Changing case of a URL allows bypassing of validation rules.

This also allows for bypassing of security (credential checking) rules. The basicsecurityfilter is not even loaded if the corresponding yml file isn't found.

I should say that because the route wasn't predefined, the router set a default /:module/:action route.

For the security.yml, I solved it by adding the following to sfSecurityConfigHandler.class.php right before the retval is assigned.:

//change all of the keys to lowercase
$myConfig = array_change_key_case($myConfig);

and then in the sfAction.class.php in the isSecure function:

public function isSecure()
  { 
    $actionName = strtolower($this->getActionName());
    if (isset($this->security[$actionName]['is_secure']))
    {
      return $this->security[$actionName]['is_secure'];
    }
...

in r1498

WARNING: may break BC

Actions in the routing are now case sensitive. If you have a page with an 'index' action name, your action must be named 'executeIndex' ('fooBar' => 'executeFooBar').