[HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache

Bug fix: yes
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: #1813
Todo: -

In order to work, add this to the .htaccess:

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]
fixed CS
merged 2.0
fixed CS
Changed composer constraint to allow Doctrine 2.3 too
Added missing dependency to doctrine common in the global composer.json

Doctrine Common is a dependency of FrameworkBundle for the annotation
reader.
merged branch kepten/ticket_1813 (PR #3551)

Commits
-------

a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache

Discussion
----------

[HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache

Bug fix: yes
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: #1813
Todo: -

In order to work, add this to the .htaccess:

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]

---------------------------------------------------------------------------

by stof at 2012-03-10T17:34:26Z

you should also add a unit test for this

---------------------------------------------------------------------------

by kepten at 2012-03-11T15:34:04Z

Thanks for the feedback, I committed the changes.

---------------------------------------------------------------------------

by stof at 2012-04-04T01:59:53Z

@fabpot could you review it ?

---------------------------------------------------------------------------

by fabpot at 2012-04-04T07:15:34Z

My comments:

 * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers.

 * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs).

 * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed).

---------------------------------------------------------------------------

by danielholmes at 2012-04-14T13:27:09Z

A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this:

```
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.*)$ app.php [QSA,L]
</IfModule>
```

NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening

---------------------------------------------------------------------------

by towards at 2012-04-20T16:12:49Z

@kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI

---------------------------------------------------------------------------

by kepten at 2012-04-20T16:15:57Z

ok, so is my PR is useless or should I still fix problems?

---------------------------------------------------------------------------

by towards at 2012-04-20T16:20:26Z

your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes

---------------------------------------------------------------------------

by vicb at 2012-04-20T16:20:36Z

I have been working with @towards: your PR is useful, please implement his comments and squash your PR.

---------------------------------------------------------------------------

by kepten at 2012-04-20T16:59:07Z

never squashed before, is it okay now? :)

---------------------------------------------------------------------------

by stof at 2012-04-20T17:21:07Z

it is

---------------------------------------------------------------------------

by vicb at 2012-05-20T19:57:51Z

@fabpot this should be ready to be merged
merged branch stof/allow_doctrine_2_3 (PR #4350)

Commits
-------

0581c3a Added missing dependency to doctrine common in the global composer.json
cdfb0b1 Changed composer constraint to allow Doctrine 2.3 too

Discussion
----------

Changed composer constraint to allow Doctrine 2.3 too

This allows both the 2.2.x and 2.3.x series for the Doctrine constraints instead of restricting to 2.2.x (thus allowing me to allow Doctrine 2.3 in DoctrineBundle too).

It also fixes some constraint that were missed when bumping the requirement to Doctrine 2.2 and added the missing deps in the global file (FrameworkBundle declares its dependency to ``doctrine/common`` for the ``annotation_reader`` service but it was not declared in the global file)

---------------------------------------------------------------------------

by travisbot at 2012-05-20T20:36:06Z

This pull request [fails](http://travis-ci.org/symfony/symfony/builds/1383231) (merged 0581c3a5 into 1407f112).

---------------------------------------------------------------------------

by stof at 2012-05-20T20:56:18Z

The failure is because the doctrine ORM does not allow Doctrine Common 2.2.x but only stable releases (see doctrine/doctrine2#351 fixing it) and Composer seems to resolve dev dependencies by considering all previous resolved deps as fixed whereas downgrading common to 2.2.2 could have worked to satisfy all deps

---------------------------------------------------------------------------

by fabpot at 2012-05-21T05:56:56Z

So, I cannot merge this until the composer bug is fixed (ping @naderman)

---------------------------------------------------------------------------

by stof at 2012-05-21T07:00:29Z

you could merge it now. The PR to the ORM has been merged so the composer.json is not triggering the issue anymore
[Console] Check for existence of proc_open to fix #4338

cs fix
merged branch davidwindell/issue_4338 (PR #4357)

Commits
-------

0a3dd0f [Console] Check for existence of proc_open to fix #4338

Discussion
----------

[Console] Check for existence of proc_open to fix #4338

It is quite common to disable proc_open for security purposes.

This PR checks for the existence of the proc_open function and fixes Issue #4338

Replacement for PR4356

---------------------------------------------------------------------------

by travisbot at 2012-05-21T10:49:59Z

This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1387784) (merged dd991bea into 1407f112).

---------------------------------------------------------------------------

by travisbot at 2012-05-21T11:35:21Z

This pull request [passes](http://travis-ci.org/symfony/symfony/builds/1387991) (merged 0a3dd0fe into 1407f112).

---------------------------------------------------------------------------

by fabpot at 2012-05-21T12:17:32Z

I forgot to ask you to sent a new PR for the 2.0 branch instead of master. Thanks.

---------------------------------------------------------------------------

by davidwindell at 2012-05-21T13:03:36Z

proc_open is not used in 2.0?
fixed CS
merged 2.0
fixed CS
Merge remote-tracking branch 'upstream/master'

* upstream/master:
  fixed CS
  fixed CS
  [Console] Check for existence of proc_open to fix #4338
  Added missing dependency to doctrine common in the global composer.json
  Changed composer constraint to allow Doctrine 2.3 too
  fixed CS
  fixed CS
  [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache