ALPHA 3.0.2

vendor/symfony/http-kernel/CHANGELOG.md

@@ -5,7 +5,7 @@ CHANGELOG
 -----
 
  * added orphaned events support to `EventDataCollector`
- * `ExceptionListener` now logs and collects exceptions at priority `2048` (previously logged at `-128` and collected at `0`)
+ * `ExceptionListener` now logs exceptions at priority `0` (previously logged at `-128`)
  * Deprecated `service:action` syntax with a single colon to reference controllers. Use `service::method` instead.
  * Added the ability to profile individual argument value resolvers via the
    `Symfony\Component\HttpKernel\Controller\ArgumentResolver\TraceableValueResolver`

vendor/symfony/http-kernel/Controller/ArgumentResolver/ServiceValueResolver.php

@@ -68,7 +68,7 @@ final class ServiceValueResolver implements ArgumentValueResolverInterface
             yield $this->container->get($controller)->get($argument->getName());
         } catch (RuntimeException $e) {
             $what = sprintf('argument $%s of "%s()"', $argument->getName(), $controller);
-            $message = preg_replace('/service "service_locator\.[^"]++"/', $what, $e->getMessage());
+            $message = preg_replace('/service "\.service_locator\.[^"]++"/', $what, $e->getMessage());
 
             if ($e->getMessage() === $message) {
                 $message = sprintf('Cannot resolve %s: %s', $what, $message);

vendor/symfony/http-kernel/DataCollector/DumpDataCollector.php

@@ -21,7 +21,7 @@ use Symfony\Component\VarDumper\Dumper\CliDumper;
 use Symfony\Component\VarDumper\Dumper\ContextProvider\SourceContextProvider;
 use Symfony\Component\VarDumper\Dumper\HtmlDumper;
 use Symfony\Component\VarDumper\Dumper\DataDumperInterface;
-use Symfony\Component\VarDumper\Dumper\ServerDumper;
+use Symfony\Component\VarDumper\Server\Connection;
 
 /**
  * @author Nicolas Grekas <p@tchwork.com>
@@ -38,17 +38,18 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
     private $charset;
     private $requestStack;
     private $dumper;
-    private $dumperIsInjected;
     private $sourceContextProvider;
 
-    public function __construct(Stopwatch $stopwatch = null, $fileLinkFormat = null, string $charset = null, RequestStack $requestStack = null, DataDumperInterface $dumper = null)
+    /**
+     * @param DataDumperInterface|Connection|null $dumper
+     */
+    public function __construct(Stopwatch $stopwatch = null, $fileLinkFormat = null, string $charset = null, RequestStack $requestStack = null, $dumper = null)
     {
         $this->stopwatch = $stopwatch;
         $this->fileLinkFormat = $fileLinkFormat ?: ini_get('xdebug.file_link_format') ?: get_cfg_var('xdebug.file_link_format');
         $this->charset = $charset ?: ini_get('php.output_encoding') ?: ini_get('default_charset') ?: 'UTF-8';
         $this->requestStack = $requestStack;
         $this->dumper = $dumper;
-        $this->dumperIsInjected = null !== $dumper;
 
         // All clones share these properties by reference:
         $this->rootRefs = array(
@@ -58,7 +59,7 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
             &$this->clonesCount,
         );
 
-        $this->sourceContextProvider = $dumper instanceof ServerDumper && isset($dumper->getContextProviders()['source']) ? $dumper->getContextProviders()['source'] : new SourceContextProvider($this->charset);
+        $this->sourceContextProvider = $dumper instanceof Connection && isset($dumper->getContextProviders()['source']) ? $dumper->getContextProviders()['source'] : new SourceContextProvider($this->charset);
     }
 
     public function __clone()
@@ -71,14 +72,17 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
         if ($this->stopwatch) {
             $this->stopwatch->start('dump');
         }
-        if ($this->isCollected && !$this->dumper) {
-            $this->isCollected = false;
-        }
 
         list('name' => $name, 'file' => $file, 'line' => $line, 'file_excerpt' => $fileExcerpt) = $this->sourceContextProvider->getContext();
 
-        if ($this->dumper) {
+        if ($this->dumper instanceof Connection) {
+            if (!$this->dumper->write($data)) {
+                $this->isCollected = false;
+            }
+        } elseif ($this->dumper) {
             $this->doDump($this->dumper, $data, $name, $file, $line);
+        } else {
+            $this->isCollected = false;
         }
 
