Yii 2: The Fast, Secure and Professional PHP Framework

I think it can be useful if Yii will provide some web-api support, for example REST, with catching event when request starts, also if Yii will provide some CRestAction < CAction, maybe other workaround can be here to fit REST, what do u think? Situation is common enough so if Yii will give developers some basis it can be good.

Features to implement

• [x] API Testing Framework (RC)
• [ ] ~~File upload support (RC)~~ moved to #4477
• [ ] ~~Batch queries with transactions support and error handling. (GA or post GA)~~ moved to #4478
• [ ] ~~Searching and filtering (GA or post GA)~~ moved to #4479
• [ ] ~~Automatic API Documentation Generation (e.g. via https://developers.helloreverb.com/swagger/) (GA or post GA)~~ moved to #2684
• [x] Ability to serve in multiple formats: JSON, JSONP, XML.
  • already nicely done by Response class: https://github.com/yiisoft/yii2/issues/158#issuecomment-19480770
• [x] Pagination for collections.
• [x] Documentation about which HTTP codes to return when.
• [x] Documentation on how to implement authentication.

I have been using fxp and until now I had only trouble with it. It feels like it's flawed by design and makes managing the bower/npm assets a real PITA. The idea is extremely awesome, but this plugin is just near to useless.

I have been patching some very big issues it has with npm/bower/git, but issues keep popping and it just feels that the entire plugin was badly designed and that those issues won't be fixed ever or will require major changes.

Is it time to switch to something else? Or maybe invest some time working on that plugin?

What steps will reproduce the problem?

Currently Yii is using a four-digit versioning, which is not 100% Semantic Versioning and it does not play very well with composer.

Two of the most commonly used operators ^ and ~ don't work well with the current versioning.

What is the expected result?

Have a concise way to define constraints for the core framework.

What do you get instead?

• ^2.0.15.2 - gives you updates of all the 2.x versions (which include major releases in Yii terms)
• ~2.0.15.2 - gives you only updates below 2.0.16, which is clearly too restrictive

There's no operator which can be used in a sane way with the current versioning.

Additional info

| Q | A | ---------------- | --- | Yii version | any

You can read the prologue to this issue starting from https://github.com/yiisoft/yii2-phpunit/pull/2#issuecomment-375270353

I know this is a huge change and I'd avoid it if there'd be a reasonable alternative, but neither changing semver, nor introducing a new operator to composer seems to be one.

Possible naming:

• Yii 2.0 Framework 3.0.0
• Yii 2:3.0.0 Framework
• ...

Tasks

• [ ] change 2.1 branches to 3.0
• [ ] change branding info

Decision

Update to PHP 7.1.

TODO

• [x] Install APCu via travis instead of APC: https://github.com/yiisoft/yii2/pull/14505
• [x] Drop memcache (w/o D) support.
• [x] Use null coalesce: https://github.com/yiisoft/yii2/pull/16270
• [x] Remove old PHPUnit polyfills: https://github.com/yiisoft/yii2/pull/14506
• [x] Remove intl polyfills: https://github.com/yiisoft/yii2/pull/16273#pullrequestreview-119708556

Original issue

Currently only php 5.6, 7 and 7.1 are supported

http://php.net/supported-versions.php

php 5.5 is in security-only support and will reach end of life very soon, while php5.6 will enter security-only support next year. Probably yii 2.1 will take around a year to develop, by that time the entire php5 branch will be obsolete.

Today ubunt 16.04 will be released which includes php7 as the default version and its an LTS so we can expect a lot of server providers to switch to it an offer php7 effortlessly during the next months.

Requiring php7 for yii2.1 can be very useful

• code generation in gii which can take full advantage of the type hintings.
• views and controllers can be simplified a lot with the use groups
• Interally yii2 has many unit tests and has a good dependency injection container, both of them can be benefited by the anonymous classes.
• Yii security class can benefit a lot of the new random generators.

I propose to make a poll using emoji's. I will post 3 options bellow and any reaction to them (:+1: :-1: etc) count as a vote for that option. That way someone can vote for more than one option.

