bug #937 Properly lock down app_dev.php (phihag)
bug #937 Properly lock down app_dev.php (phihag)

This PR was submitted for the master branch but it was merged into the 2.7 branch instead (closes #937).

Discussion
----------

Properly lock down app_dev.php

Currently, web/app_dev.php in the symfony-standard package limits requests to those coming from CLI and unproxied localhost.

This prevents an attacker to execute this file in a production environment.

IPv4 localhost requests can come from 127.0.0.0/8, so the current check is actually a little bit too restrictive, but safe.

IPv6 localhost requests come from ::1/128.

The address fe80::1, however, is a link-local IPv6 address like any other. Anyone in the local network can take it and communicate with it. Therefore, it does not belong here.

Commits
-------

f63bbbf Properly lock down app_dev.php

egeloen/symfony-standard,symfony-cmf/standard-edition,kmelia/fresh-symfony,the-software-factory/superhero-api,formapro-forks/api-basic,Tobion/symfony-standard,Spea/symfony-standard,debruyne0/symfony,GulDmitry/music-diff,fabpot/symfony-standard,Spea/symfony-standard,symfony/symfony-standard,Tobion/symfony-standard,GulDmitry/music-diff,debruyne0/symfony,kmelia/fresh-symfony,uttam-vi/pardawala,GulDmitry/music-diff,ovelasquez/ussi,kmelia/fresh-symfony,gencer/symfony-standard,ovelasquez/ussi,symfony/symfony-standard,simonjcarr/symfony_rest,formapro-forks/api-basic,apnet/symfony-standard-edition,gencer/symfony-standard,lyrixx/symfony-standard,vincentaubert/symfony-standard,apnet/symfony-standard-edition,fabpot/symfony-standard,the-software-factory/superhero-api,apnet/symfony-standard-edition,black-project/black-standard,vincentaubert/symfony-standard,ovelasquez/ussi,jakzal/symfony-standard,symfony-cmf/standard-edition,fduch/symfony-standard-workflow,jakzal/symfony-standard,uttam-vi/pardawala,uttam-vi/pardawala,egeloen/symfony-standard,stof/symfony-standard,stof/symfony-standard,black-project/black-standard,GulDmitry/music-diff,simonjcarr/symfony_rest,fduch/symfony-standard-workflow,lyrixx/symfony-standard