diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

merged branch adrienbrault/security-feature (PR #4776)

Browse Source 
This PR was merged into the master branch.

Discussion
----------

[2.2] [Security] Add an option to disable the hasPreviousSession() check in AbstractAuthenticationListener

Bug fix: no
Feature addition: yes
Backwards compatibility break: no
Symfony2 tests pass: [![Build Status](https://secure.travis-ci.org/adrienbrault/symfony.png?branch=security-feature)](http://travis-ci.org/adrienbrault/symfony)
Fixes the following tickets: #3703
Todo: Add this option to the symfony doc security configuration reference
License of the code: MIT
Documentation PR: N/A

As stated in #3703, all authentication listeners that inherit from AbstractAuthenticationListener, only work when a previous session has been created.
This PR allows to change the default behavior in the security.yml file.

Example:

```yml
security:
    firewalls:
        secured_area:
            pattern:    ^/demo/secured/
            form_login:
                check_path: /demo/secured/login_check
                login_path: /demo/secured/login
                require_previous_session: false # The default value is true
            logout:
                path:   /demo/secured/logout
                target: /demo/
            #anonymous: ~
            #http_basic:
            #    realm: "Secured Demo Area"
```

PS: While removing my old commit, it closed the #4774 PR ...

Commits
-------

0562463 [Security] Add an option to disable the hasPreviousSession() check in AbstractAuthenticationListener
This commit is contained in:
Fabien Potencier 2013-03-23 14:17:47 +01:00
commit aa26e663b1
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/AbstractFactory.php
View File

@ -44,6 +44,7 @@ abstract class AbstractFactory implements SecurityFactoryInterface
'failure_forward' => false,
'login_path' => '/login',
'failure_path_parameter' => '_failure_path',
'require_previous_session' => true,
);
public function create(ContainerBuilder $container, $id, $config, $userProviderId, $defaultEntryPointId)

10
src/Symfony/Component/Security/Http/Firewall/AbstractAuthenticationListener.php
View File

@ -92,6 +92,14 @@ abstract class AbstractAuthenticationListener implements ListenerInterface
$this->failureHandler = $failureHandler;
$this->options = array_merge(array(
'check_path' => '/login_check',
'login_path' => '/login',
'always_use_default_target_path' => false,
'default_target_path' => '/',
'target_path_parameter' => '_target_path',
'use_referer' => false,
'failure_path' => null,
'failure_forward' => false,
'require_previous_session' => true,
), $options);
$this->logger = $logger;
$this->dispatcher = $dispatcher;
@ -129,7 +137,7 @@ abstract class AbstractAuthenticationListener implements ListenerInterface
}
try {
if (!$request->hasPreviousSession()) {
if ($this->options['require_previous_session'] && !$request->hasPreviousSession()) {
throw new SessionUnavailableException('Your session has timed out, or you have disabled cookies.');
}