If $_SERVER['APP_ENV'] ist set, loading of the .env files is currently prevented in our Kernel:

This leads to a bad dx when using the symfony binary to execute the console ( as a wrapper for php to get a consistent version) because the symfony binary is apparently setting $_SERVER['APP_ENV'] = 'prod' by default:

symfony php vendor/bin/contao-console # <-- won't process .env / .env.local
php vendor/bin/contao-console         # <-- will process .env / .env.local

In a Symfony 5 application (with flex) the .env files are processed anyways, also the default bootstrapping (see recipe) for Symfony 4 doesn't contain this check.

I'd really like the managed edition and flex behave the same way in this case. Although I don't really know what the correct behavior should be.

When ScriptHandler::initializeApplication() gets executed during a composer operation, I've come across this problem (had it two or three times before but unfortunately don't know by what it's caused):

WARNING   ContaoCoreBundle                absolute symlink
WARNING   ContaoCommentsBundle            absolute symlink
ERROR     ContaoNewsletterBundle          Failed to create "web/bundles/contaonewsletter": mkdir(): File exists.

(Output is from a console under windows - so that's why there are absolute symlinks and the warnings are as expected.)

One of the symlinks cannot be created. I don't know why composer tries to create the symlink in the first place as it is already existing and I don't know why the problem only happens for one of the packages.

The system/initialize.php file is wrong which causes failure of legacy extensions that depend on it. The file created by core-bundle triggers the AppKernel which does not exist, it should trigger ContaoKernel isntead.

Related issues:
isotope/core#1771
codefog/contao-news_categories#98

The following code in src/Composer/ScriptHandler.php causes an "Array to string conversion" error if a command doesn't successfully run.

Line 94:

if (!$process->isSuccessful()) {
     throw new \RuntimeException(sprintf('An error occurred while executing the "%s" command: %s', $cmd, $process->getErrorOutput()));
}

$cmd is an array and not a string:

Line 60:
private static function executeCommand(array $cmd, Event $event, string $env = 'prod'): void

With the changes from #60 Contao does not work anymore.

It works fine using app_dev.php. No log entries or other information, probably because the problem occurs very early in the program flow. If I revert the changes from 722cbe6 it works again.

@Toflar Can you please check?

At the moment it isn't possible to refresh/invalidate the page cache for cache entries related to a page. Before 4.3 (?) it was possible to clear the cache by tracking the cache key using the getCacheKey hook.

For instance netzmacht/contao-cache-control and 1up-lab/contao-cache-warmup did it this way.

With contao/core-bundle#576 the getCacheKey hook was removed from Contao.

To gain back more control of the default used HttpCache, i propose to add the (FOS HTTP Cache event listeners](http://foshttpcache.readthedocs.io/en/stable/symfony-cache-configuration.html#cache-event-listeners) by default and enable the bundle.

Providing a more flexible way to register own subscribers here would be great too. Adding the above mentioned listeners wouldn't need to be added by default. As the cache is created before the kernel is booting I don't know you it could be accomplished.

Issue by @fritzmg
June 22nd, 2017, 19:30 GMT

Tested in Contao managed-edition 4.4.0.

1. Add the following to your app/config/config.yml:

contao:
    url_suffix: ''

2. Open the front-end with domain.org/app_dev.php

The Symfony debug bar will not be visible. After a while you will see the following alert:

If you open the profiler, an exception will be visible:

Contao\CoreBundle\Exception\PageNotFoundException:
Page not found: http://c43me.dev/app_dev.php/_profiler/307a90

  at vendor\contao\core-bundle\src\Resources\contao\controllers\FrontendIndex.php:75
  at Contao\FrontendIndex->run()
     (vendor\contao\core-bundle\src\Controller\FrontendController.php:42)
  at Contao\CoreBundle\Controller\FrontendController->indexAction()
  at call_user_func_array(array(object(FrontendController), 'indexAction'), array())
     (vendor\symfony\symfony\src\Symfony\Component\HttpKernel\HttpKernel.php:153)
  at Symfony\Component\HttpKernel\HttpKernel->handleRaw(object(Request), 1)
     (vendor\symfony\symfony\src\Symfony\Component\HttpKernel\HttpKernel.php:68)
  at Symfony\Component\HttpKernel\HttpKernel->handle(object(Request), 1, true)
     (vendor\symfony\symfony\src\Symfony\Component\HttpKernel\Kernel.php:171)
  at Symfony\Component\HttpKernel\Kernel->handle(object(Request))
     (web\app_dev.php:62)

I am assuming this happens because without an url_suffix the /_profiler/307a90 URL is catched by Contao and treated as a regular page URL (which can then not be found).

