[symfony#2508] Adding extra warning about app_dev.php and config.php

weaverryan · weaverryan · commit dcf06e3b63e0 · 2013-05-03T13:12:02.000-06:00
diff --git a/cookbook/configuration/web_server_configuration.rst b/cookbook/configuration/web_server_configuration.rst
@@ -85,9 +85,13 @@ are:
 .. tip::
 
     This executes **only** ``app.php``, ``app_dev.php`` and ``config.php`` in
-    the web directory. All other files will be served as text. If you have
-    other PHP files in your web directory, be sure to include them in the
-    ``location`` block above.
+    the web directory. All other files will be served as text. You **must**
+    also make sure that if you *do* deploy ``app_dev.php`` or ``config.php``
+    that these files are secured and not available to any outside user (the
+    IP checking code at the top of each file does this by default).
+    
+    If you have other PHP files in your web directory that need to be executed,
+    be sure to include them in the ``location`` block above.
 
 .. _`Apache`: http://httpd.apache.org/docs/current/mod/core.html#documentroot
 .. _`Nginx`: http://wiki.nginx.org/Symfony
