Merge branch '2.8' into 3.4

* 2.8:
  [SecurityBundle] Backport test
  [Security] fix merge of 2.7 into 2.8 + add test case
  backport regression test from 3.4
  Fix misspelling variable
  [DI] minor: use a strict comparision in setDecoratedService
  Follow-on to #25825: Fix edge case in getParameterOption.
  keep the context when validating forms

Author: xabbuh

Http/Firewall/UsernamePasswordFormAuthenticationListener.php

@@ -77,9 +77,13 @@ protected function attemptAuthentication(Request $request)
             }
         }
 
-        $requestBag = $this->options['post_only'] ? $request->request : $request;
-        $username = ParameterBagUtils::getParameterBagValue($requestBag, $this->options['username_parameter']);
-        $password = ParameterBagUtils::getParameterBagValue($requestBag, $this->options['password_parameter']);
+        if ($this->options['post_only']) {
+            $username = ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']);
+            $password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
+        } else {
+            $username = ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']);
+            $password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
+        }
 
         if (!\is_string($username) || (\is_object($username) && !\method_exists($username, '__toString'))) {
             throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));

Http/Tests/Firewall/UsernamePasswordFormAuthenticationListenerTest.php

@@ -77,14 +77,14 @@ public function testHandleWhenUsernameLength($username, $ok)
     }
 
     /**
+     * @dataProvider postOnlyDataProvider
      * @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
      * @expectedExceptionMessage The key "_username" must be a string, "array" given.
      */
-    public function testHandleNonStringUsername()
+    public function testHandleNonStringUsername($postOnly)
     {
         $request = Request::create('/login_check', 'POST', array('_username' => array()));
         $request->setSession($this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
-
         $listener = new UsernamePasswordFormAuthenticationListener(
             new TokenStorage(),
             $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface')->getMock(),
@@ -93,14 +93,20 @@ public function testHandleNonStringUsername()
             'foo',
             new DefaultAuthenticationSuccessHandler($httpUtils),
             new DefaultAuthenticationFailureHandler($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $httpUtils),
-            array('require_previous_session' => false)
+            array('require_previous_session' => false, 'post_only' => $postOnly)
         );
-
         $event = new GetResponseEvent($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $request, HttpKernelInterface::MASTER_REQUEST);
-
         $listener->handle($event);
     }
 
+    public function postOnlyDataProvider()
+    {
+        return array(
+            array(true),
+            array(false),
+        );
+    }
+
     public function getUsernameForLength()
     {
         return array(