diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make the session entry for the target url firewall dependent.

Browse Source 
If there are two firewalls (eg. main and admin), calling an protected admin url
will direct you to the login form of the admin. If I ignore this and go to the login
form of the main firewall directly I will end up being redirected to the stored
admin target url. This is not what you usually want to happen.
This commit is contained in:
Uwe Jäger 2012-05-24 15:16:38 +02:00
parent 45849ce306
commit 8ffaafa867
4 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php
View File

@ -551,13 +551,14 @@ class SecurityExtension extends Extension
{
$exceptionListenerId = 'security.exception_listener.'.$id;
$listener = $container->setDefinition($exceptionListenerId, new DefinitionDecorator('security.exception_listener'));
$listener->replaceArgument(3, null === $defaultEntryPoint ? null : new Reference($defaultEntryPoint));
$listener->replaceArgument(3, $id);
$listener->replaceArgument(4, null === $defaultEntryPoint ? null : new Reference($defaultEntryPoint));
// access denied handler setup
if (isset($config['access_denied_handler'])) {
$listener->replaceArgument(5, new Reference($config['access_denied_handler']));
$listener->replaceArgument(6, new Reference($config['access_denied_handler']));
} elseif (isset($config['access_denied_url'])) {
$listener->replaceArgument(4, $config['access_denied_url']);
$listener->replaceArgument(5, $config['access_denied_url']);
}
return $exceptionListenerId;

1
src/Symfony/Bundle/SecurityBundle/Resources/config/security_listeners.xml
View File

@ -158,6 +158,7 @@
<argument type="service" id="security.context" />
<argument type="service" id="security.authentication.trust_resolver" />
<argument type="service" id="security.http_utils" />
<argument />
<argument type="service" id="security.authentication.entry_point" on-invalid="null" />
<argument>%security.access.denied_url%</argument>
<argument type="service" id="security.access.denied_handler" on-invalid="null" />

4
src/Symfony/Component/Security/Http/Firewall/AbstractAuthenticationListener.php
View File

@ -271,8 +271,8 @@ abstract class AbstractAuthenticationListener implements ListenerInterface
}
$session = $request->getSession();
if ($targetUrl = $session->get('_security.target_path')) {
$session->remove('_security.target_path');
if ($targetUrl = $session->get('_security.' . $this->providerKey . '.target_path')) {
$session->remove('_security.' . $this->providerKey . '.target_path');
return $targetUrl;
}

6
src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php
View File

@ -39,6 +39,7 @@ use Symfony\Component\EventDispatcher\EventDispatcherInterface;
class ExceptionListener
{
private $context;
private $providerKey;
private $accessDeniedHandler;
private $authenticationEntryPoint;
private $authenticationTrustResolver;
@ -46,11 +47,12 @@ class ExceptionListener
private $logger;
private $httpUtils;
public function __construct(SecurityContextInterface $context, AuthenticationTrustResolverInterface $trustResolver, HttpUtils $httpUtils, AuthenticationEntryPointInterface $authenticationEntryPoint = null, $errorPage = null, AccessDeniedHandlerInterface $accessDeniedHandler = null, LoggerInterface $logger = null)
public function __construct(SecurityContextInterface $context, AuthenticationTrustResolverInterface $trustResolver, HttpUtils $httpUtils, $providerKey, AuthenticationEntryPointInterface $authenticationEntryPoint = null, $errorPage = null, AccessDeniedHandlerInterface $accessDeniedHandler = null, LoggerInterface $logger = null)
{
$this->context = $context;
$this->accessDeniedHandler = $accessDeniedHandler;
$this->httpUtils = $httpUtils;
$this->providerKey = $providerKey;
$this->authenticationEntryPoint = $authenticationEntryPoint;
$this->authenticationTrustResolver = $trustResolver;
$this->errorPage = $errorPage;
@ -180,7 +182,7 @@ class ExceptionListener
{
// session isn't required when using http basic authentication mechanism for example
if ($request->hasSession()) {
$request->getSession()->set('_security.target_path', $request->getUri());
$request->getSession()->set('_security.' . $this->providerKey . '.target_path', $request->getUri());
}
}
}