Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitcd33ed0

Browse files
committed
[WebProfilerBundle] Fix CORS ajax security issues
1 parenteb23f05 commitcd33ed0

File tree

6 files changed

+21
-8
lines changed

6 files changed

+21
-8
lines changed

‎src/Symfony/Bundle/WebProfilerBundle/DependencyInjection/Configuration.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ public function getConfigTreeBuilder()
4545
->end()
4646
->end()
4747
->booleanNode('intercept_redirects')->defaultFalse()->end()
48+
->booleanNode('enable_cors')->defaultFalse()->end()
4849
->scalarNode('excluded_ajax_paths')->defaultValue('^/(app(_[\\w]+)?\\.php/)?_wdt')->end()
4950
->end()
5051
;

‎src/Symfony/Bundle/WebProfilerBundle/DependencyInjection/WebProfilerExtension.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ public function load(array $configs, ContainerBuilder $container)
4949
if ($config['toolbar'] ||$config['intercept_redirects']) {
5050
$loader->load('toolbar.xml');
5151
$container->getDefinition('web_profiler.debug_toolbar')->replaceArgument(5,$config['excluded_ajax_paths']);
52+
$container->getDefinition('web_profiler.debug_toolbar')->replaceArgument(6,$config['enable_cors']);
5253
$container->setParameter('web_profiler.debug_toolbar.intercept_redirects',$config['intercept_redirects']);
5354
$container->setParameter('web_profiler.debug_toolbar.mode',$config['toolbar'] ? WebDebugToolbarListener::ENABLED : WebDebugToolbarListener::DISABLED);
5455
}

‎src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,17 @@ class WebDebugToolbarListener implements EventSubscriberInterface
4040
protected$mode;
4141
protected$position;
4242
protected$excludedAjaxPaths;
43+
protected$enableCors;
4344

44-
publicfunction__construct(\Twig_Environment$twig,$interceptRedirects =false,$mode =self::ENABLED,$position ='bottom',UrlGeneratorInterface$urlGenerator =null,$excludedAjaxPaths ='^/bundles|^/_wdt')
45+
publicfunction__construct(\Twig_Environment$twig,$interceptRedirects =false,$mode =self::ENABLED,$position ='bottom',UrlGeneratorInterface$urlGenerator =null,$excludedAjaxPaths ='^/bundles|^/_wdt',$enableCors =false)
4546
{
4647
$this->twig =$twig;
4748
$this->urlGenerator =$urlGenerator;
4849
$this->interceptRedirects = (bool)$interceptRedirects;
4950
$this->mode = (int)$mode;
5051
$this->position =$position;
5152
$this->excludedAjaxPaths =$excludedAjaxPaths;
53+
$this->enableCors =$enableCors;
5254
}
5355

5456
publicfunctionisEnabled()
@@ -123,6 +125,7 @@ protected function injectToolbar(Response $response, Request $request)
123125
'excluded_ajax_paths' =>$this->excludedAjaxPaths,
124126
'token' =>$response->headers->get('X-Debug-Token'),
125127
'request' =>$request,
128+
'enable_cors' =>$this->enableCors,
126129
)
127130
))."\n";
128131
$content =substr($content,0,$pos).$toolbar.substr($content,$pos);

‎src/Symfony/Bundle/WebProfilerBundle/Resources/config/toolbar.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
<argument>%web_profiler.debug_toolbar.position%</argument>
1818
<argumenttype="service"id="router"on-invalid="ignore" />
1919
<argument /><!-- paths that should be excluded from the AJAX requests shown in the toolbar-->
20+
<argument /><!-- enable CORS AJAX requests shown in the toolbar-->
2021
</service>
2122
</services>
2223
</container>

‎src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base_js.html.twig‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,12 +208,15 @@
208208
{%if excluded_ajax_paths is defined%}
209209
if (window.XMLHttpRequest&&XMLHttpRequest.prototype.addEventListener) {
210210
var proxied=XMLHttpRequest.prototype.open;
211+
var enable_cors= {{ enable_cors?'true':'false' }};
211212
212213
XMLHttpRequest.prototype.open=function(method,url,async,user,pass) {
213214
varself=this;
214215
215216
/* prevent logging AJAX calls to static and inline files, like templates*/
216217
var path= url;
218+
var is_cors_request=false;
219+
217220
if (url.substr(0,1)==='/') {
218221
if (0===url.indexOf('{{ request.basePath|e('js') }}')) {
219222
path=url.substr({{request.basePath|length }});
@@ -222,8 +225,11 @@
222225
elseif (0===url.indexOf('{{ (request.schemeAndHttpHost ~ request.basePath)|e('js') }}')) {
223226
path=url.substr({{ (request.schemeAndHttpHost~request.basePath)|length }});
224227
}
228+
elseif (!enable_cors) {
229+
is_cors_request=true;
230+
}
225231
226-
if (!path.match(newRegExp({{ excluded_ajax_paths|json_encode|raw }}))) {
232+
if ((!is_cors_request|| enable_cors)&&!path.match(newRegExp({{ excluded_ajax_paths|json_encode|raw }}))) {
227233
var stackElement= {
228234
loading:true,
229235
error:false,

‎src/Symfony/Bundle/WebProfilerBundle/Tests/DependencyInjection/ConfigurationTest.php‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,13 @@ public function testConfigTree($options, $results)
3131
publicfunctiongetDebugModes()
3232
{
3333
returnarray(
34-
array(array(),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt')),
35-
array(array('intercept_redirects' =>true),array('intercept_redirects' =>true,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt')),
36-
array(array('intercept_redirects' =>false),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt')),
37-
array(array('toolbar' =>true),array('intercept_redirects' =>false,'toolbar' =>true,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt')),
38-
array(array('position' =>'top'),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'top','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt')),
39-
array(array('excluded_ajax_paths' =>'test'),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'test')),
34+
array(array(),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt','enable_cors' =>false)),
35+
array(array('intercept_redirects' =>true),array('intercept_redirects' =>true,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt','enable_cors' =>false)),
36+
array(array('intercept_redirects' =>false),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt','enable_cors' =>false)),
37+
array(array('toolbar' =>true),array('intercept_redirects' =>false,'toolbar' =>true,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt','enable_cors' =>false)),
38+
array(array('position' =>'top'),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'top','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt','enable_cors' =>false)),
39+
array(array('excluded_ajax_paths' =>'test'),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'test','enable_cors' =>false)),
40+
array(array('enable_cors' =>true),array('intercept_redirects' =>false,'toolbar' =>false,'position' =>'bottom','excluded_ajax_paths' =>'^/(app(_[\\w]+)?\\.php/)?_wdt','enable_cors' =>true)),
4041
);
4142
}
4243
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp