Merge 5.11 changes into 6.x

composer.json

@@ -66,7 +66,7 @@
     "symfony/yaml": "^7.0|^8.0",
     "theiconic/name-parser": "^1.2",
     "tpetry/laravel-query-expressions": "^1.5",
-    "twig/twig": "~3.27.0",
+    "twig/twig": "~3.28.0",
     "voku/portable-ascii": "^2.0",
     "web-auth/webauthn-lib": "~5.2.4",
     "webonyx/graphql-php": "~15.33.1",

src/Support/Url.php

@@ -131,22 +131,50 @@ public static function urlWithParams(string $url, array|string $params): string
      * Removes a query string param from a URL.
      */
     public static function removeParam(string $url, string $param): string
+    {
+        return static::removeParams($url, [$param]);
+    }
+
+    /**
+     * Removes query string params from a URL.
+     */
+    public static function removeParams(string $url, array $params): string
     {
         // Extract any params/fragment from the base URL
-        [$url, $params, $fragment] = self::_extractParams($url);
+        [$url, $urlParams, $fragment] = self::_extractParams($url);
 
-        // Remove the param
-        unset($params[$param]);
+        // Remove the params
+        foreach ($params as $param) {
+            unset($urlParams[$param]);
+        }
 
         // Rebuild
-        if (($query = static::buildQuery($params)) !== '') {
-            $url .= '?'.$query;
-        }
-        if ($fragment !== null) {
-            $url .= '#'.$fragment;
+        return self::_buildUrl($url, $urlParams, $fragment);
+    }
+
+    /**
+     * Removes all query string params from a URL.
+     *
+     * @param  string[]  $except  Any params that should be left alone
+     */
+    public static function removeAllParams(string $url, array $except = []): string
+    {
+        // Extract any params/fragment from the base URL
+        [$url, $params, $fragment] = self::_extractParams($url);
+
+        // Remove the params
+        if (! empty($except)) {
+            foreach (array_keys($params) as $param) {
+                if (! in_array($param, $except)) {
+                    unset($params[$param]);
+                }
+            }
+        } else {
+            $params = [];
         }
 
-        return $url;
+        // Rebuild
+        return self::_buildUrl($url, $params, $fragment);
     }
 
     /**
@@ -242,13 +270,17 @@ public static function rootRelativeUrl(string $url): string
 
     /**
      * Returns either a control panel or a site URL, depending on the request type.
+     *
+     * @param  array|string|false|null  $params  The query params to add to the URL. If `false`, any existing params will be removed.
      */
-    public static function url(string $path = '', array|string|null $params = null, ?string $scheme = null): string
+    public static function url(string $path = '', array|string|false|null $params = null, ?string $scheme = null): string
     {
         // Return $path if it appears to be an absolute URL.
         if (static::isFullUrl($path)) {
             if ($params) {
                 $path = static::urlWithParams($path, $params);
+            } elseif ($params === false) {
+                $path = static::removeAllParams($path);
             }
 
             if ($scheme !== null) {
@@ -273,7 +305,7 @@ public static function url(string $path = '', array|string|null $params = null,
             $scheme = 'https';
         }
 
-        return self::_createUrl($path, $params, $scheme, $cpUrl);
+        return self::_createUrl($path, $params ?: null, $scheme, $cpUrl);
     }
 
     /**

tests/Feature/Support/URLTest.php

@@ -216,6 +216,61 @@
         ],
     ]);
 
