All notable changes to this project will be documented in this file, in reverse chronological order by release.
SapiStreamEmitter
causing the response body to be cast
to (string)
and also be read as a readable stream, potentially producing
double output.SapiStreamEmitter
consuming too much memory when producing output
for readable bodies.SapiStreamEmitter
's handling of the Content-Range
header to properly only
emit a range of bytes if the header value is in the form bytes {first-last}/length
.
This allows using other range units, such as items
, without incorrectly
emitting truncated content.Zend\Diactoros\Response
, including:
Zend\Diactoros\Uri
.REDIRECT_HTTP_*
header detection in the ServerRequestFactory
.SapiStreamEmitter
.SapiStreamEmitter
to implement a check for isSeekable()
prior to attempts
to rewind; this allows it to work with non-seekable streams such as the
CallbackStream
.\r\n\r\n
sequence following the
headers, even when no message body is present, to ensure it conforms with RFC
7230.Request
class to set the Host
header from the URI host if no header is
already present. (Ensures conformity with PSR-7 specification.)Uri
class to ensure that string serialization does not include a colon after
the host name if no port is present in the instance.ServerRequestFactory
to work correctly with HTTP/2.Response
class.null
values when calling withoutAttribute()
.ServerRequestFactory
to marshal the request path fragment, if present.HeaderSecurity
to include the header name and/or
value.ServerRequestFactory::marshalHeaders()
to no longer omit
Cookie
headers from the aggregated headers. While the values are parsed and
injected into the cookie params, it's useful to have access to the raw headers
as well.ServerRequest
constructor:
array $cookies
array $queryParams
null|array|object $parsedBody
string $protocolVersion
ServerRequestFactory
was updated to pass values for each of these parameters
when creating an instance, instead of using the related with*()
methods on
an instance.ServerRequestFactory
to retrieve the HTTP protocol version and inject it in
the generated ServerRequest
, which previously was not performed.TextResponse
, HtmlResponse
,
and JsonResponse
); due to the fact that the constructor was not
rewinding the message body stream, getContents()
was thus returning null
,
as the pointer was at the end of the stream. The constructor now rewinds the
stream after populating it in the constructor.Zend\Diactoros\Response\SapiEmitterTrait
, which provides the following
private method definitions:
injectContentLength()
emitStatusLine()
emitHeaders()
flush()
filterHeader()
The SapiEmitter
implementation has been updated to remove those methods and
instead compose the trait.SapiStreamEmitter
; this emitter type will
loop through the stream instead of emitting it in one go, and supports content
ranges.withHeader()
implementation to ensure that if the header existed previously
but using a different casing strategy, the previous version will be removed
in the cloned instance.Response
to ensure that null status codes are not possible.SapiEmitter
to emit a Content-Length
header with the content length as
reported by the response body stream, assuming that
StreamInterface::getSize()
returns an integer.Zend\Diactoros\Response\TextResponse
, for returning plain
text responses. By default, it sets the content type to text/plain;
charset=utf-8
; per the other response types, the signature is new
TextResponse($text, $status = 200, array $headers = [])
.Zend\Diactoros\CallbackStream
, allowing you to back a stream with a PHP
callable (such as a generator) to generate the message content. Its
constructor accepts the callable: $stream = new CallbackStream($callable);
HtmlResponse
to set the charset to utf-8 by default (if no content type
header is provided at instantiation).JSON_UNESCAPED_SLASHES
to the default json_encode
flags used by
Zend\Diactoros\Response\JsonResponse
.withPort()
to allow null
port values (indicating usage of default for
the given scheme).withUri()
to do a case-insensitive check for an existing Host
header, replacing it with the new one.JsonResponse
constructor to typehint the $data
argument
as mixed
.Request
such that if it marshals a stream during instantiation,
the stream is marked as writeable (specifically, mode wb+
).Zend\Diactoros\Uri
's various with*()
methods that are
documented as accepting strings to raise exceptions on non-string input.
