[HttpKernel] made the cache key generation configurable for the default HttpCache store
feature#9151 [HttpKernel] made the cache key generation configurable for the default HttpCache store (fabpot)

This PR was merged into the master branch.

Discussion
----------

[HttpKernel] made the cache key generation configurable for the default HttpCache store

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #9088
| License       | MIT
| Doc PR        | n/a

Commits
-------

780b77a [HttpKernel] made the cache key generation configurable for the default HttpCache store
feature#9150 [Filesystem] introduced new Exception base classes (fabpot)

This PR was merged into the master branch.

Discussion
----------

[Filesystem] introduced new Exception base classes

The Filesystem class now throws a ```FileNotFoundException``` if a file could not be found, rather than an basic ```IOException```. The new exception is still a child of the ```IOException```, this way it doesn' t breack BC.
The ```IOException``` now also takes as the first argument an path to the file of interest, which can be used via the ```getPath()``` method.

The switch to the FilesystemInterface will allow you to have an implementation accessing S3 or Dropbox, etc. and still inject it into a classes, which are requiring the Filesystem.

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | ~
| Doc PR        | symfony/symfony-docs#2947

Commits
-------

c2e43d0 [Filesystem] removed getPath() on Exceptions and cleaned up CS and error messages
785080a [Filesystem] introduced new Exception base classes
[HttpKernel] added missing argument to listener call
bug#9166 [HttpKernel] added missing argument to listener call (fabpot)

This PR was merged into the master branch.

Discussion
----------

[HttpKernel] added missing argument to listener call

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | na
| License       | MIT
| Doc PR        | n/a

When calling a listener, the dispatcher now must pass the event name and the dispatcher (see 7852), but the traceable event dispatcher did not do that.

Commits
-------

e26ae45 [HttpKernel] added missing argument to listener call
fixed a typo
Merge branch '2.3'

* 2.3:
  fixed Client when using the terminable event
  Fix problem with Windows file links (backslash in JavaScript string)
  [Security] fixed wrong phpdoc
  [DependencyInjection] Prevented inlining of lazy loaded private service definitions.
  [Routing] removed extra argument
  [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted).
  Added doc comments

Conflicts:
	src/Symfony/Component/Routing/Router.php
	src/Symfony/Component/Security/Http/Firewall.php
fixed wrong merge
[HttpKernel] decoupled TraceableEventDispatcher and Profiler
[HttpKernel] added LateDataCollectorInterface
[Form] Rewrite boolean attributes to match HTML spec

'The presence of a boolean attribute on an element represents the true value, and the absence of the attribute represents the false value.'

- http://www.w3.org/html/wg/drafts/html/master/infrastructure.html#boolean-attribute
[Form] Improved test coverage of widget_attributes and widget_container_attributes blocks
Updated Composer dependencies to require the Security\Csrf component where necessary
[Security] Added missing PHPDoc tag
feature#9171 [Form] Rewrite boolean attributes to match HTML spec (bschussek)

This PR was merged into the master branch.

Discussion
----------

[Form] Rewrite boolean attributes to match HTML spec

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Same as #7856

> 'The presence of a boolean attribute on an element represents the true value, and the absence of the attribute represents the false value.' - http://www.w3.org/html/wg/drafts/html/master/infrastructure.html#boolean-attribute

This commit modifies widget_container_attributes and widget_attributes so that:

* `true` values render as the attribute name with the attribute name repeated as the value
* `false` values are not rendered

The comparison is strict using sames() in twig.

Previously `false` values would have been rendered as `some-attribute=""` which according to the spec would actually make them a boolean attribute and therefore equal to true.

Commits
-------

b85577b [Form] Improved test coverage of widget_attributes and widget_container_attributes blocks
8e4c2a7 [Form] Rewrite boolean attributes to match HTML spec
feature#6554 [Security] Added Security\Csrf sub-component with better token generation (bschussek)

This PR was merged into the master branch.

Discussion
----------

[Security] Added Security\Csrf sub-component with better token generation

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | TODO

**Update September 27, 2013**

This PR simplifies the CSRF mechanism to generate completely random tokens. A random token is generated once per ~~intention~~ token ID and then stored in the session. Tokens are valid until the session expires.

Since the CSRF token generator depends on `StringUtils` and `SecureRandom` from Security\Core, and since Security\Http currently depends on the Form component for token generation, I decided to add a new Security\Csrf sub-component that contains the improved CSRF token generator. Consequences:

* Security\Http now depends on Security\Csrf instead of Form
* Form now optionally depends on Security\Csrf
* The configuration for the "security.secure_random" service and the "security.csrf.*" services was moved to FrameworkBundle to guarantee BC

In the new Security\Csrf sub-component, I tried to improve the naming where I could do so without breaking BC:

* CSRF "providers" are now called "token generators"
* CSRF "intentions" are now called "token IDs", because that's really what they are

##### TODO

- [ ] The documentation needs to be checked for references to the configuration of the application secret. Remarks that the secret is used for CSRF protection need to be removed.
- [ ] Add aliases "csrf_token_generator" and "csrf_token_id" for "csrf_provider" and "intention" in the SecurityBundle configuration
- [x] Make sure `SecureRandom` never blocks for `CsrfTokenGenerator`

Commits
-------

7f02304 [Security] Added missing PHPDoc tag
2e04e32 Updated Composer dependencies to require the Security\Csrf component where necessary
bf85e83 [FrameworkBundle][SecurityBundle] Added service configuration for the new Security CSRF sub-component
2048cf6 [Form] Deprecated the CSRF implementation and added an optional dependency to the Security CSRF sub-component instead
85d4959 [Security] Changed Security HTTP sub-component to depend on CSRF sub-component instead of Form
1bf1640 [Security] Added CSRF sub-component
feature#9170 Decoupled TraceableEventDispatcher from the Profiler (fabpot)

This PR was merged into the master branch.

Discussion
----------

Decoupled TraceableEventDispatcher from the Profiler

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

This PR removes the Profiler dependency on the TraceableEventDispatcher. That makes things more decoupled and cleaner. This PR also cleans up how profiles are stored; a Profile is now always stored only once.

I've created a `LateDataCollectorInterface` that is implemented for data collector that needs to get information from data that are available very late in the request process (when the request and the response are not even available anymore). The `lateCollect()` method is called just before the profile is stored.

We have 3 data collectors that implement that interface:

 * Time: As the traceable event dipsatcher gets inject timing information via the stopwatch about all events (including the `terminate` one), we need to get events from the stopwatch as late as possible.
 * Event: The traceable event dispatcher gathers all called listeners to determine non-called ones. To be able to accurately do that for all events (including the `terminate` one), we need to get the data as late as possible.
 * Memory: We want to get the memory as late as possible to get the most accurate number as possible

I'm not very happy with the name and as always, better suggestions would be much appreciated.

This is an extract from #9168

Commits
-------

5cedea2 [HttpKernel] added LateDataCollectorInterface
9c4bc9a [HttpKernel] decoupled TraceableEventDispatcher and Profiler
fixed typos
[FrameworkBundle] made sure that the debug event dispatcher is used everywhere
fixed some unit tests