Clients/neveling

Fork 0

PHP 8.4 / Symfony 6.4 upgrade #20

Merged

mrouissi merged 7 commits from feature/php84-symfony64 into master

2026-05-30 13:14:50 +02:00

mrouissi commented

2026-05-29 19:05:27 +02:00

Owner

Summary

Upgrades adressermittlung.de from PHP 7.4 / Symfony 3.4 to PHP 8.4 / Symfony 6.4 LTS.

Repository restructure

App moved from wf10501/www/ to the repo root (matches server layout + standard Symfony); stop tracking the server home dir and vendor_old/.

Framework migration (3.4 -> 6.4 LTS)

Symfony components -> 6.4; Twig 2 -> 3; Doctrine bundle 2.x / migrations 3.x
Swiftmailer -> symfony/mailer (MAILER_DSN); mailer pinned to 6.4; PHP >=8.1
@Route / @IsGranted annotations -> PHP 8 attributes
getDoctrine() -> injected ManagerRegistry; $this->get(session) -> RequestStack
UserPasswordEncoderInterface -> UserPasswordHasherInterface
SF6 front controller; prod Doctrine cache type: pool; server_version -> mariadb-10.11.17

Database

Migration metadata modernized to doctrine-migrations 3.x
user.roles legacy json_array -> native json

Testing (dev = https://dev.adressermittlung.de)

Prod container compiles, 146 routes load
Public + portal pages 200; login + auth redirects OK
Mailer SMTP verified; RISER SOAP loads on 8.4; Stripe SDK functional

Planned follow-ups (NOT in this PR)

Phase 2: replace abandoned paypal/rest-api-sdk-php
Phase 3: bump to Symfony 7.4 LTS (+ residual 6.4/7.x mix & deprecation cleanup)

Prod promotion checklist (wfweb012)

Set prod MAILER_DSN (only old Swiftmailer MAILER_URL present)
Migrations: sync-metadata-storage -> mark 2019 migrations applied -> migrate
composer install on PHP 8.4; switch fpm pool to 8.4

## Summary Upgrades adressermittlung.de from PHP 7.4 / Symfony 3.4 to **PHP 8.4 / Symfony 6.4 LTS**. ### Repository restructure - App moved from `wf10501/www/` to the repo root (matches server layout + standard Symfony); stop tracking the server home dir and `vendor_old/`. ### Framework migration (3.4 -> 6.4 LTS) - Symfony components -> 6.4; Twig 2 -> 3; Doctrine bundle 2.x / migrations 3.x - Swiftmailer -> symfony/mailer (MAILER_DSN); mailer pinned to 6.4; PHP `>=8.1` - `@Route` / `@IsGranted` annotations -> PHP 8 attributes - `getDoctrine()` -> injected ManagerRegistry; `$this->get(session)` -> RequestStack - UserPasswordEncoderInterface -> UserPasswordHasherInterface - SF6 front controller; prod Doctrine cache `type: pool`; server_version -> mariadb-10.11.17 ### Database - Migration metadata modernized to doctrine-migrations 3.x - `user.roles` legacy `json_array` -> native `json` ## Testing (dev = https://dev.adressermittlung.de) - Prod container compiles, 146 routes load - Public + portal pages 200; login + auth redirects OK - Mailer SMTP verified; RISER SOAP loads on 8.4; Stripe SDK functional ## Planned follow-ups (NOT in this PR) - Phase 2: replace abandoned paypal/rest-api-sdk-php - Phase 3: bump to Symfony 7.4 LTS (+ residual 6.4/7.x mix & deprecation cleanup) ## Prod promotion checklist (wfweb012) - Set prod MAILER_DSN (only old Swiftmailer MAILER_URL present) - Migrations: sync-metadata-storage -> mark 2019 migrations applied -> migrate - composer install on PHP 8.4; switch fpm pool to 8.4

mrouissi added 5 commits

2026-05-29 19:05:28 +02:00

chore: Move application to repository root 1859001334

feat: Upgrade to PHP 8.4 and Symfony 6.4 29f0a286a9

feat: Fix legacy json_array type on user.roles and modernize migrations 06311d5096

chore: Replace Swiftmailer MAILER_URL with MAILER_DSN in .env.dist b66fb13165

chore: Pin symfony/mailer to 6.4 LTS and require PHP 8.1+ a83261c4ff

mrouissi self-assigned this

2026-05-29 19:06:22 +02:00

mrouissi added the

approved-project

label

2026-05-29 19:06:28 +02:00

mrouissi commented

2026-05-30 10:24:44 +02:00

Author

Owner

Code review findings

Reviewed via a multi-angle pass and verified against the running dev site. Note: two finder claims of "breaks all routing" were verified false — Symfony\Component\Routing\Annotation\Route still exists as a deprecated alias in routing 7.4, and the missing-TestController route only 500s if that URL is hit (Symfony resolves controllers lazily).

