symfony/symfony — pull request #6482 by lmcd (2012-12-26 06:07:08+00:00)
Title: Mask PHP_AUTH_PW header in profiler

I've noticed that passwords for HTTP Basic Access Authentication are being stored in plaintext in the profiler. If enabled in production, this could allow someone malicious with access to the profiler database to obtain a list of active username/passwords for a website.

See example security.yml:

security:
...

firewalls:
secured_area:
pattern: ^/
http_basic:
realm: "Secured Demo Area"

providers:
in_memory:
memory:
users:
ryan: { password: bb87a29949f3a1ee0559f8a57357487151281386, roles: 'ROLE_USER' }

encoders:
Symfony\Component\Security\Core\User\User:
algorithm: sha1
iterations: 1
encode_as_base64: false

Before patch:
![pass-before](https://f.cloud.github.com/assets/363540/30822/557f8852-4f22-11e2-9325-ae5014ab7a02.png)

After patch:
![pass-after](https://f.cloud.github.com/assets/363540/30823/601a6048-4f22-11e2-9333-2702ca7a649a.png)