readonly mode to the cache, fixes #9150
4 years ago
875a4784ed
Reorg config class a little
4 years ago
6186c7f36f
Fix handling of root aliases in partial updates, fixes #9110
4 years ago
05e9fe936f
Merge branch '1.10'
4 years ago
b847c4dc3a
Validate licenses correctly even when proprietary is combined with some other license, fixes #9144
4 years ago
d140a842fa
RemoteFilesystem: avoid warning when setting max file size
4 years ago
2bd1bd4194
Merge pull request #9142 from oleg-andreyev/fixing-error-message-for-higher-priority-repo
...
fixing error message for higher repository priority when it provides only a dev-branch
4 years ago
448daea696
Add support for detecting packages not matching only due to minimum stability
4 years ago
e5ba99cf67
Merge branch '1.10'
4 years ago
9ea9d20b21
Merge pull request #9130 from glaubinix/t/max-file-size
...
Downloader: add a max_file_size option to prevent too big files to be downloaded
4 years ago
a16f32484b
Downloader: add a max_file_size to prevent too big files to be downloaded
4 years ago
f262feebec
fixing error message for higher repository priority, when higher repo has only a dev-branch
4 years ago
a83588f568
The proper fix
4 years ago
4e06aa051a
Check if inet_pton() exists
4 years ago
3be62a9fda
Fix openssl_free_key deprecation notice in PHP 8
4 years ago
fdff3aeaba
emit github action formatted error messages ( #9120 )
4 years ago
c845d66818
Lowercase ext- package names, refs #9093
4 years ago
4d20e6f5d6
Move Version util to Platform namespace, fix CS nitpicks, make regexes case insensitive for robustness, refs #9093
4 years ago
7e1ef19a5a
Expand library version checking capabilities ( closes #9093 )
4 years ago
657ae5519e
Add support for TAR in Artifact packages ( #9105 )
4 years ago
ff757e649c
Use pool to match packages to avoid getting packages without ids, fixes #9094
4 years ago
826db3db5e
Used locked repo only if it is present
4 years ago
c0eb9834fe
Merge pull request #9116 from ryanaslett/patch-1
...
Update PathDownloader.php
4 years ago
51b1a752e3
Merge pull request #9098 from GrahamCampbell/patch-1
...
Use consistent phpdoc nullable syntax
4 years ago
7649c8438d
Fix exception when using create-project in current directory, fixes #9073
4 years ago
c0309f22d7
Update PathDownloader.php
...
If a path repository points at a directory that is managed by composer installers, the path that gets set ends up being relative, and this check fails to see that the source is already present, and therefore removes it.
Since ->install is already using realpath around the $path argument, remove should as well.
For an example repository that demonstrates this bug See: https://github.com/ryanaslett/pathrepotestcase
4 years ago
019febb5fa
Use consistent phpdoc nullable syntax
4 years ago
2d3905157d
Merge branch '1.10'
4 years ago
00f712a7c4
Revert "Allow specifying a version requirement for CLDR"
4 years ago
387e828993
Promote next major version when running stable self-update, and prevent self-update from automatically upgrading to the next major release
4 years ago
5bd61ac55c
Cache versions data to avoid redownloading it twice during self-update
4 years ago
7028d0ce27
Merge pull request #9077 from glaubinix/f/api-data-detection
...
Driver: only cache composer.json file without API data to disk
4 years ago
daae46e1e0
Merge pull request #9085 from lstrojny/lib-cldr
...
Allow specifying a version requirement for CLDR
4 years ago
12d6759888
Fail hard instead of skipping branches/tags quietly when parsing VCS repos if 401/403 are returned, fixes #9087
4 years ago
7bcde1481d
Fix git downloader syntax for windows cmd when updating packages, fixes #9089
4 years ago
79813b2f77
Fix detection of git refs to be more strict
4 years ago
5a02ea6a96
Check that class exists
4 years ago
404dea61c2
Allow specifying a version requirement for the relevant CLDR
4 years ago
b25296ef74
Driver: only cache composer.json file without API data to disk
4 years ago
username
Jordi Boggiano
Ayesh Karunaratne
Iskander (Alex) Sharipov
Stephan
Oleg Andreyev
Lars Strojny
johnstevenson
Markus Staab
Wissem Riahi
Ryan Aslett
Graham Campbell