Currently Yii2 support only one init plain file that will be included before fixtures load. This is good but not enough. For some different cases we may need special initializers per each fixture that will take care of creating triggers, views, maybe adding/deleting fk and other, so to avoid copy-paste between setUp methods we need some class-initializer. For example:

use yii\test\fixture\Initializer;

class UsersInitializer extends Initializer
{
     public function run()
     {
          $this->createTable(); 
          $this->addForeignKey();
          .....
     }
}

After initializer call fixture file will be loaded if it is exists. So ower goals after all:

1. ability to reuse Initializer in multiple setUp() methods of tests; Avoid copy-paste of init. code in special testing methods (env. creation like triggers, tables, fk and constraints should not be in setUp of test-case, and we should avoid this copy-paste between different test-cases).
2. add some additional abilitites that will be needed in most cases (user can use initializer to create needed env. fo fixture: tables, fk, triggers, other constraints). Provide migration-like API for working with DB schema;
3. speed-up database tests, by creating only needed things and not all schema with all tables, etc;

Hello! Thank you for your work! I have updated today by composer and found this error:

http://awesomescreenshot.com/0ff3hzs143

Do you have removed this method anywhere except debug mode?

Currently in order to make a search function (not following gii approach) a user needs to do the following:

$query = Contact::find();
if(!empty($this->full_name))
{
   $query->where(['like', 'full_name', $this->full_name]);
}
// or 
if(trim($this->email) !== '')
{
   $query->where(['email' => $this->email]);
}

Or using the gii approach (creating an addCondition method) it is always required to search for empty or NULL values. Which even I think is good for demo purposes to have the addCondition on the search model reproduced by gii, I find it quite of non-sense to have the same method on each search model.

Failing to not check against NULL values will cause two different results on both scenarios. On the first one like, it throws an error:

Whereas on the second one will produce the following SQL:

SELECT * FROM tbl_contact WHERE full_name IS NULL LIMIT 10

Which IMHO I think is the wrong behavior, even if the adCondition function of the search model strictly checks for empty strings not NULL attributes.

_Suggestion_

I believe that everybody should be able to use the following:

$query = Contact::find();
$query->where(['like', 'full_name', $this->full_name]);
$query->where(['email' => $this->email]);

And NULL or empty values should be removed from the resulting Query object as it used to happen with CDbCriteria on Yii1. That will make our search classes cleaner and without the need to check whether I have NULL or empty values on my queries and also we will follow an approach that was commonly used by new users.

I do not think we should force the IS NULL search if an attribute has null value. For that purposes we already have yii\db\Expression don't you agree? I think it makes more sense and is less error prone (in terms of search results).

$query->where(['email' => yii\db\Expression('IS NULL')]);

Hi, I cache some menu links in my application (datacaching using filecache), sometimes hostname part of these links change to a random website (usually chinese websites) and I have to flush the cache to make it work again. after some research and studying webserver logs it turned out to be "Host Header Attack". turning off caching would solve the problem but that's not the solution for me as I have very high traffic websites. reading some articles ( https://www.acunetix.com/vulnerabilities/web/host-header-attack ) suggest not using $_SERVER['HTTP_HOST'] when creating links and using $_SERVER['SERVER_NAME'] instead. I tried to simulate the situation using burp suite application and the suggested solution acutally works. but the code responsible for getting host info is located in core framework and is in \yii\web\Request::getHostInfo method and the above change should be applied on that method. although I don't know if it has any other side effect rather than ruined links when caching is enabled.

Things to be fixed:

• [x] we have yiisoft/jquery and bower/jquery in the composer.json file
• [x] remove bower.json files
• [x] update extension guide point 5: https://github.com/yiisoft/yii2/blob/master/extensions/README.md
• [x] add documentation for extension developers on how to configure asset bundles: https://github.com/yiisoft/yii2/pull/5084#issuecomment-55933141

It would be great if we have ability to set components on some basic class extended from Component, so in this way it will be smth. like composite pattern, also @samdark do you remeber this suggestions from russian php forum? Any other thoughts of core-developers? In Yii1 i was missing this functionality, that i can't do smth. like this for example:

class MyComponent extends CComponent
{
}

$a = new MyComponent();
$a->setComponent($b);
$a->setComponents($config); //configure

I think this functionality can be cleared from Module and set to the Component class.