Real bugs — fixed in this PR

Silent RISER email failures — Mailer::sendResultEmail() no longer returns a recipient count (Swiftmailer did; symfony/mailer returns void), but GetResultsCommand still did if ($nrMailsSent === 0) to detect failure → always false → a failed result email was logged as "successful". Fixed: send wrapped in try/catch on the thrown TransportException (and no longer aborts the batch).
GetResultsCommand TypeError risk on PHP 8.4 — setHost(getenv(WEBSITE_HOST)) had no fallback (sibling commands got ?:); getenv returns false when unset → setHost(false) TypeError. Fixed: added ?: localhost / ?: https.
Dead/broken route — create_test_customer pointed at a non-existent App\Controller\TestController (also a test-data endpoint that should not ship). Fixed: removed.

Security / behaviour — fixed in this PR

Login account-enumeration — the account-disabled check ran in the user loader before password verification, so a disabled account revealed its state to anyone submitting the email with any password. Fixed: moved to App\Security\UserChecker::checkPostAuth(), which runs only after the password is verified.

Deprecations — deferred to Phase 3 (Symfony 7.4)

EntityManager::merge() used ~12x in InquiryController — works on ORM 2.x, removed in ORM 3.
use Symfony\Component\Routing\Annotation\Route in 6 controllers — deprecated alias (works on 7.4, removed in 8.0); inconsistent with Portal/Security which use Attribute\Route.

Cleanup

getDoctrine() shim duplicated across 6 controllers (PortalController injects the EM directly) — a trait/base controller would be cleaner. [deferred]
CustomerController @param docblocks referenced a non-existent FQCN. Fixed.
services.yaml leftover static_route_loader alias + # FIX banners. [deferred]
Stale \Twig_Error_* docblocks; security.yaml ^/login$ rule does not match the /login/ route. [deferred]

## Code review findings Reviewed via a multi-angle pass and verified against the running dev site. Note: two finder claims of "breaks all routing" were verified **false** — `Symfony\Component\Routing\Annotation\Route` still exists as a deprecated alias in routing 7.4, and the missing-`TestController` route only 500s if that URL is hit (Symfony resolves controllers lazily). ### Real bugs — fixed in this PR 1. **Silent RISER email failures** — `Mailer::sendResultEmail()` no longer returns a recipient count (Swiftmailer did; symfony/mailer returns void), but `GetResultsCommand` still did `if ($nrMailsSent === 0)` to detect failure → always false → a failed result email was logged as "successful". Fixed: send wrapped in try/catch on the thrown `TransportException` (and no longer aborts the batch). 2. **`GetResultsCommand` TypeError risk on PHP 8.4** — `setHost(getenv(WEBSITE_HOST))` had no fallback (sibling commands got `?:`); `getenv` returns `false` when unset → `setHost(false)` TypeError. Fixed: added `?: localhost` / `?: https`. 3. **Dead/broken route** — `create_test_customer` pointed at a non-existent `App\Controller\TestController` (also a test-data endpoint that should not ship). Fixed: removed. ### Security / behaviour — fixed in this PR 4. **Login account-enumeration** — the account-disabled check ran in the user loader *before* password verification, so a disabled account revealed its state to anyone submitting the email with any password. Fixed: moved to `App\Security\UserChecker::checkPostAuth()`, which runs only after the password is verified. ### Deprecations — deferred to Phase 3 (Symfony 7.4) 5. `EntityManager::merge()` used ~12x in `InquiryController` — works on ORM 2.x, removed in ORM 3. 6. `use Symfony\Component\Routing\Annotation\Route` in 6 controllers — deprecated alias (works on 7.4, removed in 8.0); inconsistent with Portal/Security which use `Attribute\Route`. ### Cleanup 7. `getDoctrine()` shim duplicated across 6 controllers (PortalController injects the EM directly) — a trait/base controller would be cleaner. [deferred] 8. `CustomerController` `@param` docblocks referenced a non-existent FQCN. Fixed. 9. `services.yaml` leftover `static_route_loader` alias + `# FIX` banners. [deferred] 10. Stale `\Twig_Error_*` docblocks; `security.yaml` `^/login$` rule does not match the `/login/` route. [deferred]

mrouissi added 2 commits

2026-05-30 10:27:04 +02:00

fix: Run account-disabled check in a UserChecker (post-auth) to prevent login enumeration 476d88fc45

fix: Handle RISER result-mail failures and missing WEBSITE_HOST; remove dead route 100b845f44

mrouissi merged commit 4c66057ad5 into master

2026-05-30 13:14:50 +02:00

mrouissi referenced this pull request from a commit

2026-05-30 13:14:52 +02:00

Merge pull request 'PHP 8.4 / Symfony 6.4 upgrade' (#20) from feature/php84-symfony64 into master

mrouissi deleted branch feature/php84-symfony64

2026-05-30 13:14:55 +02:00