diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Security] Replace message data in JSON security error response

Browse Source
This commit is contained in:
Wouter de Jong 2021-01-16 16:38:06 +01:00
parent 8fc46dc894
commit 5e5795acd1
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/Symfony/Component/Security/Http/Authenticator/JsonLoginAuthenticator.php
View File

@ -126,10 +126,10 @@ class JsonLoginAuthenticator implements InteractiveAuthenticatorInterface
public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
{
if (null === $this->failureHandler) {
$errorMessage = $exception->getMessageKey();
if (null !== $this->translator) {
$errorMessage = $this->translator->trans($exception->getMessageKey(), $exception->getMessageData(), 'security');
} else {
$errorMessage = strtr($exception->getMessageKey(), $exception->getMessageData());
}
return new JsonResponse(['error' => $errorMessage], JsonResponse::HTTP_UNAUTHORIZED);

19
src/Symfony/Component/Security/Http/Tests/Authenticator/JsonLoginAuthenticatorTest.php
View File

@ -147,6 +147,25 @@ class JsonLoginAuthenticatorTest extends TestCase
$this->assertSame(['error' => 'foo'], json_decode($response->getContent(), true));
}
public function testOnFailureReplacesMessageDataWithoutTranslator()
{
$this->setUpAuthenticator();
$response = $this->authenticator->onAuthenticationFailure(new Request(), new class() extends AuthenticationException {
public function getMessageData(): array
{
return ['%failed_attempts%' => 3];
}
public function getMessageKey(): string
{
return 'Session locked after %failed_attempts% failed attempts.';
}
});
$this->assertSame(['error' => 'Session locked after 3 failed attempts.'], json_decode($response->getContent(), true));
}
private function setUpAuthenticator(array $options = [])
{
$this->authenticator = new JsonLoginAuthenticator(new HttpUtils(), $this->userProvider, null, null, $options);