Not sure where to put this as this might me rather a problem of the missing docs than a real issue.

If I understand correctly the idea of the RoutingPluginInterface is to be able to specify custom routes in your own bundles or the ContaoManagerPlugin in global namespace (analogous to what the BundlePluginInterface is to loading bundles in the right order). When simply implementing the interface in both cases, the getRouteCollection (...) method never gets called (the class gets loaded, however). Is this the right approach or what am I missing?

Btw.: In my case I am trying to setup legacy redirects from an old installation. For this case it would be handy if an app/config/routing.yml would be loaded if it exists like the config.yml / config_*.yml.

Bei der Installation fehlt die robots.txt. Die saubere Lösung wäre aber:

User-Agent: *
Disallow: 

Denn eine fehlende robots.txt sendet dem Crawler ein 404.

When installing the managed edition via composer create-project or when simply directly calling

php vendor/bin/contao-console contao:install

you will only get an output like this:

dir=$(d=${0%[/\\]*}; cd "$d"; cd "../contao/manager-bundle/bin" && pwd)

# See if we are running in Cygwin by checking for cygpath program
if command -v 'cygpath' >/dev/null 2>&1; then
# Cygwin paths start with /cygdrive/ which will break windows PHP,
# so we need to translate the dir path to windows format. However
# we could be using cygwin PHP which does not require this, so we
# test if the path to PHP starts with /cygdrive/ rather than /usr/bin
if [[ $(which php) == /cygdrive/* ]]; then
dir=$(cygpath -m "$dir");
fi
fi

dir=$(echo $dir | sed 's/ /\ /g')
"${dir}/contao-console" "$@"

under Windows.

The same problem also happened with the (old) build method of the Contao Manager, see https://community.contao.org/de/showthread.php?65512-Composer-Nutzung-vereinfachen&p=431181&viewfull=1#post431181

There the problem could be circumvented by using …/pharpiler.bat instead of php …/pharpiler. However, no batch file exists for contao-console.

See also https://community.contao.org/de/showthread.php?66201-Contao-4-3-mit-Composer-und-einem-RockSolid-Theme-installieren-schl%C3%A4gt-fehl

Issue by @digitalingenieur
February 7th, 2017, 11:14 GMT

In Contao Managed Version the path to the log file should be something like

$this->rootDir.'/../var/logs/prod-'.date('Y-m-d').'.log'

in InstallTool.php, Line 395

Symfony 3.4.7 was released 3 hours ago. When using legacy modules we get the following error on running composer update:

...
Compiling component files
> Contao\ManagerBundle\Composer\ScriptHandler::initializeApplication

In ContaoModuleBundle.php line 36:
                                                                         
  The module folder "system/modules/contao-filecredits" does not exist.  
                                                                         

Script Contao\ManagerBundle\Composer\ScriptHandler::initializeApplication handling the post-update-cmd event terminated with an exception

                                                                                             
  [RuntimeException]                                                                         
  An error occurred while executing the "contao:install-web-dir" command:                    
  In ContaoModuleBundle.php line 36:                                               
                                                                             
    The module folder "system/modules/contao-filecredits" does not exist. 

With Symfony 3.4.6 everything works fine.

The module name seems to be wrong and changed from 3.4.6 to 3.4.7:

• 3.4.6: system/modules/filecredits
• 3.4.7: system/modules/contao-filecredits

Issue by @fritzmg
July 18th, 2017, 13:32 GMT

Tested with the contao/managed-edition 4.4.1.

Reproduction

1. Manually install a Contao 3 extension that is compatible with Contao 4 by copying the extension folder to /system/modules.
2. Clear the cache.
3. Run the Install Tool.
4. Delete the extension folder from /system/modules again to uninstall the extension.
5. Run vendor/bin/contao-console cache:warmup or … cache:clear --no-warmup or … cache:clear. The following fatal error will occur:

PHP Fatal error:  Uncaught LogicException: The module folder "system/modules/news_sorted" does not exist. in …\vendor\contao\core-bundle\src\HttpKernel\Bundle\ContaoModuleBundle.php:36
Stack trace:
#0 …\vendor\contao\manager-plugin\src\Bundle\Config\ModuleConfig.php(53): Contao\CoreBundle\HttpKernel\Bundle\ContaoModuleBundle->__construct('news_sorted', 'C:\\xampp\\htdocs...')
#1 …\vendor\contao\manager-bundle\src\HttpKernel\ContaoKernel.php(232): Contao\ManagerPlugin\Bundle\Config\ModuleConfig->getBundleInstance(Object(Contao\ManagerBundle\HttpKernel\ContaoKernel))
#2 …\vendor\contao\manager-bundle\src\HttpKernel\ContaoKernel.php(53): Contao\ManagerBundle\HttpKernel\ContaoKernel->addBundlesFromPlugins(Array)
#3 …\vendor\symfony\symfony\src\Symfony\Component\HttpKernel\Kernel.php(450): Contao\ManagerBundle\HttpKernel\ContaoKernel->registerBundles()
#4 …\vendor\symfony\symfony\src\Symfony\Component\HttpKernel\K in …\vendor\contao\core-bundle\src\HttpKernel\Bundle\ContaoModuleBundle.php on line 36

The only way to uninstall such an extension is by deleting the extension folder and then deleting var/cache/prod manually.

hey,

when do you provide an up 2 date documentation for contao 4.5? =)
e.g. php requirements are outdated....

https://docs.contao.org/books/manual/current/de/01-installation/den-live-server-konfigurieren.html#contao-systemvoraussetzungen

Have:

• server Ubuntu 20.04 x64
• PHP 7.4.15
• Contao latest managed-edition
• FOS/http-cache-bundle 2.10.2
  When trying to run installer, I receive error:
  request.CRITICAL: Uncaught PHP Exception Exception: "Php8AttributesListener must not be loaded for PHP 7.4.15" at vendor/friendsofsymfony/http-cache-bundle/src/EventListener/Php8AttributesListener.php line 35 {"exception":"[object] (Exception(code: 0): Php8AttributesListener must not be loaded for PHP 7.4.15 at vendor/friendsofsymfony/http-cache-bundle/src/EventListener/Php8AttributesListener.php:35)"} []
  Quick investigation shows, that Php8AttributesListener must be loaded only for PHP 8.
  Why is it being loaded with Contao core, when in 7.4 environment?

This is a follow-up ticket for #29.

Unfortunately, adding $projectDir as first argument leads to an exception upon install:

composer run-script post-update-cmd
> Contao\ManagerBundle\Composer\ScriptHandler::initializeApplication

 Added/updated the web/app.php file.

 // Clearing the cache for the prod environment with debug                      
 // false                                                                       

21:37:54 ERROR     [console] Error thrown while running command "--ansi cache:clear --env=prod". Message: "Too few arguments to function Contao\ManagerBundle\HttpKernel\ContaoKernel::__construct(), 2 passed in /Users/leofeyer/Sites/contao/managed-edition/vendor/symfony/symfony/src/Symfony/Bundle/FrameworkBundle/Command/CacheClearCommand.php on line 262 and exactly 3 expected" ["error" => ArgumentCountError {trace: { …} …},"command" => "--ansi cache:clear --env=prod","message" => "Too few arguments to function Contao\ManagerBundle\HttpKernel\ContaoKernel::__construct(), 2 passed in /Users/leofeyer/Sites/contao/managed-edition/vendor/symfony/symfony/src/Symfony/Bundle/FrameworkBundle/Command/CacheClearCommand.php on line 262 and exactly 3 expected"] []
21:37:54 ERROR     [console] Command "--ansi cache:clear --env=prod" exited with code "1" ["command" => "--ansi cache:clear --env=prod","code" => 1] []

  [Symfony\Component\Debug\Exception\FatalThrowableError]                      
  Type error: Too few arguments to function Contao\ManagerBundle\HttpKernel\C  
  ontaoKernel::__construct(), 2 passed in /Users/leofeyer/Sites/contao/manage  
  d-edition/vendor/symfony/symfony/src/Symfony/Bundle/FrameworkBundle/Command  
  /CacheClearCommand.php on line 262 and exactly 3 expected                    

This is because the Symfony CacheClearCommand creates a temporary kernel, which of course does not know about our custom parameter.

@aschempp @ausi So I guess there is no other way then making the third argument optional?