         $this->data[] = compact('data', 'name', 'file', 'line', 'fileExcerpt');
@@ -124,7 +128,7 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
         }
         $this->data = array();
         $this->dataCount = 0;
-        $this->isCollected = false;
+        $this->isCollected = true;
         $this->clonesCount = 0;
         $this->clonesIndex = 0;
     }
@@ -141,9 +145,6 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
         $this->data = array();
         $this->dataCount = 0;
         $this->isCollected = true;
-        if (!$this->dumperIsInjected) {
-            $this->dumper = null;
-        }
 
         return $ser;
     }
@@ -245,7 +246,7 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
             };
             $contextDumper = $contextDumper->bindTo($dumper, $dumper);
             $contextDumper($name, $file, $line, $this->fileLinkFormat);
-        } elseif (!$dumper instanceof ServerDumper) {
+        } else {
             $cloner = new VarCloner();
             $dumper->dump($cloner->cloneVar($name.' on line '.$line.':'));
         }

vendor/symfony/http-kernel/EventListener/AbstractSessionListener.php

@@ -15,6 +15,7 @@ use Psr\Container\ContainerInterface;
 use Symfony\Component\HttpFoundation\Session\Session;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
+use Symfony\Component\HttpKernel\Event\FinishRequestEvent;
 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -37,6 +38,7 @@ abstract class AbstractSessionListener implements EventSubscriberInterface
     const NO_AUTO_CACHE_CONTROL_HEADER = 'Symfony-Session-NoAutoCacheControl';
 
     protected $container;
+    private $sessionUsageStack = array();
 
     public function __construct(ContainerInterface $container = null)
     {
@@ -49,6 +51,7 @@ abstract class AbstractSessionListener implements EventSubscriberInterface
             return;
         }
 
+        $session = null;
         $request = $event->getRequest();
         if ($request->hasSession()) {
             // no-op
@@ -57,6 +60,9 @@ abstract class AbstractSessionListener implements EventSubscriberInterface
         } elseif ($session = $this->getSession()) {
             $request->setSession($session);
         }
+
+        $session = $session ?? ($this->container && $this->container->has('initialized_session') ? $this->container->get('initialized_session') : null);
+        $this->sessionUsageStack[] = $session instanceof Session ? $session->getUsageIndex() : null;
     }
 
     public function onKernelResponse(FilterResponseEvent $event)
@@ -71,7 +77,7 @@ abstract class AbstractSessionListener implements EventSubscriberInterface
 
         $response = $event->getResponse();
 
-        if ($session->isStarted() || ($session instanceof Session && $session->hasBeenStarted())) {
+        if ($session instanceof Session ? $session->getUsageIndex() !== end($this->sessionUsageStack) : $session->isStarted()) {
             if (!$response->headers->has(self::NO_AUTO_CACHE_CONTROL_HEADER)) {
                 $response
                     ->setPrivate()
@@ -113,12 +119,23 @@ abstract class AbstractSessionListener implements EventSubscriberInterface
         }
     }
 
+    /**
+     * @internal
+     */
+    public function onFinishRequest(FinishRequestEvent $event)
+    {
+        if ($event->isMasterRequest()) {
+            array_pop($this->sessionUsageStack);
+        }
+    }
+
     public static function getSubscribedEvents()
     {
         return array(
             KernelEvents::REQUEST => array('onKernelRequest', 128),
             // low priority to come after regular response listeners, but higher than StreamedResponseListener
             KernelEvents::RESPONSE => array('onKernelResponse', -1000),
+            KernelEvents::FINISH_REQUEST => array('onFinishRequest'),
         );
     }
 

vendor/symfony/http-kernel/EventListener/DumpListener.php

@@ -15,6 +15,7 @@ use Symfony\Component\Console\ConsoleEvents;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\VarDumper\Cloner\ClonerInterface;
 use Symfony\Component\VarDumper\Dumper\DataDumperInterface;
+use Symfony\Component\VarDumper\Server\Connection;
 use Symfony\Component\VarDumper\VarDumper;
 
 /**
@@ -26,20 +27,27 @@ class DumpListener implements EventSubscriberInterface
 {
     private $cloner;
     private $dumper;
+    private $connection;
 
