8000 added a global secret setting to configure CSRF, the temporary storag… · beenalee/symfony@e72f1a9 · GitHub
[go: up one dir, main page]
Skip to content

Commit e72f1a9

Browse files
fabpotfabpot
committed
added a global secret setting to configure CSRF, the temporary storage, and possibly more
1 parent 2291af4 commit e72f1a9

File tree

13 files changed

+29
-15
lines changed

13 files changed

+29
-15
lines changed

‎UPDATE.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,20 @@ timeline closely anyway.
99
PR12 to beta1
1010
-------------
1111

12+
* The CSRF secret configuration has been moved to a mandatory global `secret`
13+
setting (as the secret is now used for everything and not just CSRF):
14+
15+
Before:
16+
17+
framework:
18+
csrf_protection:
19+
secret: S3cr3t
20+
21+
After:
22+
23+
framework:
24+
secret: S3cr3t
25+
1226
* The `File::getWebPath()` and `File::rename()` methods have been removed, as
1327
well as the `framework.document_root` configuration setting.
1428

‎src/Symfony/Bundle/AsseticBundle/Tests/Resources/config/config.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
framework:
22
charset: UTF-8
33
error_handler: null
4+
secret: xxxxxxxxxx
45
csrf_protection:
56
enabled: true
6-
secret: xxxxxxxxxx
77
router: { resource: "%kernel.root_dir%/config/routing.yml" }
88
validation: { enabled: true, annotations: true }
99
templating: { engines: ['twig', 'php'] }

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ public function getConfigTreeBuilder()
3939
->children()
4040
->scalarNode('cache_warmer')->defaultValue(!$this->debug)->end()
4141
->scalarNode('charset')->end()
42+
->scalarNode('secret')->isRequired()->end()
4243
->scalarNode('error_handler')->end()
4344
->scalarNode('exception_controller')->defaultValue('Symfony\\Bundle\\FrameworkBundle\\Controller\\ExceptionController::showAction')->end()
4445
->scalarNode('ide')->defaultNull()->end()
@@ -69,7 +70,6 @@ private function addCsrfProtectionSection(ArrayNodeDefinition $rootNode)
6970
->children()
7071
->booleanNode('enabled')->defaultTrue()->end()
7172
->scalarNode('field_name')->defaultValue('_token')->end()
72-
->scalarNode('secret')->defaultValue('secret')->end()
7373
->end()
7474
->end()
7575
->end()

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ public function load(array $configs, ContainerBuilder $container)
6565
$container->setParameter('kernel.charset', $config['charset']);
6666
}
6767

68+
$container->setParameter('kernel.secret', $config['secret']);
69+
6870
if (isset($config['error_handler'])) {
6971
if (false === $config['error_handler']) {
7072
$container->getDefinition('error_handler')->setMethodCalls(array());
@@ -157,8 +159,6 @@ public function load(array $configs, ContainerBuilder $container)
157159
*/
158160
private function registerCsrfProtectionConfiguration(array $config, ContainerBuilder $container)
159161
{
160-
$container->getDefinition('form.csrf_provider')->replaceArgument(1, $config['secret']);
161-
162162
// FIXME: those are not used
163163
$container->setParameter('form.csrf_protection.field_name', $config['field_name']);
164164
$container->setParameter('form.csrf_protection.enabled', $config['enabled']);

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/form.xml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@
99
<parameter key="form.factory.class">Symfony\Component\Form\FormFactory</parameter>
1010
<parameter key="form.type_guesser.validator.class">Symfony\Component\Form\Extension\Validator\ValidatorTypeGuesser</parameter>
1111
<parameter key="form.csrf_provider.class">Symfony\Component\Form\Extension\Csrf\CsrfProvider\SessionCsrfProvider</parameter>
12-
1312
<parameter key="file.temporary_storage.class">Symfony\Component\HttpFoundation\File\SessionBasedTemporaryStorage</parameter>
14-
<parameter key="file.temporary_storage.secret">abcdef</parameter>
1513
</parameters>
1614

1715
<services>
@@ -56,13 +54,13 @@
5654
<!-- CsrfProvider -->
5755
<service id="form.csrf_provider" class="%form.csrf_provider.class%">
5856
<argument type="service" id="session" />
59-
<argument /> <!-- secret -->
57+
<argument>%kernel.secret%</argument>
6058
</service>
6159

6260
<!-- TemporaryStorage - where should we put this? -->
6361
<service id="file.temporary_storage" class="%file.temporary_storage.class%">
6462
<argument type="service" id="session" />
65-
<argument>%file.temporary_storage.secret%</argument>
63+
<argument>%kernel.secret%</argument>
6664
<argument>%kernel.cache_dir%/upload</argument>
6765
</service>
6866

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
<xsd:attribute name="error-handler" type="xsd:string" />
2525
<xsd:attribute name="exception-controller" type="xsd:string" />
2626
<xsd:attribute name="ide" type="xsd:string" />
27+
<xsd:attribute name="secret" type="xsd:string" />
2728
</xsd:complexType>
2829

2930
<xsd:simpleType name="cache_warmer">
@@ -37,7 +38,6 @@
3738
<xsd:complexType name="csrf_protection">
3839
<xsd:attribute name="enabled" type="xsd:boolean" />
3940
<xsd:attribute name="field-name" type="xsd:string" />
40-
<xsd:attribute name="secret" type="xsd:string" />
4141
</xsd:complexType>
4242

4343
<xsd:complexType name="esi">

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
<?php
22

33
$container->loadFromExtension('framework', array(
4+
'secret' => 's3cr3t',
45
'csrf_protection' => array(
56
'enabled' => true,
67
'field_name' => '_csrf',
7-
'secret' => 's3cr3t',
88
),
99
'esi' => array(
1010
'enabled' => true,

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/validation_annotations.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('framework', array(
4+
'secret' => 's3cr3t',
45
'validation' => array(
56
'enabled' => true,
67
'annotations' => array(

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
77
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
88

9-
<framework:config>
10-
<framework:csrf-protection enabled="true" field-name="_csrf" secret="s3cr3t" />
9+
<framework:config secret="s3cr3t">
10+
<framework:csrf-protection enabled="true" field-name="_csrf" />
1111
<framework:esi enabled="true" />
1212
<framework:profiler only-exceptions="true" />
1313
<framework:router cache-warmer="true" resource="%kernel.root_dir%/config/routing.xml" type="xml" />

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/validation_annotations.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
77
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
88

9-
<framework:config>
9+
<framework:config secret="s3cr3t">
1010
<framework:validation enabled="true" annotations="true">
1111
<framework:namespace prefix="app">Application\Validator\Constraints\</framework:namespace>
1212
</framework:validation>

0 commit comments

Comments
 (0)
0