save auto-escaping of generated URLs when possible for performance reasons
Outsource all the BCrypt heavy lifting to a library
[Security] tweaked previous commit
[TwigBridge] added some unit test for the previous commit
merged branch fabpot/bcrypt (PR #7853)

This PR was merged into the master branch.

Discussion
----------

[Security] Outsource all the BCrypt heavy lifting to a library

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | yes
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

The [BCrypt bundle](https://github.com/elnur/ElnurBlowfishPasswordEncoderBundle) is already using the library.

This is a working implementation of #7247

Commits
-------

c83546d [Security] tweaked previous commit
b2e553a Outsource all the BCrypt heavy lifting to a library
merged branch fabpot/twig-url-escaping (PR #7850)

This PR was merged into the master branch.

Discussion
----------

[2.3] [TwigBridge] save auto-escaping of generated URLs when possible

| Q             | A
| ------------- | ---
| Bug fix?      | [no]
| New feature?  | [yes: optimization]
| BC breaks?    | [no]
| Deprecations? | [no]
| Tests pass?   | [yes]
| Fixed tickets | #7088
| License       | MIT
| Doc PR        | [-]

Determines at compile time whether the generated URL will be safe and thus
saving the unneeded automatic escaping for performance reasons.

The URL generation process percent encodes non-alphanumeric characters. So there is no risk
that malicious/invalid characters are part of the URL. The only character within an URL that
must be escaped in html is the ampersand ("&") which separates query params. So we cannot mark
the URL generation as always safe, but only when we are sure there won't be multiple query
params. This is the case when there are none or only one constant parameter given.
E.g. we know beforehand this will be safe:
- path('route')
- path('route', {'param': 'value'})

But the following may not:
- path('route', var)
- path('route', {'param': ['val1', 'val2'] }) // a sub-array
- path('route', {'param1': 'value1', 'param2': 'value2'})

If param1 and param2 reference placeholder in the route, it would still be safe. But we don't know.

Commits
-------

725568b [TwigBridge] added some unit test for the previous commit
0721ff8 save auto-escaping of generated URLs when possible for performance reasons
Revert "merged branch mvrhov/patch-1 (PR #4975)"

This reverts commit 407246a1da3b71ca548d00a51d1e5798b69feb8f, reversing
changes made to 3841d1c6d73eb9cc222867ac2bc047d6518d942e.
[Security] added more info about the BCrypt change (refs #7853)
[Security] added an exception when the BCrypt encoder cannot be used (refs #7853)
fixed a test on windows
merged branch bamarni/windows-test (PR #7858)

This PR was merged into the master branch.

Discussion
----------

fixed a test on windows

Commits
-------

6f7e35e fixed a test on windows
Truly disabled profiler in prod
[FrameworkBundle] added a way to disable the profiler

Before:

  enabled: true  # the profiler is enabled and data are collected

  enabled: false # the profiler is enabled but data are not collected (data can be collected on demand)

  No way to disable the profiler

After:

  enabled: true  # the profiler is enabled and data are collected
  collect: true

  enabled: true  # the profiler is enabled but data are not collected (data can be collected on demand)
  collect: false

  enabled: false # the profiler is disabled
fixed the registration of the web profiler when the profiler is disabled
merged branch fabpot/profiler-activation (PR #7859)

This PR was merged into the master branch.

Discussion
----------

Profiler activation

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | yes
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #7064, #7071
| License       | MIT
| Doc PR        | symfony/symfony-docs#2565

As stated in #7071, there is no way to disable the profiler completely. Even when the `enabled` flag is set to `false`, the profiler is still registered but the data collectors are not activated.

Now, when `enabled` is `false`, the profiler is disabled. To get the old `false` behavior, you now need to set `enabled` to `true` and set the new `collect` flag to `false`.

Todo:

 - [x] update docs
 - [x] update Symfony SE -- not needed

Commits
-------

88ebd62 fixed the registration of the web profiler when the profiler is disabled
a11f901 [FrameworkBundle] added a way to disable the profiler
f675dd8 Truly disabled profiler in prod