В данной реализации фреймворка невозможно никак сконфигурировать модель, т.к. все упирается на public static function instantiate($row). Хотелось, чтобы разработчики пересмотрели свое мнение касательно данного нюанса, и все таки дали разработчикам возможность задавать конфиг по умолчанию. На самом деле сложного здесь не очень много, но не хотелось бы создавать свои грабли. Для начала опишу случаи когда это может понадобиться - к примеру мы используем 1 модуль в нескольких местах и хотим чтобы наша модель в зависимости от конфигурации модуля реализовывала то или иное поведение. Как второй вариант задача сценария для релатед моделей. Собственно хотелось бы предложить в ActiveQueryTrait заменить modelClass на modelConfig и разрешить делать следующие 3 пункта:

• $this->hasMany(['class'=>'ModelClass', 'property' => $var], ....)
• hasOne
• ModelClass::find(['property' => $var])

далее изменим вышеупомянутую функцию instantiate($row, $config = [])

Данное решение полностью удовлетворяет обратной совместимости и многие разработчики думаю будут рады этому введению, т.к. сейчас смотря на расширения кто на что горазд в передаче того же модуля в модель.

If a field is set at the defaultOrder of a Sort specification with a SORT_DESC ordering, and enableMultiSort is set to true, the sort link is always generated the same and sorting in SORT_ASC order is not possible.

What steps will reproduce the problem?

Enable multisort and set defaultOrder on a property with SORT_DESC, i.e.

        $dataProvider = new ActiveDataProvider([
            'query' => $query,
            'sort' => [
                'enableMultiSort' => true,
                'defaultOrder' => [
                    'date' => SORT_DESC
                ]
            ],
        ]);

What is the expected result?

After https://github.com/yiisoft/yii2/pull/18826 changing the sorting of the designated field would be expected in the order: DESC -> off -> ASC -> DESC ...

What do you get instead?

The sort link generated by $sort->link() is repeatedly setting sorting to OFF, due to the fact that the default ordering sets the order to DESC.

Additional info

| Q | A | ---------------- | --- | Yii version | 2.0.47 | PHP version | 8.2.0 | Operating system | Ubuntu 22.04.1 LTS (Jammy Jellyfish) 64-bit

We need to patch Yii2 for changes that we need, but isn't accepted upstream.

To do this, we use cweagans/composer-patches, and specify the patches that need to be done in our composer.json file. Nothing special here.

Example:

...
    "extra": {
        "composer-exit-on-patch-failure": true,
        "patches": {
            "yiisoft/yii2": {
                "Auto expand in toArray()": "patches/auto_expand_in_toarray.patch"
            }
        }
    },
...

This works fine, untill we add yiisoft/yii2-gii ~2.2.0 and phpunit/phpunit ~9.5.0 to our require-dev section.

Example:

...
    "require-dev": {
        "phpunit/phpunit": "~9.5.0",
        "yiisoft/yii2-gii": "~2.2.0"
    },
...

Composer will then suddenly try to patch phpunit/phpunit with the patches from https://github.com/yiisoft/phpunit-patches, but those patches are for phpunit 4.8, and I want to use phpunit 9.5.

This has been reported before here: https://github.com/yiisoft/phpunit-patches/issues/9, but I didn't provide a reproducable test case. You can find one below now.

What steps will reproduce the problem?

$ git clone https://github.com/michaelarnauts/yii2-patch-issue
$ cd yii2-patch-issue
$ composer install
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 40 installs, 0 updates, 0 removals
  - Locking bower-asset/inputmask (3.3.11)
...
  - Locking yiisoft/yii2 (2.0.47)
  - Locking yiisoft/yii2-composer (2.0.10)
  - Locking yiisoft/yii2-gii (2.2.5)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 40 installs, 0 updates, 0 removals
As there is no 'unzip' nor '7z' command installed zip files are being unpacked using the PHP zip extension.
This may cause invalid reports of corrupted archives. Besides, any UNIX permissions (e.g. executable) defined in the archives will be lost.
Installing 'unzip' or '7z' (21.01+) may remediate them.
  - Installing cweagans/composer-patches (1.7.2): Extracting archive
Gathering patches for root package.
Gathering patches for dependencies. This might take a minute.
  - Installing yiisoft/yii2-composer (2.0.10): Extracting archive
...
  - Installing yiisoft/yii2-gii (2.2.5): Extracting archive
  - Applying patches for phpunit/phpunit
    https://yiisoft.github.io/phpunit-patches/phpunit_php7.patch (Fix PHP 7 compatibility)
   Could not apply patch! Skipping. The error was: Cannot apply patch https://yiisoft.github.io/phpunit-patches/phpunit_php7.patch

In Patches.php line 326:

  Cannot apply patch Fix PHP 7 compatibility (https://yiisoft.github.io/phpunit-patches/phpunit_php7.patch)!


install [--prefer-source] [--prefer-dist] [--prefer-install PREFER-INSTALL] [--dry-run] [--dev] [--no-suggest] [--no-dev] [--no-autoloader] [--no-progress] [--no-install] [--audit] [--audit-format AUDIT-FORMAT] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--apcu-autoloader-prefix APCU-AUTOLOADER-PREFIX] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [--] [<packages>...]

