This week Symfony published three security releases to address a potential code injection issue in the way Symfony implements translation caching in FrameworkBundle. In addition, it fixed object initializers for Validator component and it removed spaceless blocks from Twig templates.

Symfony2 development highlights

2.3 changelog:

  • 8f9ed3e: [Twig Bridge] removed Spaceless Blocks from Twig Form Templates
  • 06fc97e: [HttpFoundation] prevented magic bytes injection in JSONP responses (CVE-2014-4671)
  • 06a80fb, 3176f8b: validate locales sets into translator
  • d418935: [Process] fixed unit tests on Windows platform
  • 91e32f8: [Process] use correct test for empty string in UnixPipes
  • 291cbf9: [Validator] object initializers are called only once per object

2.4 changelog:

  • 793a083: removed Spaceless Blocks From Twig Templates

2.5 changelog:

  • 2ac1bb4: [Console] removed estimated field from debug_nomax
  • 705d67b: [Form] solved dependency to ValidatorInterface

Master changelog:

Newest issues and pull requests

They talked about us

Published in #A week of symfony