Documented the security:check command #4651

javiereguiluz · 2014-12-14T15:57:46Z

Q	A
Doc fix?	no
New docs?	yes
Applies to	all
Fixed tickets	#4051

xabbuh · 2014-12-14T18:50:36Z

We need to be careful, to only merge this into the 2.5 branch and higher since the command isn't part of the 2.3 version of the SensioDistributionBundle.

xabbuh · 2014-12-14T18:52:55Z

book/security.rst

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. versionadded:: 2.6
+    The ``security:check`` command was introduced in Symfony 2.6.


It's actually available in Symfony 2.5 too (it's part of SensioDistributionBundle in version 3.0 which is compatible with Symfony 2.5 and higher).

Thanks! Fixed.

xabbuh · 2014-12-14T18:55:42Z

Thanks for your work @javiereguiluz. I'm just wondering if we should also add a note in /contributing/code/security.rst. What do you think?

javiereguiluz · 2014-12-14T19:02:54Z

A comment to the doc merger (probably @weaverryan): I wrongly made this PR against 2.3 and it should be 2.5 because security:check command was introduced in Symfony 2.5.

javiereguiluz · 2014-12-14T19:07:00Z

@xabbuh I've added a note in 20de27e Please, let me know if that was what you were thinking or not. Thanks!

xabbuh · 2014-12-14T19:27:31Z

contributing/code/security.rst

@@ -38,6 +38,8 @@ confirmed, the core-team works on a solution following these steps:
 8. Publish the post on the official Symfony `blog`_ (it must also be added to
   the "`Security Advisories`_" category);
 9. Update the security advisory list (see below).
+10. Update the public `security advisories database`_ maintained by the


You'll have to add the referenced URL.

Fixed. Thanks.

xabbuh · 2014-12-14T19:28:31Z

I thought we could also add a note at "Security Advisories" which explains that you can use the security:check command to test for known vulnerabilities.

javiereguiluz · 2014-12-16T07:50:09Z

I thought we could also add a note at "Security Advisories" which explains that you can use the security:check command to test for known vulnerabilities.

I'm afraid that I do't understand your last comment. Where else should we mention this security:check command?

xabbuh · 2014-12-16T09:20:26Z

I thought about adding the following block in /contributing/code/security.rst (before or after the list of security releases):

.. tip::

    You can check your Symfony application for known security vulnerabilities
    using the ``security:check`` command.

This might be valuable because issues not only occur in the Symfony core, but do also happen in third-party bundle code.

stof · 2014-12-16T09:54:02Z

book/security.rst

+When using lots of dependencies in your Symfony projects, odds are that some of
+them contain security vulnerabilities. That's why Symfony includes a command
+called ``security:check`` that checks whether any of your installed dependencies
+contain a known security vulnerability:


you should add a note that the command is provided by SensioDistributionBundle, so it will be available only when it is registered

wouterj · 2014-12-28T15:26:51Z

ping @javiereguiluz

…y:check

javiereguiluz · 2014-12-29T16:19:15Z

@wouterj I've rebased the PR and fixed everything that reviewers told me. If you agree, we can move this PR to Finished state. Thanks!

xabbuh · 2014-12-29T16:27:01Z

book/security.rst

+.. versionadded:: 2.5
+    The ``security:check`` command was introduced in Symfony 2.5. This command is
+    included in ``SensioDistributionBundle``, which has to be registered in your
+    application in order to use this command.


The reference to the SensioDistributionBundle should probably also be added in the installation chapter.

Do you really think is necessary? The installation chapter is for people that know nothing about Symfony. They're going to use the installer and they're going to install the standard edition, so everything works out of the box. My feel is that this note is only for advanced users doing custom installations.

Hm, I guess you're right now that I think about it again.

This PR was merged into the 2.3 branch. Discussion ---------- Documented the security:check command | Q | A | ------------- | --- | Doc fix? | no | New docs? | yes | Applies to | all | Fixed tickets | #4051 Commits ------- 897dc70 Added a lot of changes suggested by reviewers fdfb1a0 Added a note about the SensioDistributionBundle necessary for security:check 3c9a962 Added a note about the security:check command e552369 Added a missing link reference 0e7d0cd Added a note about the security advisories database 36d3f2b This command is available sin Symfony 2.5 7f3fb71 Documented the security:check command

weaverryan · 2015-01-01T22:51:13Z

Thanks Javier! I merged this in and am fixing the build error right now :)

* 2.3: fixing bad link Fixing bad merge - this section should not have been left in [#4651] Fixing build error Update by_reference.rst.inc Added a lot of changes suggested by reviewers Added a note about the SensioDistributionBundle necessary for security:check Added a note about the security:check command Added a missing link reference Added a note about the security advisories database This command is available sin Symfony 2.5 Documented the security:check command

