[robertSt7]

Resolves pimcore/service-operations#935

Problem

In the dev environment the Symfony profiler exposes /_profiler/phpinfo. It prints phpinfo() - including environment variables and, depending on the setup, secrets - to anyone who can reach the instance. Dev and staging instances are often reachable from the network. The page is served as soon as the profiler is enabled; it ignores web_profiler.toolbar, so simply turning the toolbar off does not close it.

Root cause

ProfilerController::phpinfoAction() (symfony/web-profiler-bundle 7.4) only checks that the profiler service exists. Core's routing_dev.yaml imports the profiler routes, and the skeleton did not configure anything for them.

Fix

• config/packages/dev/config.yaml: web_profiler.toolbar: false - toolbar off by default in dev (Dev Steering decision).
• config/routes/dev/routes.yaml: redefine the _profiler_phpinfo route under the same name with condition: "false". The redefinition replaces the original route, so /_profiler/phpinfo falls through to the profiler's /{token} route, which only reports an unknown token. The rest of the profiler keeps working and path('_profiler_phpinfo') links still generate. Remove the route to get the page back.
• README.md: new section "Symfony profiler (dev environment)" explaining the new defaults and how to activate the toolbar and the /_profiler/phpinfo page again (including the cache clear that is needed for the change to show up).
• tests/Functional/Dev/ProfilerTest.php: boots the dev kernel and checks the route match, the response of /_profiler/phpinfo, that other profiler routes still match/generate, and that the toolbar is disabled.

Core is untouched. Same change for the demo app: pimcore/demo-enterprise (pimcore/demo-enterprise#551).

Testing

• New test: 4 tests / 9 assertions pass with the change; 3 of 4 fail on the original config (phpinfo output served, _profiler_phpinfo matched, toolbar enabled). Run with PHPUnit against a Pimcore 2026.3 dev instance (the demo app, which uses the same dev config); not run by this repo's CI, which only does the create-project / install smoke test.
• Walkthrough on a running dev instance with the patched files: /_profiler/phpinfo no longer returns the phpinfo page (before: 200 with the full page), the toolbar markers disappear from HTML pages, /_profiler/ still redirects to the search results.
• The activation steps from the README were verified on a running dev instance: with toolbar: true the toolbar appears, with the _profiler_phpinfo route removed the phpinfo page is served again - both only after a cache clear.
• YAML lint on all changed config files; php-cs-fixer (skeleton rules) clean on the new test.

Notes

• Only affects the dev environment of newly created projects; prod/test and existing projects are untouched.
• Not covered (only recorded): other profiler pages (request/config panels) remain reachable while the profiler is enabled in dev. Running with APP_ENV=prod / APP_DEBUG=0 stays the recommendation for anything reachable from the network.
• BC: no PHP API, service id or config key of the framework changes; dev-only application config.

[Copilot]

🟡 Changes recommended

The new tests boot the dev kernel without the test database override, breaking database isolation.

1 open finding

• Dev boot ignores test database override · New

What changed in this PR

Hardens the skeleton’s dev defaults by disabling the debug toolbar and blocking the profiler’s phpinfo page while preserving other profiler routes.

Changes:

• Disables the dev toolbar by default.
• Overrides the phpinfo route so it never matches.
• Adds functional checks for the profiler defaults.

File	Description
tests/​Functional/​Dev/​ProfilerTest.php	Tests phpinfo blocking, profiler routes, and toolbar configuration.
config/​routes/​dev/​routes.yaml	Prevents the phpinfo route from matching.
config/​packages/​dev/​config.yaml	Disables the debug toolbar.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Test cleanup can delete or overwrite existing database environment values, affecting subsequent tests.

1 open finding

• Database environment teardown loses per-store original values · New

1 resolved since last review

• Dev boot ignores test database override

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The security-sensitive route override still needs validation against the skeleton’s installed dependencies.

0 open findings

1 resolved since last review

• Database environment teardown loses per-store original values

🧠 Review effort: Balanced

[jdreesen]

Is it really necessary to change Symfony's default behavior here?

[robertSt7]

@jdreesen Fair question. The toolbar default follows the Dev Steering decision. The phpinfo route is separate: toolbar: false doesn't close /_profiler/phpinfo, and Symfony's profiler has no option to disable it, since it only checks that the profiler exists. So the only ways to close it are to disable the whole profiler or to override the route. I chose a single dev-only route override in app config, so the framework default stays untouched. Deleting the route restores the page. If you'd rather keep this PR to the toolbar default, I can drop the route. Then the exposure would need a decision in core, and the demo-enterprise change would be reverted to match.

[jdreesen]

If that's such an issue, shouldn't it be fixed in Symfony instead?

[Copilot]

🟢 Approval recommended

The focused configuration changes, documentation, and regression tests are consistent, and the previously reported database isolation issues are addressed.

No open issues 🎉

_{Review effort: Balanced}