Previously, several simply passed non-string input on verbatim, others
normalized the input, and a few correctly raised the exceptions. Behavior is
now consistent across each.UploadedFile
to ensure that moveTo()
works correctly in non-SAPI
environments when the file provided to the constructor is a path.Stream
class only accepts stream
resources, not any resource.JsonResponse
with regards to serialization of null
and scalar
values; the new behavior is to serialize them verbatim, without any casting.#52, #58, #59, and #61 create several custom response types for simplifying response creation:
Zend\Diactoros\Response\HtmlResponse
accepts HTML content via its
constructor, and sets the Content-Type
to text/html
.Zend\Diactoros\Response\JsonResponse
accepts data to serialize to JSON via
its constructor, and sets the Content-Type
to application/json
.Zend\Diactoros\Response\EmptyResponse
allows creating empty, read-only
responses, with a default status code of 204.Zend\Diactoros\Response\RedirectResponse
allows specifying a URI for the
Location
header in the constructor, with a default status code of 302.Each also accepts an optional status code, and optional headers (which can
also be used to provide an alternate Content-Type
in the case of the HTML
and JSON responses).
ServerRequestFactory::marshalUri()
and ServerRequestFactory::marshalHostAndPort()
,
which were deprecated prior to the 1.0 release.UploadedFile
when the $errorStatus
provided at
instantiation is not UPLOAD_ERR_OK
. Prior to the fix, an
InvalidArgumentException
would occur at instantiation due to the fact that
the upload file was missing or invalid. With the fix, no exception is raised
until a call to moveTo()
or getStream()
is made.This is a security release.
A patch has been applied to Zend\Diactoros\Uri::filterPath()
that ensures that
paths can only begin with a single leading slash. This prevents the following
potential security issues:
//example.com/foo
. With the patch,
the leading double slash is reduced to a single slash, preventing the XSS
vector.Location
or Link
headers,
without a scheme and authority, potential for open redirects exist if clients
do not prepend the scheme and authority. Again, preventing a double slash
corrects the vector.If you are using Zend\Diactoros\Uri
for creating links, form targets, or
redirect paths, and only using the path segment, we recommend upgrading
immediately.
MessageTrait::getHeaderLine()
to return an empty string instead of null
if
the header is undefined (which is the behavior specified in PSR-7).ServerRequestFactory
marshals upload files when they are
represented as a nested associative array.MessageInterface::getHeaderLine()
MUST return a string (that string CAN be
empty). Previously, Diactoros would return null
.Host
header is set, the $preserveHost
flag MUST be ignored when
calling withUri()
(previously, Diactoros would not set the Host
header
if $preserveHost
was true
, but no Host
header was present).null
.UriInterface
instance from getUri()
; that
instance CAN be empty. Previously, Diactoros would return null
; now it
lazy-instantiates an empty Uri
instance on initialization.Uri::filterPath()
to prevent emitting a path prepended
with multiple slashes.Zend\Diactoros\RequestTrait
to
ensure properties inherited from the MessageTrait
are inherited by
implementations.#41 fixes the
namespace for test files to begin with ZendTest
instead of Zend
.
#46 ensures that
the cookie and query params for the ServerRequest
implementation are
initialized as arrays.
#47 modifies the
internal logic in HeaderSecurity::isValid()
to use a regular expression
instead of character-by-character comparisons, improving performance.
Zend\Diactoros\RelativeStream
, which will return stream contents relative to
a given offset (i.e., a subset of the stream). AbstractSerializer
was
updated to create a RelativeStream
when creating the body of a message,
which will prevent duplication of the stream in-memory..gitattributes
file that excludes directories and files not needed for
production; this will further minify the package for production use cases.Zend\Diactoros\Request
to use a php://temp
stream by default instead of
php://memory
, to ensure requests do not create an out-of-memory condition.Zend\Diactoros\Stream
to ensure that write operations trigger an exception
if the stream is not writeable. Additionally, it adds more robust logic for
determining if a stream is writeable.First stable release, and first release as zend-diactoros
.