-    public function __construct(ClonerInterface $cloner, DataDumperInterface $dumper)
+    public function __construct(ClonerInterface $cloner, DataDumperInterface $dumper, Connection $connection = null)
     {
         $this->cloner = $cloner;
         $this->dumper = $dumper;
+        $this->connection = $connection;
     }
 
     public function configure()
     {
         $cloner = $this->cloner;
         $dumper = $this->dumper;
+        $connection = $this->connection;
 
-        VarDumper::setHandler(function ($var) use ($cloner, $dumper) {
-            $dumper->dump($cloner->cloneVar($var));
+        VarDumper::setHandler(static function ($var) use ($cloner, $dumper, $connection) {
+            $data = $cloner->cloneVar($var);
+
+            if (!$connection || !$connection->write($data)) {
+                $dumper->dump($data);
+            }
         });
     }
 

vendor/symfony/http-kernel/EventListener/ExceptionListener.php

@@ -12,11 +12,9 @@
 namespace Symfony\Component\HttpKernel\EventListener;
 
 use Psr\Log\LoggerInterface;
-use Symfony\Component\Debug\ExceptionHandler;
 use Symfony\Component\Debug\Exception\FlattenException;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
 use Symfony\Component\HttpKernel\Log\DebugLoggerInterface;
 use Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent;
@@ -35,20 +33,17 @@ class ExceptionListener implements EventSubscriberInterface
     protected $controller;
     protected $logger;
     protected $debug;
-    private $charset;
 
-    public function __construct($controller, LoggerInterface $logger = null, $debug = false, $charset = null)
+    public function __construct($controller, LoggerInterface $logger = null, $debug = false)
     {
         $this->controller = $controller;
         $this->logger = $logger;
         $this->debug = $debug;
-        $this->charset = $charset;
     }
 
     public function logKernelException(GetResponseForExceptionEvent $event)
     {
         $exception = $event->getException();
-        $request = $event->getRequest();
 
         $this->logException($exception, sprintf('Uncaught PHP Exception %s: "%s" at %s line %s', get_class($exception), $exception->getMessage(), $exception->getFile(), $exception->getLine()));
     }
@@ -72,7 +67,7 @@ class ExceptionListener implements EventSubscriberInterface
                 }
             }
 
-            $prev = new \ReflectionProperty('Exception', 'previous');
+            $prev = new \ReflectionProperty($wrapper instanceof \Exception ? \Exception::class : \Error::class, 'previous');
             $prev->setAccessible(true);
             $prev->setValue($wrapper, $exception);
 
@@ -94,7 +89,7 @@ class ExceptionListener implements EventSubscriberInterface
     {
         return array(
             KernelEvents::EXCEPTION => array(
-                array('logKernelException', 2048),
+                array('logKernelException', 0),
                 array('onKernelException', -128),
             ),
         );
@@ -128,12 +123,8 @@ class ExceptionListener implements EventSubscriberInterface
     protected function duplicateRequest(\Exception $exception, Request $request)
     {
         $attributes = array(
-            'exception' => $exception = FlattenException::create($exception),
-            '_controller' => $this->controller ?: function () use ($exception) {
-                $handler = new ExceptionHandler($this->debug, $this->charset);
-
-                return new Response($handler->getHtml($exception), $exception->getStatusCode(), $exception->getHeaders());
-            },
+            '_controller' => $this->controller,
+            'exception' => FlattenException::create($exception),
             'logger' => $this->logger instanceof DebugLoggerInterface ? $this->logger : null,
         );
         $request = $request->duplicate(null, null, $attributes);

vendor/symfony/http-kernel/EventListener/ProfilerListener.php

@@ -121,7 +121,7 @@ class ProfilerListener implements EventSubscriberInterface
     {
         return array(
             KernelEvents::RESPONSE => array('onKernelResponse', -100),
-            KernelEvents::EXCEPTION => array('onKernelException', 2048),
+            KernelEvents::EXCEPTION => array('onKernelException', 0),
             KernelEvents::TERMINATE => array('onKernelTerminate', -1024),
         );
     }

vendor/symfony/http-kernel/Fragment/InlineFragmentRenderer.php

@@ -115,7 +115,9 @@ class InlineFragmentRenderer extends RoutableFragmentRenderer
             $server['HTTP_X_FORWARDED_FOR'] = ($currentXForwardedFor ? $currentXForwardedFor.', ' : '').$request->getClientIp();
         }
 