Description

Today I wanted to set some routes to x-frame-option: allow to allow iframe inclusion. I tried to set the corresponding settings in my project config, but it always give me x-frame-options: sameorigin.
After a lot of searching and debugging I found the reason: the settings from this bundle are alway the first in the nelmio_security.clickjacking.paths parameter and my project settings are afterwards. But in NelmioSecurityBundle it uses alway the first match, so it always gives sameorigin. It is not possible to change the settings or unset them from the config. I needed to write a compiler pass to bypass this issue. While this is a good base to start a new extension, it would be great to have the option to simply set this from the config files.

Steps to reproduce:

1. Create a new contao managed edition project.
2. Create a page you want to have x-frame-origin: allow and give it a route starting with /extern
3. add this to your config.yml (maybe you need to import it to your config_prod.yml/config_dev.yml):

nelmio_security:
  clickjacking:
    paths:
      '^/extern/.*': ALLOW
      '^/.*': DENY

Bottom line

Maybe this is an issue due the handling of the treebuilder of symfony, that keeps the order of the config error, even if overwritten in a later config file (like in my reprodiction example).
Just wanted to let you know, maybe you have an idea to bypass this issue.

We should discuss if we want to add:

     if (false === $accessKey) {
         header('HTTP/1.0 403 Forbidden');
         die(sprintf('You are not allowed to access this file. Check %s for more information.', basename(__FILE__)));
     }
+
+    // Check for alternate authorization header set by FastCGI et al.
+    if (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) {
+        list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['REDIRECT_HTTP_AUTHORIZATION'], 6)));
+    }
 
     if (!isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])

This will provide the authorization in environments where the requests are proxied and therefore no HTTP_AUTHORIZATION environment variable is available.

Otherwise Contao 4.4 ME won't be compatible with php 7.2 :)

/* Use the "contao:install-web-dir" console command to set a password for the dev entry point. */

Damit können die wenigsten (neuen) Nutzer was anfangen. Ich selber musste per "help" auch erst schauen wie das gehen soll. Wer Symfony 3.3 noch nicht kennt, wird hier nicht schlau daraus.

So könnte das schon verständlicher sein,
contao:install-web-dir --user=USER --password[=PASSWORD]
sofern jeder weiß wie die contao-console aufzurufen ist.

Beachte dabei aber auch #39

Hi,
I have a Problem using the contao-manager.
The manager just work fine until it gets to the post-install-cmd Script of the composer.
After debugging a while I found out that this is because the PHP open_basedir is set.

So the command

I have tried to specify the binary hardcoded in the ScriptHandler.php

/*if (false === ($phpPath = $phpFinder->find())) {
     throw new \RuntimeException('The php executable could not be found.');
}*/
  $phpPath = '/usr/bin/php71';

and it just worked fine.
Where

'/usr/bin/php71'

is exactly the string I specified during the Manager Setup.

I cannot change the open_basedir settings, so is there a way to take the binary’s which I already specified on the Setup of the Manager and don’t try to get it with the Symfony Function ?

Es ist normalerweise nicht üblich auf Kommandozeile Login und Passwort als Parameter anzugeben, da diese beiden Informationen dann in der Befehls-History zu finden sind.
Ich hätte erwartet, dass es bei der Angabe ... --user=dev -p zur Abfrage kommt, wenn man hier nichts direkt angibt.
Ist das umsetzbar?
Stattdessen kommt:

  [InvalidArgumentException]               
  Cannot set a username without password.

Reproduction

1. create an app/config/config.yml with

doctrine:
    dbal:
        connections:
            second:
                driver:   pdo_mysql
                host:     '%second_database_host%'
                port:     '%second_database_port%'
                dbname:   '%second_database_name%'
                user:     '%second_database_user%'
                password: '%second_database_password%'
                charset:  UTF8

2. provide the database parameters in your app/config/parameters.yml

parameters:
    …
    second_database_host: …
    second_database_port: …
    second_database_user: …
    second_database_password: …
    second_database_name: …

3. try to access the second database connection with

\System::getContainer()->get('doctrine')->getConnection('second');

The following error will occur:

Doctrine ORM Connection named "second" does not exist.

Same with

\System::getContainer()->get('doctrine.dbal.second_connection');

»

You have requested a non-existent service "doctrine.dbal.second_connection". Did you mean this: "doctrine.dbal.default_connection"?

We should be able to circumvent the default AppCache by an env variable in case you want to use a real reverse proxy (Varnish, Litespeed etc.) in front of Contao.