+    test('removes multiple query params from a URL', function (string $expected, string $url, array $params) {
+        expect(Url::removeParams($url, $params))->toBe($expected);
+    })->with([
+        'removes-multiple' => [
+            'https://craftcms.com/?bar=2#anchor',
+            'https://craftcms.com/?foo=1&bar=2&baz=3#anchor',
+            ['foo', 'baz'],
+        ],
+        'removes-all-listed' => [
+            'https://craftcms.com/#anchor',
+            'https://craftcms.com/?foo=1&bar=2#anchor',
+            ['foo', 'bar'],
+        ],
+        'keeps-url-when-params-are-missing' => [
+            'https://craftcms.com/?foo=1',
+            'https://craftcms.com/?foo=1',
+            ['bar', 'baz'],
+        ],
+        'empty-params' => [
+            'https://craftcms.com/?foo=1',
+            'https://craftcms.com/?foo=1',
+            [],
+        ],
+    ]);
+
+    test('removes all query params from a URL', function (string $expected, string $url, array $except) {
+        expect(Url::removeAllParams($url, $except))->toBe($expected);
+    })->with([
+        'removes-all' => [
+            'https://craftcms.com/',
+            'https://craftcms.com/?foo=1&bar=2',
+            [],
+        ],
+        'keeps-fragment' => [
+            'https://craftcms.com/#anchor',
+            'https://craftcms.com/?foo=1&bar=2#anchor',
+            [],
+        ],
+        'except' => [
+            'https://craftcms.com/?bar=2',
+            'https://craftcms.com/?foo=1&bar=2&baz=3',
+            ['bar'],
+        ],
+        'except-multiple' => [
+            'https://craftcms.com/?foo=1&baz=3',
+            'https://craftcms.com/?foo=1&bar=2&baz=3',
+            ['foo', 'baz'],
+        ],
+        'except-missing' => [
+            'https://craftcms.com/',
+            'https://craftcms.com/?foo=1&bar=2',
+            ['baz'],
+        ],
+    ]);
+
     test('adds token params to a URL', function (string $expected, string $url, string $token) {
         Cms::config()->useSslOnTokenizedUrls = true;
 
@@ -390,6 +445,13 @@
         ['{siteUrl}endpoint?returnUrl=https%3A%2F%2Fexample.test%2Fadmin%2Fentries%3Fsite%3D{handle}', 'endpoint', ['returnUrl' => 'https://example.test/admin/entries?site={handle}'], 'https', null],
     ]);
 
+    it('removes all params from a full URL when params is false', function () {
+        swapUrlRequest('https://localhost/news');
+
+        expect(Url::url('https://craftcms.com/?x-craft-preview=foo&test=bar', false))
+            ->toBe('https://craftcms.com/');
+    });
+
     it('creates action URLs', function () {
         swapUrlRequest('https://localhost/news');
 

yii2-adapter/legacy/helpers/UrlHelper.php

@@ -1,6 +1,8 @@
 <?php
+
 /**
  * @link https://craftcms.com/
+ *
  * @copyright Copyright (c) Pixel & Tonic, Inc.
  * @license https://craftcms.github.io/license/
  */
@@ -13,6 +15,7 @@
  * Class Url
  *
  * @author Pixel & Tonic, Inc. <support@pixelandtonic.com>
+ *
  * @since 3.0.0
  * @deprecated 6.0.0 use {@see Url} instead.
  */
@@ -21,7 +24,6 @@ class UrlHelper extends Url
     /**
      * Returns a CP referral URL.
      *
-     * @return string|null
      * @since 5.9.0
      * @deprecated in 5.10.0
      */
@@ -40,7 +42,7 @@ public static function cpReferralUrl(): ?string
         }
 
         // Make sure the CP referred it
-        if (!str_starts_with($referrer, self::baseCpUrl())) {
+        if (!str_starts_with($referrer, static::baseCpUrl())) {
             return null;
         }
 

yii2-adapter/legacy/web/DbSession.php

@@ -0,0 +1,37 @@
+<?php
+
+/**
+ * @link https://craftcms.com/
+ *
+ * @copyright Copyright (c) Pixel & Tonic, Inc.
+ * @license https://craftcms.github.io/license/
+ */
+
+namespace craft\web;
+
+use craft\behaviors\SessionBehavior;
+
+/**
+ * Extends [[\yii\web\DbSession]] to add defenses for “headers already sent” errors.
+ *
+ * @author Pixel & Tonic, Inc. <support@pixelandtonic.com>
+ *
+ * @since 5.11.0
+ *
+ * @mixin SessionBehavior
+ */
+class DbSession extends \yii\web\DbSession
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function has($key): bool
+    {
+        // don't open the session if the headers were already sent
+        if (!$this->getIsActive() && headers_sent()) {
+            return isset($_SESSION[$key]);
+        }
+
+        return parent::has($key);
+    }
+}