Tag
Security
5 posts tagged Security.
09/02/2026
is_granted in Twig: roles and IS_AUTHENTICATED
is_granted takes more than roles, and picking the wrong one gives you a check that quietly passes when it should not. What each attribute tests, why role hierarchy makes ROLE_USER true for your admins, and where the check belongs.
09/02/2026
Leaving FOSUserBundle: what replaces each piece
The bundle is maintained only enough for existing projects to migrate off it. Every piece it provided now has a replacement in Symfony itself or in two small bundles - and the migration is mostly deletion.
09/02/2026
Twig autoescaping and the raw filter
Autoescaping makes Twig safe by default and makes |raw the fastest way to undo that. The catch is that HTML escaping is only correct in HTML - inside a script tag or an unquoted attribute, the default is the wrong answer.
04/28/2015
Show the logged-in user in a Twig template
The snippet everyone has saved uses app.user.username, which throws on every supported Symfony. Here is the version that works, which check to guard it with, and how to greet somebody by name rather than by email address.
02/26/2014
Including a PHP file from a WordPress shortcode, safely
The 2014 version of this shortcode takes a file path out of the post and includes it, which is a local file inclusion hole with extra steps. The fix is small: let the code decide which files are includable, not the person writing the post.