-        $server['REMOTE_ADDR'] = '127.0.0.1';
+        $trustedProxies = Request::getTrustedProxies();
+        $server['REMOTE_ADDR'] = $trustedProxies ? reset($trustedProxies) : '127.0.0.1';
+
         unset($server['HTTP_IF_MODIFIED_SINCE']);
         unset($server['HTTP_IF_NONE_MATCH']);
 

vendor/symfony/http-kernel/HttpCache/HttpCache.php

@@ -165,7 +165,11 @@ class HttpCache implements HttpKernelInterface, TerminableInterface
         // FIXME: catch exceptions and implement a 500 error page here? -> in Varnish, there is a built-in error page mechanism
         if (HttpKernelInterface::MASTER_REQUEST === $type) {
             $this->traces = array();
-            $this->request = $request;
+            // Keep a clone of the original request for surrogates so they can access it.
+            // We must clone here to get a separate instance because the application will modify the request during
+            // the application flow (we know it always does because we do ourselves by setting REMOTE_ADDR to 127.0.0.1
+            // and adding the X-Forwarded-For header, see HttpCache::forward()).
+            $this->request = clone $request;
             if (null !== $this->surrogate) {
                 $this->surrogateCacheStrategy = $this->surrogate->createCacheStrategy();
             }

vendor/symfony/http-kernel/Kernel.php

@@ -63,11 +63,11 @@ abstract class Kernel implements KernelInterface, RebootableInterface, Terminabl
     private $requestStackSize = 0;
     private $resetServices = false;
 
-    const VERSION = '4.1.0';
-    const VERSION_ID = 40100;
+    const VERSION = '4.1.1';
+    const VERSION_ID = 40101;
     const MAJOR_VERSION = 4;
     const MINOR_VERSION = 1;
-    const RELEASE_VERSION = 0;
+    const RELEASE_VERSION = 1;
     const EXTRA_VERSION = '';
 
     const END_OF_MAINTENANCE = '01/2019';

vendor/symfony/http-kernel/Tests/Controller/ArgumentResolver/ServiceValueResolverTest.php

@@ -12,10 +12,12 @@
 namespace Symfony\Component\HttpKernel\Tests\Controller\ArgumentResolver;
 
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
 use Symfony\Component\DependencyInjection\ServiceLocator;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Controller\ArgumentResolver\ServiceValueResolver;
 use Symfony\Component\HttpKernel\ControllerMetadata\ArgumentMetadata;
+use Symfony\Component\HttpKernel\DependencyInjection\RegisterControllerArgumentLocatorsPass;
 
 class ServiceValueResolverTest extends TestCase
 {
@@ -85,6 +87,25 @@ class ServiceValueResolverTest extends TestCase
         $this->assertYieldEquals(array(new DummyService()), $resolver->resolve($request, $argument));
     }
 
+    /**
+     * @expectedException \Symfony\Component\DependencyInjection\Exception\RuntimeException
+     * @expectedExceptionMessage Cannot autowire argument $dummy of "Symfony\Component\HttpKernel\Tests\Controller\ArgumentResolver\DummyController::index()": it references class "Symfony\Component\HttpKernel\Tests\Controller\ArgumentResolver\DummyService" but no such service exists.
+     */
+    public function testErrorIsTruncated()
+    {
+        $container = new ContainerBuilder();
+        $container->addCompilerPass(new RegisterControllerArgumentLocatorsPass());
+
+        $container->register('argument_resolver.service', ServiceValueResolver::class)->addArgument(null)->setPublic(true);
+        $container->register(DummyController::class)->addTag('controller.service_arguments')->setPublic(true);
+
+        $container->compile();
+
+        $request = $this->requestWithAttributes(array('_controller' => array(DummyController::class, 'index')));
+        $argument = new ArgumentMetadata('dummy', DummyService::class, false, false, null);
+        $container->get('argument_resolver.service')->resolve($request, $argument)->current();
+    }
+
     private function requestWithAttributes(array $attributes)
     {
         $request = Request::create('/');
@@ -110,3 +131,10 @@ class ServiceValueResolverTest extends TestCase
 class DummyService
 {
 }
+
+class DummyController
+{
+    public function index(DummyService $dummy)
+    {
+    }
+}

vendor/symfony/http-kernel/Tests/DataCollector/DumpDataCollectorTest.php

@@ -17,7 +17,7 @@ use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\DataCollector\DumpDataCollector;
 use Symfony\Component\VarDumper\Cloner\Data;
 use Symfony\Component\VarDumper\Dumper\CliDumper;
-use Symfony\Component\VarDumper\Dumper\ServerDumper;
+use Symfony\Component\VarDumper\Server\Connection;
 
