- What is Symfony?
- Get started
- Documentation
- Community
- Services
-
News
Latest News
What happened last week in Symfony?
This week, Symfony 2.3.0 released its second and last beta version. Among other features, this version supports the interactive management of the parameters.yml file and some nice improvements for the Console component. In addition, the Symfony 2.1.10 maintainance version and the Twig 1.13.0 version were released.
Upcoming EventsThe Symfony Community organizes events all over the world on a regular basis. Here are the next ones.
United States, Portland — SymfonyLive Portland 2013
from May 20, 2013 to May 24, 2013
Netherlands, Utrecht — Symfony Meetup - Netherlands/Utrecht
on May 22, 2013, from 19:00 to 22:00
France, Montpellier — eZ UnConference #2
from May 27, 2013 to May 29, 2013
Germany, München — Symfony User Group München
on June 05, 2013, from 18:30 to 22:30 - About
Archives
Master Symfony2 fundamentals
Symfony hosting done right
Discover the SensioLabs Support
Security: Access Control Documentation Issue
by
Fabien Potencier
– January 10, 2013
– 3 comments
Please, read this post carefully as your application may be vulnerable if
you are using access control rules to secure some paths or ESI/Hincludes via
the _internal routes.
We have recently discovered that the documentation for access control rules was incorrect. Thanks to Victor Berchet for reporting this issue.
This is a serious problem as these access control rules let you secure some
parts of your application; it is even worse as the example in the
security.yml file in the Symfony Standard Edition was also incorrect.
To make a long story short, using the ip setting in an access rule does
not restrict the path to be accessible only for the given IP address:
1 2 | access_control:
- { path: ^/_internal, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 }
|
The above rule does not restrict access to localhost (127.0.0.1) for
requests whose path start with /_internal. If you want paths starting with
/_internal to be only accessible from localhost, use the following
configuration instead:
1 2 3 | access_control:
- { path: ^/_internal, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 }
- { path: ^/_internal, roles: ROLE_NO_ACCESS }
|
If you want to learn more about how access control rules work, read the updated documentation, or have a look at the patch we have just pushed. The example in the Symfony Standard Edition has also been updated accordingly.
The documentation update is only the first step towards the resolution of this issue as the way access control rules can be configured is very confusing. We are working on improving access control rules configuration for Symfony 2.3.
NEWS FROM THE BLOG
IN THE NEWS
is a trademark of Fabien Potencier. All rights reserved.
Add a Comment
Comments
I agree with Bernhard that this should be listed in the "Security Advisories" at symfony.com/security.