Merge branch '1.3.x'

Conflicts:
	Changelog.md
	Upgrade.md

Author: stof

Changelog.md

@@ -9,6 +9,17 @@ Changelog
 * [BC break] Changed Datetime properties of default User entity that were nullable to default to null when no value supplied
 * [BC break] Updated schema.xml for Propel BaseUser class to allow nullable and typehint accordingly
 
+### 1.3.5 (2014-09-04)
+
+This release fixes a security issue. You are encouraged to update
+as soon as possible.
+
+BC break: The characters used in generated tokens have changed. They
+now include dashes and underscores as well. Any routing requirement
+matching them should be updated to ``[\w\-]+``.
+
+* Fixed the TokenGenerator to preserve entropy.
+
 ### 1.3.4 (2014-06-13)
 
 * Fixed the compatibility with FrameworkBundle 2.5

Upgrade.md

@@ -8,7 +8,7 @@ break. For the full list of changes, please look at the Changelog file.
 
 ### User Provider
 
-Using the UserManager as a user provider is no longer supported and is 
+Using the UserManager as a user provider is no longer supported and is
 deprecated. Change your security.yml's provider section to look like:
 
 ```yml
@@ -28,6 +28,30 @@ Document namespaces are deprecated, you should update your User and Group
 classes to extend the classes found in `Model`.
 The old classes will stay until 2.0 is released stable, but throw deprecated warnings.
 
+## 1.3.4 to 1.3.5
+
+The characters used in generated tokens have changed. They now include dashes
+and underscores as well. Any routing requirement matching them should be
+updated to ``[\w\-]+``.
+
+Before:
+
+```yaml
+my_route:
+    path: /{token}
+    requirement:
+        token: \w+
+```
+
+After:
+
+```yaml
+my_route:
+    path: /{token}
+    requirement:
+        token: '[\w\-]+'
+```
+
 ## 1.2 to 1.3
 
 ### Forms