Release 2.26 (#5189)

* bring back deprecated methods
* bump packages
* fix SAML redirect
* config flag for break times
* use class constant instead of string in attributes
* throw if all tags were not found - fixes #4792

src/Controller/Auth/SamlController.php

@@ -12,18 +12,24 @@ namespace App\Controller\Auth;
 use App\Configuration\SamlConfigurationInterface;
 use App\Saml\SamlAuthFactory;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Http\SecurityRequestAttributes;
+use Symfony\Component\Security\Http\Util\TargetPathTrait;
 
 #[Route(path: '/saml')]
 final class SamlController extends AbstractController
 {
+    use TargetPathTrait;
+
     public function __construct(
         private readonly SamlAuthFactory $authFactory,
-        private readonly SamlConfigurationInterface $samlConfiguration
+        private readonly SamlConfigurationInterface $samlConfiguration,
+        private readonly Security $security,
     )
     {
     }
@@ -54,8 +60,12 @@ final class SamlController extends AbstractController
             throw new \RuntimeException($error);
         }
 
-        // this does set headers and exit as $stay is not set to true
-        $redirectTarget = $session->get('_security.main.target_path');
+        $firewallName = $this->security->getFirewallConfig($request)?->getName();
+        if ($firewallName === null || $firewallName === '') {
+            throw new ServiceUnavailableHttpException(message: 'Unknown firewall.');
+        }
+
+        $redirectTarget = $this->getTargetPath($session, $firewallName);
         if ($redirectTarget === null || $redirectTarget === '') {
             $redirectTarget = $this->generateUrl('homepage', [], UrlGeneratorInterface::ABSOLUTE_URL);
         }

src/Controller/DoctorController.php

@@ -253,7 +253,6 @@ final class DoctorController extends AbstractController
             'max_execution_time',
             'date.timezone',
             'allow_url_fopen',
-            'allow_url_include',
             'default_charset',
             'default_mimetype',
             'display_errors',