Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[DI] Fix reading env vars from fastcgi params#23899

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
nicolas-grekas merged 1 commit intosymfony:3.3fromnicolas-grekas:di-fix
Aug 17, 2017

Conversation

@nicolas-grekas
Copy link
Member

QA
Branch?3.3
Bug fix?yes
New feature?no
BC breaks?no
Deprecations?no
Tests pass?yes
Fixed tickets#23348
LicenseMIT
Doc PR-

Values in fastcgi_param populate$_SERVER, never$_ENV.
This PR makes$container->getEnv() read from$_SERVER, excluding any vars whose name start byHTTP_ as that would be a security issue (values injection via HTTP headers.)

Embeds a few other fixes found meanwhile.

@nicolas-grekasnicolas-grekasforce-pushed thedi-fix branch 2 times, most recently fromd829791 to8477c91CompareAugust 16, 2017 12:45
@nicolas-grekas
Copy link
MemberAuthor

Merging to unlock other PRs.
But review still welcomed.

@nicolas-grekasnicolas-grekas merged commitadff65a intosymfony:3.3Aug 17, 2017
nicolas-grekas added a commit that referenced this pull requestAug 17, 2017
…kas)This PR was merged into the 3.3 branch.Discussion----------[DI] Fix reading env vars from fastcgi params| Q             | A| ------------- | ---| Branch?       | 3.3| Bug fix?      | yes| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets |#23348| License       | MIT| Doc PR        | -Values in fastcgi_param populate `$_SERVER`, never `$_ENV`.This PR makes `$container->getEnv()` read from `$_SERVER`, excluding any vars whose name start by `HTTP_` as that would be a security issue (values injection via HTTP headers.)Embeds a few other fixes found meanwhile.Commits-------adff65a [DI] Fix reading env vars from fastcgi params
@nicolas-grekasnicolas-grekas deleted the di-fix branchAugust 17, 2017 12:10
@fabpotfabpot mentioned this pull requestAug 28, 2017
fabpot added a commit that referenced this pull requestSep 7, 2017
This PR was merged into the 3.4 branch.Discussion----------[DI] Allow processing env vars| Q             | A| ------------- | ---| Branch?       | 3.4| Bug fix?      | no| New feature?  | yes| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | see description| License       | MIT| Doc PR        | -This PR is an updated version of#20276 ~~(it embeds#23899 for now.)~~It superscedes/closes:- [DI] Add support for secrets#23621 ping@dunglas- Runtime container parameter not found event filter#23669 ping@marfillaster- [DependencyInjection] [DX] Support for JSON string environment variables#23823 ping@Pierstoval- add support for composite environment variables#17689 ping@greg0ire- [DI] ENV parameters at runtime with PHP 7 strict types not working properly#20434 ping@sandrokeil- Issue when using a SQLite database and the DATABASE_URL env var#23527 ping@javiereguiluz#22151 is another story, so not fixed here.The way it works is via `%env(foo:BAR)%` prefixes, where "foo" can be bound to any services you'd like.By default, the following prefixes are supported:- `bool`, `int`, `float`, `string`, `base64`- `const` (for referencing PHP constants)- `json` (supporting only json **arrays** for type predictability)- `file` (eg for access to secrets stored in files.)- `resolve` (for processing parameters inside env vars.)New prefixes can be added by implementing the new `EnvProviderInterface`, and tagging with `container.env_provider` (see `Rot13EnvProvider` in tests.)Prefixes can be combined to chain processing, eg.`%env(json:base64:file:FOO)%` will be roughly equivalent to`json_decode(base64_decode(file_get_content(getenv('FOO'))))`.Commits-------1f92e45 [DI] Allow processing env vars
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

1 more reviewer

@ro0NLro0NLro0NL approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Projects

None yet

Milestone

3.3

Development

Successfully merging this pull request may close these issues.

3 participants

@nicolas-grekas@ro0NL@carsonbot

[8]ページ先頭

©2009-2025 Movatter.jp