CVE-2017-16754

@@ -0,0 +1,74 @@
+<?php
+
+namespace Bolt\EventListener;
+
+use Bolt\AccessControl\Token\Token;
+use Bolt\Request\ProfilerAwareTrait;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\HttpKernel\Event\GetResponseEvent;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+/**
+ * Symfony Profiler listener.
+ *
+ * @author Gawain Lynch <gawain.lynch@gmail.com>
+ */
+class ProfilerListener implements EventSubscriberInterface
+{
+    use ProfilerAwareTrait;
+
+    /** @var SessionInterface */
+    private $session;
+    /** @var bool */
+    private $debug;
+    /** @var bool */
+    private $debugLoggedOff;
+
+    /**
+     * Constructor.
+     *
+     * @param SessionInterface $session
+     * @param bool             $debug
+     * @param bool             $debugLoggedOff
+     */
+    public function __construct(SessionInterface $session, $debug, $debugLoggedOff)
+    {
+        $this->session = $session;
+        $this->debug = $debug;
+        $this->debugLoggedOff = $debugLoggedOff;
+    }
+
+    /**
+     * Request listener to prevent access to profiler routes when debugging is
+     * not enabled, or the user is logged off & debugging is not configured to
+     * show when logged off.
+     *
+     * @param GetResponseEvent $event
+     */
+    public function onKernelRequest(GetResponseEvent $event)
+    {
+        $request = $event->getRequest();
+        if (!$this->isProfilerRequest($request)) {
+            return;
+        }
+
+        $token = $this->session->isStarted() ? $this->session->get('authentication') : null;
+        if ($this->debug && ($token instanceof Token || $this->debugLoggedOff)) {
+            return;
+        }
+
+        throw new NotFoundHttpException();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getSubscribedEvents()
+    {
+        return [
+            KernelEvents::REQUEST => ['onKernelRequest'],
+        ];
+    }
+}

@@ -130,6 +130,16 @@ function ($app) {
                 return new Listener\ZoneGuesser($app);
             }
         );
+
+        $app['listener.profile'] = $app->share(
+            function ($app) {
+                return new Listener\ProfilerListener(
+                    $app['session'],
+                    $app['debug'],
+                    $app['config']->get('general/debug_show_loggedoff')
+                );
+            }
+        );
     }
 
     public function boot(Application $app)
@@ -160,5 +170,7 @@ public function boot(Application $app)
         if (isset($app['listener.exception']) && !$app['config']->get('general/debug_error_use_symfony')) {
             $dispatcher->addSubscriber($app['listener.exception']);
         }
+
+        $dispatcher->addSubscriber($app['listener.profile']);
     }
 }