Merge branch 'master' into 3.next

.travis.yml

@@ -45,20 +45,12 @@ matrix:
     - php: 7.1
       env: PHPSTAN=1 DEFAULT=0
 
-    - php: hhvm
-      env: HHVM=1 DB=sqlite db_dsn='sqlite:///:memory:'
-
-    - php: hhvm
-      env: HHVM=1 DB=mysql db_dsn='mysql://travis@0.0.0.0/cakephp_test'
-
   allow_failures:
-    - php: hhvm
-
     - php: 7.0
       env: PHPCS=3 DEFAULT=0
 
 before_install:
-  - if [ $HHVM != 1 && $TRAVIS_PHP_VERSION != 7.* ]; then phpenv config-rm xdebug.ini; fi
+  - if [ $TRAVIS_PHP_VERSION != 7.0 ]; then phpenv config-rm xdebug.ini; fi
 
   - if [ -n "$GH_TOKEN" ]; then composer config github-oauth.github.com ${GH_TOKEN}; fi;
 
@@ -70,17 +62,14 @@ before_install:
   - if [ $DB = 'pgsql' ]; then psql -c 'CREATE SCHEMA test2;' -U postgres -d cakephp_test; fi
   - if [ $DB = 'pgsql' ]; then psql -c 'CREATE SCHEMA test3;' -U postgres -d cakephp_test; fi
 
-  - if [[ $TRAVIS_PHP_VERSION != 'hhvm' ]] ; then pecl channel-update pecl.php.net; fi;
-
-  - if [[ $TRAVIS_PHP_VERSION != 'hhvm' ]] ; then echo 'extension = memcached.so' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
-  - if [[ $TRAVIS_PHP_VERSION != 'hhvm' ]] ; then echo 'extension = redis.so' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
-  - if [[ $TRAVIS_PHP_VERSION != 'hhvm' ]] ; then echo 'extension = apcu.so' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
-  - if [[ $TRAVIS_PHP_VERSION != 'hhvm' ]] ; then echo 'apc.enable_cli = 1' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
+  - if [[ $DEFAULT = 1 || $PHPSTAN = 1 ]] ; then pecl channel-update pecl.php.net; fi;
+  - if [[ $DEFAULT = 1 || $PHPSTAN = 1 ]] ; then echo 'extension = memcached.so' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
+  - if [[ $DEFAULT = 1 || $PHPSTAN = 1 ]] ; then echo 'extension = redis.so' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
+  - if [[ $DEFAULT = 1 || $PHPSTAN = 1 ]] ; then echo 'extension = apcu.so' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
+  - if [[ $DEFAULT = 1 || $PHPSTAN = 1 ]] ; then echo 'apc.enable_cli = 1' >> ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
   - if [[ ${TRAVIS_PHP_VERSION:0:1} == "7" ]] ; then echo "yes" | pecl install channel://pecl.php.net/apcu-5.1.5 || true; fi
   - if [[ ${TRAVIS_PHP_VERSION:0:1} == "5" ]] ; then echo "yes" | pecl install apcu-4.0.11 || true; fi
-  - if [[ $TRAVIS_PHP_VERSION = 5.6 && $DB = 'mysql' ]] ; then wget http://xcache.lighttpd.net/pub/Releases/3.2.0/xcache-3.2.0.tar.gz; tar xf xcache-3.2.0.tar.gz; pushd xcache-3.2.0; phpize; ./configure; make; NO_INTERACTION=1 make test; make install; popd;printf "extension=xcache.so\nxcache.size=64M\nxcache.var_size=16M\nxcache.test=On" > ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
-  - phpenv rehash
-  - set +H
+  - if [[ ${TRAVIS_PHP_VERSION:0:1} == "5" && $DB = 'mysql' ]] ; then wget http://xcache.lighttpd.net/pub/Releases/3.2.0/xcache-3.2.0.tar.gz; tar xf xcache-3.2.0.tar.gz; pushd xcache-3.2.0; phpize; ./configure; make; NO_INTERACTION=1 make test; make install; popd;printf "extension=xcache.so\nxcache.size=64M\nxcache.var_size=16M\nxcache.test=On" > ~/.phpenv/versions/$(phpenv version-name)/etc/php.ini; fi
 