 /**
  * @author Nicolas Grekas <p@tchwork.com>
@@ -57,13 +57,13 @@ class DumpDataCollectorTest extends TestCase
         $this->assertSame('a:2:{i:0;b:0;i:1;s:5:"UTF-8";}', $collector->serialize());
     }
 
-    public function testDumpWithServerDumper()
+    public function testDumpWithServerConnection()
     {
         $data = new Data(array(array(123)));
 
         // Server is up, server dumper is used
-        $serverDumper = $this->getMockBuilder(ServerDumper::class)->disableOriginalConstructor()->getMock();
-        $serverDumper->expects($this->once())->method('dump');
+        $serverDumper = $this->getMockBuilder(Connection::class)->disableOriginalConstructor()->getMock();
+        $serverDumper->expects($this->once())->method('write')->willReturn(true);
 
         $collector = new DumpDataCollector(null, null, null, null, $serverDumper);
         $collector->dump($data);

vendor/symfony/http-kernel/Tests/EventListener/ExceptionListenerTest.php

@@ -155,23 +155,6 @@ class ExceptionListenerTest extends TestCase
         $this->assertFalse($response->headers->has('content-security-policy'), 'CSP header has been removed');
         $this->assertFalse($dispatcher->hasListeners(KernelEvents::RESPONSE), 'CSP removal listener has been removed');
     }
-
-    public function testNullController()
-    {
-        $listener = new ExceptionListener(null);
-        $kernel = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock();
-        $kernel->expects($this->once())->method('handle')->will($this->returnCallback(function (Request $request) {
-            $controller = $request->attributes->get('_controller');
-
-            return $controller();
-        }));
-        $request = Request::create('/');
-        $event = new GetResponseForExceptionEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST, new \Exception('foo'));
-
-        $listener->onKernelException($event);
-
-        $this->assertContains('Whoops, looks like something went wrong.', $event->getResponse()->getContent());
-    }
 }
 
 class TestLogger extends Logger implements DebugLoggerInterface

vendor/symfony/http-kernel/Tests/EventListener/SessionListenerTest.php

@@ -19,6 +19,7 @@ use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Session\Session;
 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
+use Symfony\Component\HttpKernel\Event\FinishRequestEvent;
 use Symfony\Component\HttpKernel\EventListener\AbstractSessionListener;
 use Symfony\Component\HttpKernel\EventListener\SessionListener;
 use Symfony\Component\HttpKernel\HttpKernelInterface;
@@ -59,8 +60,7 @@ class SessionListenerTest extends TestCase
     public function testResponseIsPrivateIfSessionStarted()
     {
         $session = $this->getMockBuilder(Session::class)->disableOriginalConstructor()->getMock();
-        $session->expects($this->exactly(2))->method('isStarted')->willReturn(false);
-        $session->expects($this->once())->method('hasBeenStarted')->willReturn(true);
+        $session->expects($this->exactly(2))->method('getUsageIndex')->will($this->onConsecutiveCalls(0, 1));
 
         $container = new Container();
         $container->set('initialized_session', $session);
@@ -68,6 +68,9 @@ class SessionListenerTest extends TestCase
         $listener = new SessionListener($container);
         $kernel = $this->getMockBuilder(HttpKernelInterface::class)->disableOriginalConstructor()->getMock();
 
+        $request = new Request();
+        $listener->onKernelRequest(new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST));
+
         $response = new Response();
         $listener->onKernelResponse(new FilterResponseEvent($kernel, new Request(), HttpKernelInterface::MASTER_REQUEST, $response));
 
@@ -80,8 +83,7 @@ class SessionListenerTest extends TestCase
     public function testResponseIsStillPublicIfSessionStartedAndHeaderPresent()
     {
         $session = $this->getMockBuilder(Session::class)->disableOriginalConstructor()->getMock();
-        $session->expects($this->exactly(2))->method('isStarted')->willReturn(false);
-        $session->expects($this->once())->method('hasBeenStarted')->willReturn(true);
+        $session->expects($this->exactly(2))->method('getUsageIndex')->will($this->onConsecutiveCalls(0, 1));
 
