From f5290b95a9eab7eff2857b9d824200dd43babdc9 Mon Sep 17 00:00:00 2001 From: Joseph Bielawski Date: Mon, 7 Jan 2013 09:41:41 +0100 Subject: [PATCH] [FrameworkBundle] Force users to set "kernel.secret" to something different than default "ThisTokenIsNotSoSecretChangeIt" --- .../DependencyInjection/Configuration.php | 7 ++++++- .../DependencyInjection/ConfigurationTest.php | 14 ++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php index 60caf1d00c..d9a6cf3f83 100644 --- a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php +++ b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php @@ -51,7 +51,12 @@ class Configuration implements ConfigurationInterface }) ->end() ->end() - ->scalarNode('secret')->end() + ->scalarNode('secret') + ->validate() + ->ifTrue(function($v) { return 'ThisTokenIsNotSoSecretChangeIt' === $v; }) + ->thenInvalid('The "secret" parameter is currently set to the default. It is really important that you change it to something unique.') + ->end() + ->end() ->scalarNode('trust_proxy_headers')->defaultFalse()->end() // @deprecated, to be removed in 2.3 ->arrayNode('trusted_proxies') ->beforeNormalization() diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php index 77670cc005..5de7ddc449 100644 --- a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php +++ b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php @@ -66,7 +66,7 @@ class ConfigurationTest extends \PHPUnit_Framework_TestCase { $processor = new Processor(); $configuration = new Configuration(array()); - $config = $processor->processConfiguration($configuration, array(array('secret' => 's3cr3t', 'trusted_proxies' => 'Not an IP address'))); + $processor->processConfiguration($configuration, array(array('secret' => 's3cr3t', 'trusted_proxies' => 'Not an IP address'))); } /** @@ -76,6 +76,16 @@ class ConfigurationTest extends \PHPUnit_Framework_TestCase { $processor = new Processor(); $configuration = new Configuration(array()); - $config = $processor->processConfiguration($configuration, array(array('secret' => 's3cr3t', 'trusted_proxies' => array('Not an IP address')))); + $processor->processConfiguration($configuration, array(array('secret' => 's3cr3t', 'trusted_proxies' => array('Not an IP address')))); + } + + /** + * @expectedException \Symfony\Component\Config\Definition\Exception\InvalidConfigurationException + */ + public function testDefaultSecretIsUsed() + { + $processor = new Processor(); + $configuration = new Configuration(array()); + $processor->processConfiguration($configuration, array(array('secret' => 'ThisTokenIsNotSoSecretChangeIt'))); } }