diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener

Browse Source 
* cve-2018-11385-3.4:
  migrating session for UsernamePasswordJsonAuthenticationListener
This commit is contained in:
Fabien Potencier 2018-05-23 15:56:36 +02:00
commit b5fef05c1b
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php
View File

@ -139,6 +139,8 @@ class UsernamePasswordJsonAuthenticationListener implements ListenerInterface
$this->logger->info('User has been authenticated successfully.', array('username' => $token->getUsername()));
}
$this->migrateSession($request);
$this->tokenStorage->setToken($token);
if (null !== $this->eventDispatcher) {
@ -182,4 +184,15 @@ class UsernamePasswordJsonAuthenticationListener implements ListenerInterface
return $response;
}
private function migrateSession(Request $request)
{
if (!$request->hasSession() || !$request->hasPreviousSession()) {
return;
}
// Destroying the old session is broken in php 5.4.0 - 5.4.10
// See https://bugs.php.net/63379
$destroy = \PHP_VERSION_ID < 50400 || \PHP_VERSION_ID >= 50411;
$request->getSession()->migrate($destroy);
}
}