There are two workarounds, but both aren't really a good solution:

• Add a lot of ignores to the patches-ignore section as indicated here https://github.com/yiisoft/phpunit-patches/issues/9. This is ugly and it seems that these patches are added to new yii2 packages, so I'll have to add them all.
• Set composer-exit-on-patch-failure to false, so it errors out on the phpunit patches, but continues with my patches. This works, but then I don't see if the codebase is changed and my patches don't apply anymore.

What is the expected result?

I only want my patch to apply.

What do you get instead?

  - Applying patches for phpunit/phpunit
    https://yiisoft.github.io/phpunit-patches/phpunit_php7.patch (Fix PHP 7 compatibility)
   Could not apply patch! Skipping. The error was: Cannot apply patch https://yiisoft.github.io/phpunit-patches/phpunit_php7.patch

Additional info

| Q | A | ---------------- | --- | Yii version | 2.0.47 | PHP version | 8.1, but it also happens on 7.4 | Operating system | Ubuntu 22.04

What steps will reproduce the problem?

Set yii language to "zh-HK", [error][yii\i18n\PhpMessageSource::loadFallbackMessages] The message file for category 'yii' does not exist

What is the expected result?

The message folder only have "zh-TW" and "zh-CN", "zh-HK" not found and try to locate the "zh" folder, but not exist.

What do you get instead?

The message folder only have "zh-TW" and "zh-CN", "zh-HK" not found and try to locate the "zh" folder, but not exist.

Additional info

I try to make a simple link from "zh-CN" to "zh" , problem fixed. So please add the "zh" message folder. | Q | A | ---------------- | --- | Yii version | 2.0.? | PHP version | | Operating system |

Eager load with() has one bug when relation dynamic className

table_like id,class_name,object_id 1,\App\Post,1 2,\App\Post,2 3,\App\Comment,3 4,\App\Comment,4

Model: Like extends ActiveRecord{

public function getLikeEntity(){
	return $this->hasOne($this->class_name,['id'=>'obj_id']);
}

}

Now query:

$items = Like::find()->with('likeEnity')->all();

queryBuilder will generate sql like:

select * from post where id in(1,2,3,4)

comment not query !

$items[0]->likeEntity is post model $items[1]->likeEntity is post model $items[2]->likeEntity is null $items[3]->likeEntity is null

Right sql may be like this: select * from post where id in(1,2) select * from comment where id in(3,4)

foreach($items as $item){ //$items[0]->likeEntity is post model //$items[1]->likeEntity is post model //$items[2]->likeEntity is comment model //$items[3]->likeEntity is comment model }

Additional info

| Q | A | ---------------- | --- | Yii version | 2.0.47? | PHP version 8.1 | | Operating system | ubuntu 22.04

| Q | A | ------------- | --- | Is bugfix? | ✔️ | New feature? | ❌ | Breaks BC? | ❌ | Fixed issues | https://github.com/yiisoft/yii2/issues/19705

As binary is the real data type in Mysql, it would be more perfect to add it to $typeMap list of \yii\db\mysql\Schema::class

My proposal:

        'enum' => self::TYPE_STRING,
        'varbinary' => self::TYPE_BINARY,
+       'binary' => self::TYPE_BINARY,
        'json' => self::TYPE_JSON,

List of missing data types

• set
• binary
• bool
• boolean
• dec
• fixed
• double precision
• GEOMETRY
• point
• LINESTRING
• POLYGON
• MULTIPOINT
• MULTILINESTRING
• MULTIPOLYGON
• GEOMETRYCOLLECTION

For set

https://github.com/yiisoft/yii2/issues/19705#issuecomment-1339083122

Loosely related to https://github.com/yiisoft/yii2/issues/18409