The ScriptHandler::initializeApplication() method does a lot of things which are done by the install tool already. Because of this, I have to use the --no-scripts flag in the build.xml file and re-build parts of the functionality:

  <target name="prepare">
    <mkdir dir="contao-managed-${version}/app" />
    <exec executable="vendor/bin/contao-console" dir="contao-managed-${version}">
      <arg value="contao:install-web-dir" />
    </exec>
  </target>

I wonder what you want to accomplish with the method? If you

1. want to initialize the application without having to open the install tool after the installation process, the implementation is just fine. But if

2. the user is required to open the install tool after the installation process anyway, you might as well drop the lines so we can remove the --no-scripts flag from the build file again.

Not sure if this belongs here or into contao/manager-plugin, but I'd love to see a possibility to run composer post-install/update scripts in the managed edition, without the user having to manually add them to the project's composer.json.

In version 4.5, the cache:warmup was removed from

Contao\ManagerBundle\Composer\ScriptHandler::initializeApplication

Is there any particular reason why? This leaves the website in an inefficient state after a composer operation, if you do not manually run

vendor/bin/contao-console cache:warmup

In 423a683 the default configuration for authorized ips (lexik maintenance bundle) has been set to ['127.0.0.1'] as a quick fix for contao/core-bundle#1492.

How am I supposed to test the maintenance mode locally now (e.g. when working on a custom service_unavailable template) besides temporarily removing the setting again in my config like so (with the implications of the referenced ticket)?

lexik_maintenance:
    authorized:
        ips: []

btw.: The related PR in Symfony symfony/symfony#27309 that was in the way and leaded to the quickfix has been merged in 3.4.12.

Affected version(s)
Contao 4.4.45
Php 7.3.5

Description

During the installation I have this error
In ScriptHandler.php line 113:

An error occurred while executing the "contao:install-web-dir" command:
In MonologExtension.php line 55:

Symfony 5 is required for Monolog 2 support. Please downgrade Monolog to
version 1.

How to reproduce

Hi,

Trying to install contao 4.12 with composer:

$ composer create-project contao/managed-edition xxxx 4.12

After that the config/ directory is totally absent from the file tree (as is the config/config.yml file).

[vagrant@localhost - contao4]$ ls -ltha
total 476K
drwxrwxr-x. 13 501 games  416  2 déc.  09:53 .
drwxrwxr-x. 11 501 games  352  2 déc.  09:39 public
-rw-rw-r--.  1 501 games   93  2 déc.  09:14 .env
drwxrwxr-x.  5 501 games  160  2 déc.  09:11 var
drwxrwxr-x.  9 501 games  288  2 déc.  09:10 system
drwxrwxr-x.  2 501 games   64  2 déc.  09:10 files
drwxrwxr-x. 21 501 games  672  2 déc.  09:10 assets
drwxrwxr-x.  2 501 games   64  2 déc.  09:10 templates
drwxrwxr-x. 50 501 games 1,6K  2 déc.  09:09 vendor
-rw-rw-r--.  1 501 games 463K  2 déc.  09:09 composer.lock
drwxr-xr-x. 19 501 games  608  2 déc.  09:09 ..
-rw-rw-r--.  1 501 games  821 24 août  09:06 composer.json
-rw-rw-r--.  1 501 games  313 24 août  09:06 .gitignore

The documentation often refers to the config file. Do we have to create that file manually?

The documentation also states that le install tool is responsible of creating a config/parameters.yml. I did not use the install tool but exclusively the CLI. I created an .env file to override database DSN.

Since the config file doesn't exist, where are we supposed to tweak symfony and packages configuration?

There are some inconsistency in the documentation regarding which files contao would create for us and which files the developer should create manually.

The problem is the column rows. It didn't like that it was used unquoted (it's a reserved word after all). I issued the SQL manually with the column name quoted with backticks, and then it worked.

Possibly also a problem on MySQL.

Issue by @issue-bot
June 2nd, 2017, 21:12 GMT

Issue by @LinkingYou
June 2nd, 2017, 19:55 GMT

In der aktuellen Version 4.3.11 (Managed-Edition) funktioniert der integrierte Web-Server nicht mehr:

php vendor/bin/contao-console server:run

bringt folgenden Fehler:

  [Symfony\Component\Console\Exception\CommandNotFoundException]  
  There are no commands defined in the "server" namespace.   

Ist das beabsichtigt?

I had a brief look to the manager bundle. As far I can see there is no support for optional bundle dependencies in the load after definition.

