Use SymLinksIfOwnerMatch by default.

[ostark]

Q	A
License	MIT

Options +SymLinksIfOwnerMatch is more secure than Options +FollowSymlinks.

With the FollowSymlinks option enabled, you could easily mistakenly create a symlink to a file outside the web root folder and Apache would follow it. The owner of files for the web application usually differs from other system files. This additional owner check reduces the risk of exposing files.

[github-actions]

Thanks for the PR 😍

How to test these changes in your application

1. Define the SYMFONY_ENDPOINT environment variable:

   # On Unix-like (BSD, Linux and macOS)
   export SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes-contrib/flex/pull-1570/index.json
   # On Windows
   SET SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes-contrib/flex/pull-1570/index.json

2. Install the package(s) related to this recipe:

   composer req 'symfony/flex:^1.16'
   composer req 'symfony/apache-pack:^1.0'

3. Don't forget to unset the SYMFONY_ENDPOINT environment variable when done:

   # On Unix-like (BSD, Linux and macOS)
   unset SYMFONY_ENDPOINT
   # On Windows
   SET SYMFONY_ENDPOINT=

Diff between recipe versions

In order to help with the review stage, I'm in charge of computing the diff between the various versions of patched recipes.
I'm going keep this comment up to date with any updates of the attached patch.

[frank-laemmer]

May I add some context:

We (fortrabbit) offer a standardized shared hosting solution with Apache. Our Symfony install guide suggests to install the apache-pack. That is not working any more, because of the open rule to follow any symlink.

We are aware that this may have an performance impact. Yet the increased security level might be worth it.