 before_script:
   - composer install --prefer-dist --no-interaction

Makefile

@@ -37,7 +37,7 @@ help:
 	@echo "CakePHP Makefile"
 	@echo "================"
 	@echo ""
-	@echo "release"
+	@echo "release VERSION=x.y.z"
 	@echo "  Create a new release of CakePHP. Requires the VERSION and GITHUB_USER, or GITHUB_TOKEN parameter."
 	@echo "  Packages up a new app skeleton tarball and uploads it to github."
 	@echo ""
@@ -50,6 +50,9 @@ help:
 	@echo "components"
 	@echo "  Split each of the public namespaces into separate repos and push the to Github."
 	@echo ""
+	@echo "clean-components CURRENT_BRANCH=xx"
+	@echo "  Delete branch xx from each subsplit. Useful when cleaning up after a security release."
+	@echo ""
 	@echo "test"
 	@echo "  Run the tests for CakePHP."
 	@echo ""
@@ -188,5 +191,12 @@ tag-component-%: component-% guard-VERSION guard-GITHUB_USER
 	git branch -D $*
 	git remote rm $*
 
+# Tasks for cleaning up branches created by security fixes to old branches.
+components-clean: $(foreach component, $(COMPONENTS), clean-component-$(component))
+clean-component-%:
+	- (git remote add $* git@github.com:$(OWNER)/$*.git -f 2> /dev/null)
+	- (git branch -D $* 2> /dev/null)
+	- git push -f $* :$(CURRENT_BRANCH)
+
 # Top level alias for doing a release.
 release: guard-VERSION guard-GITHUB_USER tag-release components-tag package publish

VERSION.txt

@@ -16,4 +16,4 @@
 // @license       http://www.opensource.org/licenses/mit-license.php MIT License
 // +--------------------------------------------------------------------------------------------+ //
 ////////////////////////////////////////////////////////////////////////////////////////////////////
-3.4.4
+3.4.5

composer.json

@@ -24,7 +24,7 @@
         "cakephp/chronos": "~1.0",
         "aura/intl": "^3.0.0",
         "psr/log": "^1.0",
-        "zendframework/zend-diactoros": "~1.0"
+        "zendframework/zend-diactoros": "^1.4"
     },
     "suggest": {
         "ext-openssl": "To use Security::encrypt() or have secure CSRF token generation.",

src/Console/Shell.php

@@ -433,7 +433,7 @@ class Shell
             $this->params = array_merge($this->params, $extra);
         }
         $this->_setOutputLevel();
-        if (!empty($this->params['plugin'])) {
+        if (!empty($this->params['plugin']) && !Plugin::loaded($this->params['plugin'])) {
             Plugin::load($this->params['plugin']);
         }
         $this->command = $command;

src/Http/Client/Request.php

@@ -27,7 +27,6 @@ use Zend\Diactoros\Stream;
  */
 class Request extends Message implements RequestInterface
 {
-    use MessageTrait;
     use RequestTrait;
 
     /**

src/Network/Exception/InvalidCsrfTokenException.php

@@ -27,7 +27,7 @@ class InvalidCsrfTokenException extends HttpException
     public function __construct($message = null, $code = 403)
     {
         if (empty($message)) {
-            $message = 'Invalid  CSRF Token';
+            $message = 'Invalid CSRF Token';
         }
         parent::__construct($message, $code);
     }

src/Template/Error/missing_controller.ctp

@@ -44,6 +44,9 @@ $this->start('subheading');
 ?>
 <strong>Error: </strong>
 <em><?= h($pluginDot . $class) ?>Controller</em> could not be found.
+<p>
+    In the case you tried to access a plugin controller make sure you added it to your composer file or you use the autoload option for the plugin.
+</p>
 <?php $this->end() ?>
 
 <?php $this->start('file') ?>