Skip to content

Commit c09b005

Browse files
javiereguiluzjaviereguiluz
committedMar 18, 2024
Merge branch '5.4' into 6.4
* 5.4: [Security] Replace a complex table by a list Remove the report section Use Doctor RST 1.57.1
2 parents 1ec5ca2 + 14c50b0 commit c09b005

File tree

4 files changed

+46
-37
lines changed

4 files changed

+46
-37
lines changed
 

‎.doctor-rst.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ rules:
1414
ensure_bash_prompt_before_composer_command: ~
1515
ensure_exactly_one_space_before_directive_type: ~
1616
ensure_exactly_one_space_between_link_definition_and_link: ~
17+
ensure_github_directive_start_with_prefix:
18+
prefix: 'Symfony'
1719
ensure_link_bottom: ~
1820
ensure_link_definition_contains_valid_url: ~
1921
ensure_order_of_code_blocks_in_configuration_block: ~

‎.github/workflows/ci.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
key: ${{ runner.os }}-doctor-rst-${{ steps.extract_base_branch.outputs.branch }}
7474

7575
- name: "Run DOCtor-RST"
76-
uses: docker://oskarstark/doctor-rst:1.54.0
76+
uses: docker://oskarstark/doctor-rst:1.57.1
7777
with:
7878
args: --short --error-format=github --cache-file=/github/workspace/.cache/doctor-rst.cache
7979

‎contributing/code_of_conduct/care_team.rst

-9
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,3 @@ The :doc:`Symfony project leader </contributing/code/core_team>` appoints the CA
5858
team with candidates they see fit. The CARE team will consist of at least
5959
3 people. The team should be representing as many demographics as possible,
6060
ideally from different employers.
61-
62-
CARE Team Transparency Reports
63-
------------------------------
64-
65-
The CARE team publishes a transparency report at the end of each year:
66-
67-
* `Symfony Code of Conduct Transparency Report 2018`_.
68-
69-
.. _`Symfony Code of Conduct Transparency Report 2018`: https://symfony.com/blog/symfony-code-of-conduct-transparency-report-2018

‎security/access_control.rst

+43-27
Original file line numberDiff line numberDiff line change
@@ -177,33 +177,49 @@ For each incoming request, Symfony will decide which ``access_control``
177177
to use based on the URI, the client's IP address, the incoming host name,
178178
and the request method. Remember, the first rule that matches is used, and
179179
if ``ip``, ``port``, ``host`` or ``method`` are not specified for an entry, that
180-
``access_control`` will match any ``ip``, ``port``, ``host`` or ``method``:
181-
182-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
183-
| URI | IP | PORT | HOST | METHOD | ``access_control`` | Why? |
184-
+=================+=============+=============+=============+============+================================+=============================================================+
185-
| ``/admin/user`` | 127.0.0.1 | 80 | example.com | GET | rule #2 (``ROLE_USER_IP``) | The URI matches ``path`` and the IP matches ``ip``. |
186-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
187-
| ``/admin/user`` | 127.0.0.1 | 80 | symfony.com | GET | rule #2 (``ROLE_USER_IP``) | The ``path`` and ``ip`` still match. This would also match |
188-
| | | | | | | the ``ROLE_USER_HOST`` entry, but *only* the **first** |
189-
| | | | | | | ``access_control`` match is used. |
190-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
191-
| ``/admin/user`` | 127.0.0.1 | 8080 | symfony.com | GET | rule #1 (``ROLE_USER_PORT``) | The ``path``, ``ip`` and ``port`` match. |
192-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
193-
| ``/admin/user`` | 168.0.0.1 | 80 | symfony.com | GET | rule #3 (``ROLE_USER_HOST``) | The ``ip`` doesn't match neither the first rule nor the |
194-
| | | | | | | second rule. So the third rule (which matches) is used. |
195-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
196-
| ``/admin/user`` | 168.0.0.1 | 80 | symfony.com | POST | rule #3 (``ROLE_USER_HOST``) | The third rule still matches. This would also match the |
197-
| | | | | | | fourth rule (``ROLE_USER_METHOD``), but only the **first** |
198-
| | | | | | | matched ``access_control`` is used. |
199-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
200-
| ``/admin/user`` | 168.0.0.1 | 80 | example.com | POST | rule #4 (``ROLE_USER_METHOD``) | The ``ip`` and ``host`` don't match the first three |
201-
| | | | | | | entries, but the fourth - ``ROLE_USER_METHOD`` - matches |
202-
| | | | | | | and is used. |
203-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
204-
| ``/foo`` | 127.0.0.1 | 80 | symfony.com | POST | matches no entries | This doesn't match any ``access_control`` rules, since its |
205-
| | | | | | | URI doesn't match any of the ``path`` values. |
206-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
180+
``access_control`` will match any ``ip``, ``port``, ``host`` or ``method``.
181+
See the following examples:
182+
183+
Example #1:
184+
* **URI** ``/admin/user``
185+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``example.com``, **Method**: ``GET``
186+
* **Rule applied**: rule #2 (``ROLE_USER_IP``)
187+
* **Why?** The URI matches ``path`` and the IP matches ``ip``.
188+
Example #2:
189+
* **URI** ``/admin/user``
190+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``GET``
191+
* **Rule applied**: rule #2 (``ROLE_USER_IP``)
192+
* **Why?** The ``path`` and ``ip`` still match. This would also match the
193+
``ROLE_USER_HOST`` entry, but *only* the **first** ``access_control`` match is used.
194+
Example #3:
195+
* **URI** ``/admin/user``
196+
* **IP**: ``127.0.0.1``, **Port**: ``8080``, **Host**: ``symfony.com``, **Method**: ``GET``
197+
* **Rule applied**: rule #1 (``ROLE_USER_PORT``)
198+
* **Why?** The ``path``, ``ip`` and ``port`` match.
199+
Example #4:
200+
* **URI** ``/admin/user``
201+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``GET``
202+
* **Rule applied**: rule #3 (``ROLE_USER_HOST``)
203+
* **Why?** The ``ip`` doesn't match neither the first rule nor the second rule.
204+
* So the third rule (which matches) is used.
205+
Example #5:
206+
* **URI** ``/admin/user``
207+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``POST``
208+
* **Rule applied**: rule #3 (``ROLE_USER_HOST``)
209+
* **Why?** The third rule still matches. This would also match the fourth rule
210+
* (``ROLE_USER_METHOD``), but only the **first** matched ``access_control`` is used.
211+
Example #6:
212+
* **URI** ``/admin/user``
213+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``example.com``, **Method**: ``POST``
214+
* **Rule applied**: rule #4 (``ROLE_USER_METHOD``)
215+
* **Why?** The ``ip`` and ``host`` don't match the first three entries, but
216+
* the fourth - ``ROLE_USER_METHOD`` - matches and is used.
217+
Example #7:
218+
* **URI** ``/foo``
219+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``POST``
220+
* **Rule applied**: matches no entries
221+
* **Why?** This doesn't match any ``access_control`` rules, since its URI
222+
* doesn't match any of the ``path`` values.
207223

208224
.. caution::
209225

0 commit comments

Comments
 (0)
Please sign in to comment.