[HttpKernel] hinclude fragment renderer must escape URIs properly to return valid html
fixed HInclude renderer (closes #7113)
[HttpKernel] fixed locale management when exiting sub-requests

This fix is temporary as #7007 will fix it properly in Symfony 2.3.
Merge branch '2.1' into 2.2

* 2.1:
  [HttpKernel] fixed locale management when exiting sub-requests
added a note about a BC break for the path info of sub-request (closes #7138)
merged branch fabpot/hinclude-fix (PR #7116)

This PR was merged into the 2.2 branch.

Commits
-------

3933912 fixed HInclude renderer (closes #7113)

Discussion
----------

fixed HInclude renderer (closes #7113)

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #7113
| License       | MIT
| Doc PR        | n/a

---------------------------------------------------------------------------

by stof at 2013-02-19T08:36:20Z

:+1:
merged branch Tobion/fragment-render-escaping (PR #7090)

This PR was merged into the 2.2 branch.

Commits
-------

54d7d25 [HttpKernel] hinclude fragment renderer must escape URIs properly to return valid html

Discussion
----------

[HttpKernel] hinclude fragment renderer must escape URIs properly to return valid html

| Q             | A
| ------------- | ---
| Bug fix?      | [yes]
| New feature?  | [no]
| BC breaks?    | [no]
| Deprecations? | [no]
| Tests pass?   | [yes]
| Fixed tickets | [-]
| License       | MIT
| Doc PR        | [-]

Since rendering of hinclude fragments returns html/xml, it is marked as safe. So it's not auto-escaped of course. But that means it must properly escape it's input (the URI) when outputting in html context.
Btw, this does not need to be done for esi because esi tags are processed in middleware which do not go to the client/browser.

---------------------------------------------------------------------------

by Koc at 2013-02-15T22:59:05Z

Will it works correct when `arg_separator.output="&amp;"`?

---------------------------------------------------------------------------

by stof at 2013-02-15T23:04:01Z

if your url comes form the routing, yes. It [does not rely on the default separator](https://github.com/symfony/Routing/blob/master/Generator/UrlGenerator.php#L265) to avoid issues when the separator is configured to ``&amp;`` as it would have been escaped again in Twig templates for instance.

---------------------------------------------------------------------------

by fabpot at 2013-02-16T07:26:19Z

Can you include the proper PR header in the description? Thanks.

---------------------------------------------------------------------------

by Tobion at 2013-02-16T12:28:18Z

Added.
Merge branch '2.2'

* 2.2:
  Defined stable version point of Doctrine.
  [HttpFoundation] Remove Cache-Control when using https download via IE<9 (fixes #6750)
  Update composer.json
  [Form] Fixed TimeType not to render a "size" attribute in select tags
  [Form] Added test for "label" option to accept the value "0"
  Expanded fault-tolerance for unusual cookie dates
  Fix docblock type
  [Form] Fixed "label" option to accept the value "0"
  Added greek translation
  merged branch jfcixmedia/2.1 (PR #5838)
  added a note about a BC break for the path info of sub-request (closes #7138)
  [DomCrawler] lowered parsed protocol string (fixes #6986)
  [FrameworkBundle] Fix a BC for Hinclude global template
  [HttpKernel] fixed locale management when exiting sub-requests
  fixed HInclude renderer (closes #7113)
  Removed some leaking deprecation warning in the Form component
  [HttpKernel] hinclude fragment renderer must escape URIs properly to return valid html

Conflicts:
	src/Symfony/Bundle/FrameworkBundle/composer.json
	src/Symfony/Component/Security/composer.json