Release 2.53 (#5878)

2026-04-10 18:09:27 +02:00
parent fe4185ae45
commit 999d820d4c
79 changed files with 1046 additions and 430 deletions
--- a/src/Twig/SecurityPolicy/StrictPolicy.php
+++ b/src/Twig/SecurityPolicy/StrictPolicy.php
@@ -153,7 +153,12 @@ final class StrictPolicy implements SecurityPolicyInterface
        }

        if ($obj instanceof User) {
-            if (\in_array($lcm, ['getpassword', 'gettotpsecret', 'getplainpassword', 'getconfirmationtoken', 'gettotpauthenticationconfiguration'], true)) {
+            if (str_contains($lcm, 'password')
+                || str_contains($lcm, 'totp')
+                || str_contains($lcm, 'api')
+                || str_contains($lcm, 'secret')
+                || str_contains($lcm, 'token')
+            ) {
                throw new SecurityNotAllowedMethodError('Tried to access user secrets', User::class, $method);
            }
        }