         $container = new Container();
         $container->set('initialized_session', $session);
@@ -89,6 +91,9 @@ class SessionListenerTest extends TestCase
         $listener = new SessionListener($container);
         $kernel = $this->getMockBuilder(HttpKernelInterface::class)->disableOriginalConstructor()->getMock();
 
+        $request = new Request();
+        $listener->onKernelRequest(new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST));
+
         $response = new Response();
         $response->setSharedMaxAge(60);
         $response->headers->set(AbstractSessionListener::NO_AUTO_CACHE_CONTROL_HEADER, 'true');
@@ -113,4 +118,39 @@ class SessionListenerTest extends TestCase
         $listener = new SessionListener($container);
         $listener->onKernelResponse($event);
     }
+
+    public function testSurrogateMasterRequestIsPublic()
+    {
+        $session = $this->getMockBuilder(Session::class)->disableOriginalConstructor()->getMock();
+        $session->expects($this->exactly(4))->method('getUsageIndex')->will($this->onConsecutiveCalls(0, 1, 1, 1));
+
+        $container = new Container();
+        $container->set('initialized_session', $session);
+        $container->set('session', $session);
+
+        $listener = new SessionListener($container);
+        $kernel = $this->getMockBuilder(HttpKernelInterface::class)->disableOriginalConstructor()->getMock();
+
+        $request = new Request();
+        $response = new Response();
+        $response->setCache(array('public' => true, 'max_age' => '30'));
+        $listener->onKernelRequest(new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST));
+        $this->assertTrue($request->hasSession());
+
+        $subRequest = clone $request;
+        $this->assertSame($request->getSession(), $subRequest->getSession());
+        $listener->onKernelRequest(new GetResponseEvent($kernel, $subRequest, HttpKernelInterface::MASTER_REQUEST));
+        $listener->onKernelResponse(new FilterResponseEvent($kernel, $subRequest, HttpKernelInterface::MASTER_REQUEST, $response));
+        $listener->onFinishRequest(new FinishRequestEvent($kernel, $subRequest, HttpKernelInterface::MASTER_REQUEST));
+
+        $this->assertFalse($response->headers->hasCacheControlDirective('private'));
+        $this->assertFalse($response->headers->hasCacheControlDirective('must-revalidate'));
+        $this->assertSame('30', $response->headers->getCacheControlDirective('max-age'));
+
+        $listener->onKernelResponse(new FilterResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST, $response));
+
+        $this->assertTrue($response->headers->hasCacheControlDirective('private'));
+        $this->assertTrue($response->headers->hasCacheControlDirective('must-revalidate'));
+        $this->assertSame('0', $response->headers->getCacheControlDirective('max-age'));
+    }
 }

vendor/symfony/http-kernel/Tests/EventListener/ValidateRequestListenerTest.php

@@ -21,6 +21,11 @@ use Symfony\Component\HttpKernel\KernelEvents;
 
 class ValidateRequestListenerTest extends TestCase
 {
+    protected function tearDown()
+    {
+        Request::setTrustedProxies(array(), -1);
+    }
+
     /**
      * @expectedException \Symfony\Component\HttpFoundation\Exception\ConflictingHeadersException
      */

vendor/symfony/http-kernel/Tests/Fragment/InlineFragmentRendererTest.php

@@ -168,16 +168,33 @@ class InlineFragmentRendererTest extends TestCase
     public function testHeadersPossiblyResultingIn304AreNotAssignedToSubrequest()
     {
         $expectedSubRequest = Request::create('/');
-        if (Request::HEADER_X_FORWARDED_FOR & Request::getTrustedHeaderSet()) {
-            $expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
-            $expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
-        }
+        $expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
+        $expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
 
         $strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
         $request = Request::create('/', 'GET', array(), array(), array(), array('HTTP_IF_MODIFIED_SINCE' => 'Fri, 01 Jan 2016 00:00:00 GMT', 'HTTP_IF_NONE_MATCH' => '*'));
         $strategy->render('/', $request);
     }
 
+    public function testFirstTrustedProxyIsSetAsRemote()
+    {
+        Request::setTrustedProxies(array('1.1.1.1'), -1);
+
+        $expectedSubRequest = Request::create('/');
+        $expectedSubRequest->headers->set('Surrogate-Capability', 'abc="ESI/1.0"');
+        $expectedSubRequest->server->set('REMOTE_ADDR', '1.1.1.1');
+        $expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
+        $expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
+
+        $strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
+
+        $request = Request::create('/');
+        $request->headers->set('Surrogate-Capability', 'abc="ESI/1.0"');
+        $strategy->render('/', $request);
+
+        Request::setTrustedProxies(array(), -1);
+    }
+
     /**
      * Creates a Kernel expecting a request equals to $request
      * Allows delta in comparison in case REQUEST_TIME changed by 1 second.

