Locking down _profiler route to require PIMCORE_ADMIN role to reduce …

…exposure of sensitive info

config/packages/security.yaml

@@ -7,9 +7,14 @@ security:
 
     firewalls:
         dev:
-            pattern: ^/(_(profiler|wdt)|css|images|js)/
+            pattern: ^/(_wdt|css|images|js)/
             security: false
 
+        profiler:
+            pattern: ^/(_(profiler))/
+            provider: pimcore_admin
+            http_basic: ~
+
         # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
         pimcore_webdav:
             pattern: ^/asset/webdav
@@ -29,6 +34,7 @@ security:
         - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
         - { path: ^/admin, roles: ROLE_PIMCORE_USER }
         - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }
+        - { path: ^/_profiler, roles: ROLE_PIMCORE_ADMIN }
 
     role_hierarchy:
         # Pimcore admin  // DO NOT CHANGE!