8000 Merge branch '3.4' into 4.0 · symfony/symfony@3a8ea58 · GitHub
[go: up one dir, main page]
Skip to content

Commit 3a8ea58

Browse files
fabpotfabpot
committed
Merge branch '3.4' into 4.0
* 3.4: [Security] Adding a GuardAuthenticatorHandler alias fixed tests moved method to function marked method as being internal Disallow viewing dot-files in Profiler
2 parents 8849fb9 + 4ae47e0 commit 3a8ea58

File tree

5 files changed

+50
-9
lines changed

5 files changed

+50
-9
lines changed

‎src/Symfony/Bridge/Twig/Extension/FormExtension.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -73,15 +73,10 @@ public function getTests()
7373
{
7474
return array(
7575
new TwigTest('selectedchoice', 'Symfony\Bridge\Twig\Extension\twig_is_selected_choice'),
76-
new TwigTest('rootform', array($this, 'isRootForm')),
76+
new TwigTest('rootform', 'Symfony\Bridge\Twig\Extension\twig_is_root_form'),
7777
);
7878
}
7979

80-
public function isRootForm(FormView $formView)
81-
{
82-
return null === $formView->parent;
83-
}
84-
8580
/**
8681
* {@inheritdoc}
8782
*/
@@ -110,3 +105,11 @@ function twig_is_selected_choice(ChoiceView $choice, $selectedValue)
110105

111106
return $choice->value === $selectedValue;
112107
}
108+
109+
/**
110+
* @internal
111+
*/
112+
function twig_is_root_form(FormView $formView)
113+
{
114+
return null === $formView->parent;
115+
}

‎src/Symfony/Bridge/Twig/Tests/Extension/FormExtensionDivLayoutTest.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,8 +162,7 @@ public function isRootFormProvider()
162162
*/
163163
public function testIsRootForm($expected, FormView $formView)
164164
{
165-
$extension = new FormExtension();
166-
$this->assertSame($expected, $extension->isRootForm($formView));
165+
$this->assertSame($expected, twig_is_root_form($formView));
167166
}
168167

169168
protected function renderForm(FormView $view, array $vars = array())

‎src/Symfony/Bundle/SecurityBundle/Resources/config/guard.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
<argument type="service" id="security.token_storage" />
1414
<argument type="service" id="event_dispatcher" on-invalid="null" />
1515
</service>
16+
17+
<service id="Symfony\Component\Security\Guard\GuardAuthenticatorHandler" alias="security.authentication.guard_handler" />
1618

1719
<!-- See GuardAuthenticationFactory -->
1820
<service id="security.authentication.provider.guard"

‎src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -368,7 +368,7 @@ public function openAction(Request $request)
368368

369369
$filename = $this->baseDir.DIRECTORY_SEPARATOR.$file;
370370

371-
if (preg_match("'(^|[/\\\\])\.\.?([/\\\\]|$)'", $file) || !is_readable($filename)) {
371+
if (preg_match("'(^|[/\\\\])\.'", $file) || !is_readable($filename)) {
372372
throw new NotFoundHttpException(sprintf('The file "%s" cannot be opened.', $file));
373373
}
374374

‎src/Symfony/Bundle/WebProfilerBundle/Tests/Controller/ProfilerControllerTest.php

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Bundle\WebProfilerBundle\Controller\ProfilerController;
1616
use Symfony\Bundle\WebProfilerBundle\Csp\ContentSecurityPolicyHandler;
17+
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
1718
use Symfony\Component\HttpKernel\Profiler\Profile;
1819
use Symfony\Component\HttpFoundation\Request;
1920

@@ -46,6 +47,42 @@ public function getEmptyTokenCases()
4647
);
4748
}
4849

50+
/**
51+
* @dataProvider getOpenFileCases
52+
*/
53+
public function testOpeningDisallowedPaths($path, $isAllowed)
54+
{
55+
$urlGenerator = $this->getMockBuilder('Symfony\Component\Routing\Generator\UrlGeneratorInterface')->getMock();
56+
$twig = $this->getMockBuilder('Twig\Environment')->disableOriginalConstructor()->getMock();
57+
$profiler = $this
58+
->getMockBuilder('Symfony\Component\HttpKernel\Profiler\Profiler')
59+
->disableOriginalConstructor()
60+
->getMock();
61+
62+
$controller = new ProfilerController($urlGenerator, $profiler, $twig, array(), 'bottom', null, __DIR__.'/../..');
63+
64+
try {
65+
$response = $controller->openAction(Request::create('/_wdt/open', Request::METHOD_GET, array('file' => $path)));
66+
$this->assertEquals(200, $response->getStatusCode());
67+
$this->assertTrue($isAllowed);
68+
} catch (NotFoundHttpException $e) {
69+
$this->assertFalse($isAllowed);
70+
}
71+
}
72+
73+
public function getOpenFileCases()
74+
{
75+
return array(
76+
array('README.md', true),
77+
array('composer.json', true),
78+
array('Controller/ProfilerController.php', true),
79+
array('.gitignore', false),
80+
array('../TwigBundle/README.md', false),
81+
array('Controller/../README.md', false),
82+
array('Controller/./ProfilerController.php', false),
83+
);
84+
}
85+
4986
/**
5087
* @dataProvider provideCspVariants
5188
*/

0 commit comments

Comments
 (0)
0