Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit5befc45

Browse files
committed
Merge branch '2.5' into 2.6
* 2.5: fixing bad link Fixing bad merge - this section should not have been left in [#4651] Fixing build error Update by_reference.rst.inc Added a lot of changes suggested by reviewers Added a note about the SensioDistributionBundle necessary for security:check Added a note about the security:check command Added a missing link reference Added a note about the security advisories database This command is available sin Symfony 2.5 Documented the security:check command
2 parents3470c87 +4d848d7 commit5befc45

File tree

4 files changed

+54
-3
lines changed

4 files changed

+54
-3
lines changed

‎book/installation.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,18 @@ them all at once:
287287
Depending on the complexity of your project, this update process can take up to
288288
several minutes to complete.
289289

290+
..tip::
291+
292+
Symfony provides a command to check whether your project's dependencies
293+
contain any know security vulnerability:
294+
295+
..code-block::bash
296+
297+
$ php app/console security:check
298+
299+
A good security practice is to execute this command regularly to be able to
300+
update or replace compromised dependencies as soon as possible.
301+
290302
.. _installing-a-symfony2-distribution:
291303

292304
Installing a Symfony Distribution

‎book/security.rst‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1298,6 +1298,36 @@ cookie will be ever created by Symfony):
12981298
If you use a form login, Symfony will create a cookie even if you set
12991299
``stateless`` to ``true``.
13001300

1301+
.. _book-security-checking-vulnerabilities:
1302+
1303+
Checking for Known Security Vulnerabilities in Dependencies
1304+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1305+
1306+
..versionadded::2.5
1307+
The ``security:check`` command was introduced in Symfony 2.5. This command is
1308+
included in ``SensioDistributionBundle``, which has to be registered in your
1309+
application in order to use this command.
1310+
1311+
When using lots of dependencies in your Symfony projects, some of them may
1312+
contain security vulnerabilities. That's why Symfony includes a command called
1313+
``security:check`` that checks your ``composer.lock`` file to find any known
1314+
security vulnerability in your installed dependencies:
1315+
1316+
..code-block::bash
1317+
1318+
$ php app/console security:check
1319+
1320+
A good security practice is to execute this command regularly to be able to
1321+
update or replace compromised dependencies as soon as possible. Internally,
1322+
this command uses the public `security advisories database`_ published by the
1323+
FriendsOfPHP organization.
1324+
1325+
..tip::
1326+
1327+
The ``security:check`` command terminates with a non-zero exit code if
1328+
any of your dependencies is affected by a known security vulnerability.
1329+
Therefore, you can easily integrate it in your build process.
1330+
13011331
Final Words
13021332
-----------
13031333

@@ -1326,3 +1356,4 @@ Learn more from the Cookbook
13261356

13271357
.. _`online tool`:https://www.dailycred.com/blog/12/bcrypt-calculator
13281358
.. _`frameworkextrabundle documentation`:http://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/index.html
1359+
.. _`security advisories database`:https://github.com/FriendsOfPHP/security-advisories

‎contributing/code/security.rst‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ confirmed, the core-team works on a solution following these steps:
3838
#. Publish the post on the official Symfony `blog`_ (it must also be added to
3939
the "`Security Advisories`_" category);
4040
#. Update the security advisory list (see below).
41+
#. Update the public `security advisories database`_ maintained by the
42+
FriendsOfPHP organization and which is used by the ``security:check`` command.
4143

4244
..note::
4345

@@ -93,6 +95,11 @@ of the downstream projects included in this process:
9395
Security Advisories
9496
-------------------
9597

98+
..tip::
99+
100+
You can check your Symfony application for known security vulnerabilities
101+
using the ``security:check`` command. See:ref:`book-security-checking-vulnerabilities`.
102+
96103
This section indexes security vulnerabilities that were fixed in Symfony
97104
releases, starting from Symfony 1.0.0:
98105

@@ -119,6 +126,7 @@ releases, starting from Symfony 1.0.0:
119126
* March 21, 2008: `symfony 1.0.12 is (finally) out !<http://symfony.com/blog/symfony-1-0-12-is-finally-out>`_
120127
* June 25, 2007: `symfony 1.0.5 released (security fix)<http://symfony.com/blog/symfony-1-0-5-released-security-fix>`_
121128

122-
.. _Git repository:https://github.com/symfony/symfony
123-
.. _blog:http://symfony.com/blog/
129+
.. _Git repository:https://github.com/symfony/symfony
130+
.. _blog:http://symfony.com/blog/
124131
.. _Security Advisories:http://symfony.com/blog/category/security-advisories
132+
.. _`security advisories database`:https://github.com/FriendsOfPHP/security-advisories

‎reference/forms/types/options/by_reference.rst.inc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,4 @@ call the setter on the parent object.
4242
Similarly, if you're using the :doc:`collection</reference/forms/types/collection>`
4343
form type where your underlying collection data is an object (like with Doctrine's
4444
``ArrayCollection``), then ``by_reference`` must be set to ``false`` if you
45-
need thesetter(e.g. ``setAuthors()``) to be called.
45+
need theadder and remover(e.g. ``addAuthor()`` and ``removeAuthor()``) to be called.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp