Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add note about arbitrary URLs in streamloader #1401

Merged
merged 1 commit into from
Oct 28, 2021
Merged

add note about arbitrary URLs in streamloader #1401

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions Resources/doc/data-loader/stream.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ Custom
~~~~~~

The ``Liip\ImagineBundle\Binary\Loader\StreamLoader`` allows to read images
from any stream (http, ftp, and others…) registered thus allowing you to serve your images from
literally anywhere.
from any stream (http, ftp, and others…) registered thus allowing you to
serve your images from literally anywhere.

The example service definition shows how to use a stream wrapped by the
`Gaufrette`_ filesystem abstraction layer. In order to have this example
Expand All @@ -50,8 +50,8 @@ If you are using the `KnpGaufretteBundle`_ you can make use of the
Usage
-----

Now you are ready to use the ``AwsS3Resolver`` by configuring the bundle.
The following example will configure the resolver as default.
Now you are ready to use the stream loader. To configure it as the default
loader, you can configure the following:

.. code-block:: yaml

Expand All @@ -60,6 +60,16 @@ The following example will configure the resolver as default.
liip_imagine:
data_loader: stream.profile_photos

.. note::

The stream should be set up to load images from a specific source and only
accept relative paths to that source.

We do not recommend to set this loader up in a way that it accepts an
absolute URL. Otherwise an attacker could make your controller load
arbitrary image files that are then served over your server, with all the
legal implications.


.. _`StreamWrapper configuration`: https://github.com/KnpLabs/KnpGaufretteBundle#stream-wrapper
.. _`Gaufrette`: https://github.com/KnpLabs/Gaufrette
Expand Down