Merge pull request #167 from OpenConext/feature/security-updates

Perform security related chores

.travis.yml

@@ -21,11 +21,6 @@ cache:
 
 before_script:
   - phpenv config-add .travis.php.ini
-  # TODO: cleanup after FGA implementation!
-  # Use a travis composer.json version, that not uses the symlink solution for the middleware bundle, but an installation of a feature branch
-  - mv composer.json.travis composer.json
-  - mv composer.lock.travis composer.lock
-  # TODO: end of FGA specific build settings
   - composer self-update
   - composer install --prefer-dist
 

build.xml

@@ -2,7 +2,7 @@
 
 <project name="StepupSelfService-ci" default="build">
         <target name="build"
-            depends="php-lint-ci,phpmd-ci,phpcs-ci,phpcpd-ci,phpunit-ci"/>
+            depends="php-lint-ci,phpmd-ci,phpcs-ci,phpcpd-ci,phpunit-ci,security-tests"/>
 
     <target name="get-changeset.php.raw"
             description="creates a list of changed php files separated by newline">
@@ -82,4 +82,9 @@
         </exec>
     </target>
 
+    <target name="security-tests">
+        <exec executable="vendor/bin/security-checker" failonerror="true">
+            <arg line="security:check" />
+        </exec>
+    </target>
 </project>

composer.json

@@ -42,9 +42,8 @@
     "phpmd/phpmd": "^2.6",
     "phpunit/phpunit": "^5.7",
     "sebastian/exporter": "~2.0",
-    "sensiolabs/security-checker": "^3.0",
     "sebastian/phpcpd": "^2.0",
-    "squizlabs/php_codesniffer": "^1.0",
+    "squizlabs/php_codesniffer": "^3.4",
     "symfony/phpunit-bridge": "^3.0"
   },
   "scripts": {