* 2.5: fixing bad link Fixing bad merge - this section should not have been left in [#4651] Fixing build error Update by_reference.rst.inc Added a lot of changes suggested by reviewers Added a note about the SensioDistributionBundle necessary for security:check Added a note about the security:check command Added a missing link reference Added a note about the security advisories database This command is available sin Symfony 2.5 Documented the security:check command

* 2.7: fixing bad link Fixing bad merge - this section should not have been left in [#4651] Fixing build error Update by_reference.rst.inc Added a lot of changes suggested by reviewers Added a note about the SensioDistributionBundle necessary for security:check Added a note about the security:check command Added a missing link reference Added a note about the security advisories database This command is available sin Symfony 2.5 Documented the security:check command

This PR was merged into the 2.3 branch. Discussion ---------- Revert #4651 for 2.3 branch | Q | A | ------------- | --- | Doc fix? | yes | New docs? | no | Applies to | 2.3 (only) | Fixed tickets | #4651 was merged in 2.3 but should be 2.5 as mentioned in #4651 (comment). This PR reverts the changes for the 2.3 branch. Commits ------- f2d3223 Revert #4651 for 2.3 branch

* 2.3: Revert #4651 for 2.3 branch

* 2.5: fix merge after removing @Security in 2.3 Reverting a commit on 2.5 branch, as it was only meant to be on 2.3 (so reverting after the merge) [#4735] Reverting what was left on the 2.5 branch after the merge conflict had already put back some of it Typo Fix: "allows to" should be "allows you to" move cautions to make them visible bump required PHPUnit version remove @Security annotation for Symfony 2.3 Revert #4651 for 2.3 branch Use AppBundle whenever it's possible Conflicts: components/console/helpers/map.rst.inc cookbook/form/create_custom_field_type.rst cookbook/form/dynamic_form_modification.rst cookbook/form/form_customization.rst cookbook/profiler/matchers.rst cookbook/security/custom_authentication_provider.rst cookbook/security/securing_services.rst

xabbuh reviewed Dec 14, 2014
View reviewed changes

xabbuh added the Status: Needs Work label Dec 14, 2014

xabbuh reviewed Dec 14, 2014
View reviewed changes

stof reviewed Dec 16, 2014
View reviewed changes

javiereguiluz added 6 commits December 29, 2014 17:17

Documented the security:check command

7f3fb71

This command is available sin Symfony 2.5

36d3f2b

Added a note about the security advisories database

0e7d0cd

Added a missing link reference

e552369

Added a note about the security:check command

3c9a962

Added a note about the SensioDistributionBundle necessary for securit…

fdfb1a0

…y:check

javiereguiluz force-pushed the document_security_check_command branch from 847b8ce to fdfb1a0 Compare December 29, 2014 16:18

xabbuh reviewed Dec 29, 2014
View reviewed changes

Added a lot of changes suggested by reviewers

897dc70

weaverryan merged commit 897dc70 into symfony:2.3 Jan 1, 2015

weaverryan added a commit that referenced this pull request Jan 1, 2015

[#4651] Fixing build error

d9c2209

xelaris mentioned this pull request Jan 3, 2015

Consider moving of security:check documentation #4745

Closed

xelaris added a commit to xelaris/symfony-docs that referenced this pull request Jan 3, 2015

Revert symfony#4651 for 2.3 branch

f2d3223

xelaris mentioned this pull request Jan 3, 2015

Revert #4651 for 2.3 branch #4746

Merged

weaverryan added a commit that referenced this pull request Jan 16, 2015

Merge branch '2.3' into 2.5

c8928d8

* 2.3: Revert #4651 for 2.3 branch

javiereguiluz deleted the document_security_check_command branch February 18, 2015 16:23

Uh oh!

Documented the security:check command #4651

Documented the security:check command #4651

Uh oh!

Conversation

javiereguiluz commented Dec 14, 2014

Uh oh!

xabbuh commented Dec 14, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xabbuh commented Dec 14, 2014

Uh oh!

javiereguiluz commented Dec 14, 2014

Uh oh!

javiereguiluz commented Dec 14, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xabbuh commented Dec 14, 2014

Uh oh!

javiereguiluz commented Dec 16, 2014

Uh oh!

xabbuh commented Dec 16, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wouterj commented Dec 28, 2014

Uh oh!

javiereguiluz commented Dec 29, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

weaverryan commented Jan 1, 2015

Uh oh!

Uh oh!