admin-lte js package 2.4 is concerned by known critical vulnerabilities about sonataadminbundle HOT 5 CLOSED

I fail to see how this would affect a symfony application. In symfony only "live" accessible file is index.php which is the front controller. No adminX.html are exposed or have any chance of being exposed from vendor directory. And symfony handles routing and security. So whatever bugs present in javascript, the php server won't give access or reply with resources that user don't have access.

from sonataadminbundle.

Hi,

See #7156

Admin lte 3 use Bootstrap 4, Admin lte use Bootstrap 3.
The update for bootstrap 4 is huge like you can see a try #7740

Also, this is a hard BC break and will require to release SonataAdmin 5.x.

Can you please update admin-lte dependency ?

Feel free to try

What would be great for us is to fix the vulnerability on admin lte 2.
Maybe they can accept a PR on the 2.x branch and to release a patched version.

from sonataadminbundle.

IMO it can be closed, and handled in the issue #7156

from sonataadminbundle.

The #7156 is kinda an epic when this issue is about a specific problem.
And maybe some others fix exist for this issue (Like trying a PR on admin lte 2.x)

from sonataadminbundle.

I agree, Closing then

from sonataadminbundle.