"make homepage" route in routing auto tutorial is insecure

[dantleech]

http://symfony.com/doc/current/cmf/tutorial/make-homepage.html

as on IRC:

 | A simple fix would be to change the root to                                    
 | - /admin/action/make_homepage/                                                 
 | then when firewalls are configured for the admin bundle they apply to that     
 | route also                                                                     

[dbu]

and also makeHomepageAction should only allow POST and not GET - if i see it correctly it does not specify the method currently.

[dbu]

@dantleech did #763 fix this?

[dantleech]

No, but #777
would

On Sat, Aug 20, 2016 at 03:38:56AM -0700, David Buchmann wrote:

[1]@dantleech did [2]#763 fix this?

—
You are receiving this because you were mentioned.
Reply to this email directly, [3]view it on GitHub, or [4]mute the thread.

Reverse link: [5]unknown

References

Visible links

1. https://github.com/dantleech
2. #763
3. #680 (comment)
4. https://github.com/notifications/unsubscribe-auth/AAgZcSziQkxR_GdHa5AwzqfjCny_P2j2ks5qhtlAgaJpZM4EuoUI
5. #680 (comment)

[dbu]

fixed in #777