vendor/symfony/http-kernel/Tests/HttpCache/HttpCacheTest.php

@@ -11,9 +11,11 @@
 
 namespace Symfony\Component\HttpKernel\Tests\HttpCache;
 
+use Symfony\Component\HttpKernel\HttpCache\Esi;
 use Symfony\Component\HttpKernel\HttpCache\HttpCache;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\HttpCache\Store;
 use Symfony\Component\HttpKernel\HttpKernelInterface;
 
 /**
@@ -1350,6 +1352,8 @@ class HttpCacheTest extends HttpCacheTestCase
         $this->request('GET', '/', array('REMOTE_ADDR' => '10.0.0.1'));
 
         $this->assertEquals($expected, Request::getTrustedProxies());
+
+        Request::setTrustedProxies(array(), -1);
     }
 
     public function getTrustedProxyData()
@@ -1465,6 +1469,42 @@ class HttpCacheTest extends HttpCacheTestCase
         $this->assertHttpKernelIsNotCalled();
         $this->assertSame('get', $this->response->getContent());
     }
+
+    public function testUsesOriginalRequestForSurrogate()
+    {
+        $kernel = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock();
+        $store = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpCache\StoreInterface')->getMock();
+
+        $kernel
+            ->expects($this->exactly(2))
+            ->method('handle')
+            ->willReturnCallback(function (Request $request) {
+                $this->assertSame('127.0.0.1', $request->server->get('REMOTE_ADDR'));
+
+                return new Response();
+            });
+
+        $cache = new HttpCache($kernel,
+            $store,
+            new Esi()
+        );
+
+        $request = Request::create('/');
+        $request->server->set('REMOTE_ADDR', '10.0.0.1');
+
+        // Main request
+        $cache->handle($request, HttpKernelInterface::MASTER_REQUEST);
+
+        // Main request was now modified by HttpCache
+        // The surrogate will ask for the request using $this->cache->getRequest()
+        // which MUST return the original request so the surrogate
+        // can actually behave like a reverse proxy like e.g. Varnish would.
+        $this->assertSame('10.0.0.1', $cache->getRequest()->getClientIp());
+        $this->assertSame('10.0.0.1', $cache->getRequest()->server->get('REMOTE_ADDR'));
+
+        // Surrogate request
+        $cache->handle($request, HttpKernelInterface::SUB_REQUEST);
+    }
 }
 
 class TestKernel implements HttpKernelInterface

vendor/symfony/http-kernel/Tests/HttpKernelTest.php

@@ -331,6 +331,8 @@ class HttpKernelTest extends TestCase
 
         $kernel = $this->getHttpKernel($dispatcher);
         $kernel->handle($request, $kernel::MASTER_REQUEST, false);
+
+        Request::setTrustedProxies(array(), -1);
     }
 
     private function getHttpKernel(EventDispatcherInterface $eventDispatcher, $controller = null, RequestStack $requestStack = null, array $arguments = array())

vendor/symfony/http-kernel/composer.json

@@ -18,7 +18,7 @@
     "require": {
         "php": "^7.1.3",
         "symfony/event-dispatcher": "~4.1",
-        "symfony/http-foundation": "~4.1",
+        "symfony/http-foundation": "^4.1.1",
         "symfony/debug": "~3.4|~4.0",
         "symfony/polyfill-ctype": "~1.8",
         "psr/log": "~1.0"
@@ -37,7 +37,7 @@
         "symfony/stopwatch": "~3.4|~4.0",
         "symfony/templating": "~3.4|~4.0",
         "symfony/translation": "~3.4|~4.0",
-        "symfony/var-dumper": "~4.1",
+        "symfony/var-dumper": "^4.1.1",
         "psr/cache": "~1.0"
     },
     "provide": {
@@ -46,7 +46,7 @@
     "conflict": {
         "symfony/config": "<3.4",
         "symfony/dependency-injection": "<4.1",
-        "symfony/var-dumper": "<4.1",
+        "symfony/var-dumper": "<4.1.1",
         "twig/twig": "<1.34|<2.4,>=2"
     },
     "suggest": {