zendframework/zf2 — pull request #2410 by BilgeXA (2012-09-24 00:22:08+00:00)
Title: JsonStrategy security fix

Automatically switching to JSON output based on the Accept header is a massive security risk. I can crawl an entire ZF2 site with JsonStrategy enabled and get it to dump all the ViewModel variables for every page by simply adding "application/json" to the Accept header. This includes any information which the developer passed to the view but did not anticipate ever being rendered on a page and may include sensitive information.

The default use case should NOT automatically output JSON based on a user-defined request header. A better solution would be to make this a configuration option but this is beyond my knowledge of ZF2 and beyond my current availability to implement so I can only offer to remove the offending code for now.