From 05f197825b1e3da9d931b5e620643811e6581bc9 Mon Sep 17 00:00:00 2001
From: Sam <sam@mousa.nl>
Date: Tue, 12 Dec 2017 09:25:12 +0100
Subject: [PATCH 1/3] Fixes #15332: Always check for availability of
 `openssl_pseudo_random_bytes`, even if LibreSSL is available

---
 framework/CHANGELOG.md      | 7 +++++++
 framework/base/Security.php | 6 +++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index 8a36e4aeb3..04390b66f6 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -27,6 +27,13 @@ Yii Framework 2 Change Log
 - Enh #15221: Added support for specifying `--camelCase` console options in `--kebab-case` (brandonkelly)
 - Enh #15221: Added support for the `--<option> <value>` console option syntax (brandonkelly)
 - Enh #15221: Improved the `help/list-action-options` console command output for command options without a description (brandonkelly)
+- Enh #14043: Added `yii\helpers\IpHelper` (silverfire, cebe)
+- Bug #15270: Resolved potential race conditions when writing generated php-files (kalessil)
+- Bug #15302: Fixed `yii\caching\DbCache` so that `getValues` now behaves the same as `getValue` with regards to streams (edwards-sj)
+- Bug #15301: Fixed `ArrayHelper::filter()` to work properly with `0` in values (hhniao)
+- Bug #15322: Fixed PHP 7.2 compatibility of `FileHelper::getExtensionsByMimeType()` (samdark)
+- Bug #15320: Fixed special role checks in `yii\filters\AccessRule::matchRole()` (Izumi-kun)
+- Enh #15332: Always check for availability of `openssl_pseudo_random_bytes`, even if LibreSSL is available (sammousa)
 - Enh #15335: Added `FileHelper::unlink()` that works well under all OSes (samdark)
 
 
diff --git a/framework/base/Security.php b/framework/base/Security.php
index 2545edca8a..79f43cf4c0 100644
--- a/framework/base/Security.php
+++ b/framework/base/Security.php
@@ -478,12 +478,12 @@ class Security extends Component
 
         // Since 5.4.0, openssl_random_pseudo_bytes() reads from CryptGenRandom on Windows instead
         // of using OpenSSL library. LibreSSL is OK everywhere but don't use OpenSSL on non-Windows.
-        if ($this->_useLibreSSL
+        if (function_exists('openssl_random_pseudo_bytes')
+            && ($this->_useLibreSSL
             || (
                 DIRECTORY_SEPARATOR !== '/'
                 && substr_compare(PHP_OS, 'win', 0, 3, true) === 0
-                && function_exists('openssl_random_pseudo_bytes')
-            )
+            ))
         ) {
             $key = openssl_random_pseudo_bytes($length, $cryptoStrong);
             if ($cryptoStrong === false) {

From 0e0d53f18235273f87cac3ecc1104d08061540ad Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Tue, 12 Dec 2017 17:17:55 +0300
Subject: [PATCH 2/3] Fixed changelog [skip ci]

---
 framework/CHANGELOG.md | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index 04390b66f6..87bd76cdc1 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -27,12 +27,6 @@ Yii Framework 2 Change Log
 - Enh #15221: Added support for specifying `--camelCase` console options in `--kebab-case` (brandonkelly)
 - Enh #15221: Added support for the `--<option> <value>` console option syntax (brandonkelly)
 - Enh #15221: Improved the `help/list-action-options` console command output for command options without a description (brandonkelly)
-- Enh #14043: Added `yii\helpers\IpHelper` (silverfire, cebe)
-- Bug #15270: Resolved potential race conditions when writing generated php-files (kalessil)
-- Bug #15302: Fixed `yii\caching\DbCache` so that `getValues` now behaves the same as `getValue` with regards to streams (edwards-sj)
-- Bug #15301: Fixed `ArrayHelper::filter()` to work properly with `0` in values (hhniao)
-- Bug #15322: Fixed PHP 7.2 compatibility of `FileHelper::getExtensionsByMimeType()` (samdark)
-- Bug #15320: Fixed special role checks in `yii\filters\AccessRule::matchRole()` (Izumi-kun)
 - Enh #15332: Always check for availability of `openssl_pseudo_random_bytes`, even if LibreSSL is available (sammousa)
 - Enh #15335: Added `FileHelper::unlink()` that works well under all OSes (samdark)
 

From edc8ec120d4268762b70e8bd1235cbdfa322f661 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Va=C5=A1=C3=AD=C4=8Dek?=
 <mail@ondrejvasicek.cz>
Date: Wed, 13 Dec 2017 09:30:03 +0100
Subject: [PATCH 3/3] Adds dbmanager cache into an examle (#15337) [skip ci]

* Adds dbmanager cache into an examle

When I used the RBAC first time, I didn't know about the dbmanager caching. I was relaying on the examples only. Then I saw many queries in my logs and started searching to eventually find the cache property.
I think there isn't a situation, when someone doesn't use caching for dbmanager rbac, so i'ts very helpful to put it in the example above.
Hope I'm correct.
---
 docs/guide/security-authorization.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/guide/security-authorization.md b/docs/guide/security-authorization.md
index cb8e06b300..ba31a751f8 100644
--- a/docs/guide/security-authorization.md
+++ b/docs/guide/security-authorization.md
@@ -225,6 +225,8 @@ return [
     'components' => [
         'authManager' => [
             'class' => 'yii\rbac\DbManager',
+            // uncomment if you want to cache RBAC items hierarchy
+            // 'cache' => 'cache',
         ],
         // ...
     ],