A use case first that could be an extension which would modify the calendar and news bundle but does not require that both are installed.

1. Why is the bin/contao-console command not named bin/console?

2. Why did you add AnnotationRegistry::registerLoader([$loader, 'loadClass']); in the console script?

3. Why is the src/Resources/web/.htaccess.default file not named .htaccess and only copied if no .htaccess file exists? Is "having a custom .htaccess" file a supported case at all?

Some Webhoster are adding a .htaccess with an AddHandler in the web-folder if you change the PHP version.

For example: AddHandler application/x-httpd-php72 .php

Is it possible to merge the AddHandler during the creation of the .htaccess and overwrite the old version.

While testing the new Contao Manager everything went well, expect updating the database (domain.com/contao/install), while the needed lines in the .htaccess were missing.

Most of the stuff listed in https://github.com/contao/manager-bundle/blob/develop/src/ContaoManager/Plugin.php should go to the core-bundle.

The manager-bundle uses Symfony\Component\Process\Process in ScriptHandler::executeCommand. Its default timeout is 60 seconds. However, in some environments warming the cache can take a long time and thus the execution of this command ends with an exception:

 // Warming up the cache for the prod environment with debug false

Script Contao\ManagerBundle\Composer\ScriptHandler::initializeApplication handling the post-update-cmd event terminated with an exception


  [Symfony\Component\Process\Exception\ProcessTimedOutException]
  The process ""php" "…/vendor/contao/manager-bundle/src/Composer/../
  ../bin/contao-console" --ansi cache:warmup --env=prod" exceeded the timeout of 60 seconds.

See also https://community.contao.org/de/showthread.php?68815-gelöst-Contao-Manager-bricht-ab-(Timeout). There are a few more reported instances. They happen especially when the Contao Manager is in use.

As long as the Contao Manager does not have config options, it is currently not possible to configure things like prepend_local. We should add them to the parameters.yml which is the only file that can be customized per installation.

The only other option would be for everyone to write a ContaoManagerPlugin, which is a bit over-engineered 😂

After downloading contao 4.5.3 (manually) and extracting, pointing DocumentRoot to the web/ dir and calling /install.php I get this error

Parse error: syntax error, unexpected '?' in /data/web/sgcontao/vendor/contao/manager-bundle/src/ContaoManager/Plugin.php on line 137

Line 137 looks like this:
public function getRouteCollection(LoaderResolverInterface $resolver, KernelInterface $kernel): ?RouteCollection

Running on Ubuntu 16.04. with php 7.0

As written in #61 there is still a problem with Contao 4.4.* and Symfony 3.4.8+:

$container->getParameter('kernel.project_dir') returns /var/www/project/vendor/contao/manager-bundle because Kernel::getProjectDir() searches for the nearest composer.json file. As this parameter is used for TL_ROOT, this makes Contao 4.4-beta1 unusable in the managed edition.

I think we have to add a getProjectDir() method to the ContaoKernel.

the composer.json should require php 7.1 because in php 7.0 we cannot install contao at the moment because of "symfony/console": "^3.3.7" in contao-core requirements!

Or how am I supposed to enable the debug mode to dump template variables and see the template names that were used etc.?

Related to #22

Add a new Interface that allows to define the firewall configuration. An array of firewall configuration is passed to the method and the new config is expected.

interface FirewallPluginInterface
{
    /**
     * @return array
     */
    public function getFirewallConfig(array $config);
}

The manager bundle should handle this instead of just loading the security.yml from core-bundle.

The config file handling of the Contao Managed Edition behaves differently than in the standard symfony application setup. Usually you can have the following files:

app/config/config.yml
app/config/config_prod.yml
app/config/config_dev.yml

The contents of the config.yml are always loaded and then depending on the environment, the config_prod.yml or config_dev.yml is loaded additionally.

This is not the case in the ContaoKernel:

$loader->load(function (ContainerBuilder $container) use ($loader) {
    $environment = $container->getParameter('kernel.environment');

    if (file_exists($this->getRootDir().'/config/config_'.$environment.'.yml')) {
        $loader->load($this->getRootDir().'/config/config_'.$environment.'.yml');
    } elseif (file_exists($this->getRootDir().'/config/config.yml')) {
        $loader->load($this->getRootDir().'/config/config.yml');
    }
});

Here the config.yml only serves as a fallback. So if a config_prod.yml or config_dev.yml is present, only that config file is loaded.