Skip to content

Commit b9b4231

Browse files
javiereguiluzjaviereguiluz
committed
Merge branch '7.0' into 7.1
* 7.0: [Security] Replace a complex table by a list Remove the report section Use Doctor RST 1.57.1
2 parents 20d1118 + 0d6b83f commit b9b4231

File tree

4 files changed

+46
-37
lines changed

4 files changed

+46
-37
lines changed

‎.doctor-rst.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ rules:
1414
ensure_bash_prompt_before_composer_command: ~
1515
ensure_exactly_one_space_before_directive_type: ~
1616
ensure_exactly_one_space_between_link_definition_and_link: ~
17+
ensure_github_directive_start_with_prefix:
18+
prefix: 'Symfony'
1719
ensure_link_bottom: ~
1820
ensure_link_definition_contains_valid_url: ~
1921
ensure_order_of_code_blocks_in_configuration_block: ~

‎.github/workflows/ci.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
key: ${{ runner.os }}-doctor-rst-${{ steps.extract_base_branch.outputs.branch }}
7474

7575
- name: "Run DOCtor-RST"
76-
uses: docker://oskarstark/doctor-rst:1.54.0
76+
uses: docker://oskarstark/doctor-rst:1.57.1
7777
with:
7878
args: --short --error-format=github --cache-file=/github/workspace/.cache/doctor-rst.cache
7979

‎contributing/code_of_conduct/care_team.rst‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,3 @@ The :doc:`Symfony project leader </contributing/code/core_team>` appoints the CA
5858
team with candidates they see fit. The CARE team will consist of at least
5959
3 people. The team should be representing as many demographics as possible,
6060
ideally from different employers.
61-
62-
CARE Team Transparency Reports
63-
------------------------------
64-
65-
The CARE team publishes a transparency report at the end of each year:
66-
67-
* `Symfony Code of Conduct Transparency Report 2018`_.
68-
69-
.. _`Symfony Code of Conduct Transparency Report 2018`: https://symfony.com/blog/symfony-code-of-conduct-transparency-report-2018

‎security/access_control.rst‎

Lines changed: 43 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -169,33 +169,49 @@ For each incoming request, Symfony will decide which ``access_control``
169169
to use based on the URI, the client's IP address, the incoming host name,
170170
and the request method. Remember, the first rule that matches is used, and
171171
if ``ip``, ``port``, ``host`` or ``method`` are not specified for an entry, that
172-
``access_control`` will match any ``ip``, ``port``, ``host`` or ``method``:
173-
174-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
175-
| URI | IP | PORT | HOST | METHOD | ``access_control`` | Why? |
176-
+=================+=============+=============+=============+============+================================+=============================================================+
177-
| ``/admin/user`` | 127.0.0.1 | 80 | example.com | GET | rule #2 (``ROLE_USER_IP``) | The URI matches ``path`` and the IP matches ``ip``. |
178-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
179-
| ``/admin/user`` | 127.0.0.1 | 80 | symfony.com | GET | rule #2 (``ROLE_USER_IP``) | The ``path`` and ``ip`` still match. This would also match |
180-
| | | | | | | the ``ROLE_USER_HOST`` entry, but *only* the **first** |
181-
| | | | | | | ``access_control`` match is used. |
182-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
183-
| ``/admin/user`` | 127.0.0.1 | 8080 | symfony.com | GET | rule #1 (``ROLE_USER_PORT``) | The ``path``, ``ip`` and ``port`` match. |
184-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
185-
| ``/admin/user`` | 168.0.0.1 | 80 | symfony.com | GET | rule #3 (``ROLE_USER_HOST``) | The ``ip`` doesn't match neither the first rule nor the |
186-
| | | | | | | second rule. So the third rule (which matches) is used. |
187-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
188-
| ``/admin/user`` | 168.0.0.1 | 80 | symfony.com | POST | rule #3 (``ROLE_USER_HOST``) | The third rule still matches. This would also match the |
189-
| | | | | | | fourth rule (``ROLE_USER_METHOD``), but only the **first** |
190-
| | | | | | | matched ``access_control`` is used. |
191-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
192-
| ``/admin/user`` | 168.0.0.1 | 80 | example.com | POST | rule #4 (``ROLE_USER_METHOD``) | The ``ip`` and ``host`` don't match the first three |
193-
| | | | | | | entries, but the fourth - ``ROLE_USER_METHOD`` - matches |
194-
| | | | | | | and is used. |
195-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
196-
| ``/foo`` | 127.0.0.1 | 80 | symfony.com | POST | matches no entries | This doesn't match any ``access_control`` rules, since its |
197-
| | | | | | | URI doesn't match any of the ``path`` values. |
198-
+-----------------+-------------+-------------+-------------+------------+--------------------------------+-------------------------------------------------------------+
172+
``access_control`` will match any ``ip``, ``port``, ``host`` or ``method``.
173+
See the following examples:
174+
175+
Example #1:
176+
* **URI** ``/admin/user``
177+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``example.com``, **Method**: ``GET``
178+
* **Rule applied**: rule #2 (``ROLE_USER_IP``)
179+
* **Why?** The URI matches ``path`` and the IP matches ``ip``.
180+
Example #2:
181+
* **URI** ``/admin/user``
182+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``GET``
183+
* **Rule applied**: rule #2 (``ROLE_USER_IP``)
184+
* **Why?** The ``path`` and ``ip`` still match. This would also match the
185+
``ROLE_USER_HOST`` entry, but *only* the **first** ``access_control`` match is used.
186+
Example #3:
187+
* **URI** ``/admin/user``
188+
* **IP**: ``127.0.0.1``, **Port**: ``8080``, **Host**: ``symfony.com``, **Method**: ``GET``
189+
* **Rule applied**: rule #1 (``ROLE_USER_PORT``)
190+
* **Why?** The ``path``, ``ip`` and ``port`` match.
191+
Example #4:
192+
* **URI** ``/admin/user``
193+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``GET``
194+
* **Rule applied**: rule #3 (``ROLE_USER_HOST``)
195+
* **Why?** The ``ip`` doesn't match neither the first rule nor the second rule.
196+
* So the third rule (which matches) is used.
197+
Example #5:
198+
* **URI** ``/admin/user``
199+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``POST``
200+
* **Rule applied**: rule #3 (``ROLE_USER_HOST``)
201+
* **Why?** The third rule still matches. This would also match the fourth rule
202+
* (``ROLE_USER_METHOD``), but only the **first** matched ``access_control`` is used.
203+
Example #6:
204+
* **URI** ``/admin/user``
205+
* **IP**: ``168.0.0.1``, **Port**: ``80``, **Host**: ``example.com``, **Method**: ``POST``
206+
* **Rule applied**: rule #4 (``ROLE_USER_METHOD``)
207+
* **Why?** The ``ip`` and ``host`` don't match the first three entries, but
208+
* the fourth - ``ROLE_USER_METHOD`` - matches and is used.
209+
Example #7:
210+
* **URI** ``/foo``
211+
* **IP**: ``127.0.0.1``, **Port**: ``80``, **Host**: ``symfony.com``, **Method**: ``POST``
212+
* **Rule applied**: matches no entries
213+
* **Why?** This doesn't match any ``access_control`` rules, since its URI
214+
* doesn't match any of the ``path`` values.
199215

200216
.. caution::
201217

0 commit comments

Comments
 (0)