Commit Graph

1114 Commits

Author SHA1 Message Date
Johannes M. Schmitt
4539b47522 [Security] small performance optimization 2011-03-14 17:41:33 +01:00
Bernhard Schussek
932f3b1f06 [Security] Fixed calls to EventDispatcher::dispatchEvent() 2011-03-13 21:30:50 +01:00
Bernhard Schussek
06c682b4fb Switched from Doctrine's EventManager implementation to the EventManager clone in Symfony2 (now called EventDispatcher again) 2011-03-13 19:49:10 +01:00
Johannes M. Schmitt
76573f1ab2 [Security] added some finals, some visibility changes 2011-03-13 19:40:12 +01:00
Bernhard Schussek
25931caeab Merge remote branch 'symfony/master' into event-manager
Conflicts:
	src/Symfony/Bundle/FrameworkBundle/Debug/TraceableEventManager.php
	src/Symfony/Bundle/WebProfilerBundle/WebDebugToolbarListener.php
	src/Symfony/Component/Security/Http/Firewall.php
	src/Symfony/Component/Security/Http/Firewall/AbstractAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/AbstractPreAuthenticatedListener.php
	src/Symfony/Component/Security/Http/Firewall/AccessListener.php
	src/Symfony/Component/Security/Http/Firewall/AnonymousAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/BasicAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/ChannelListener.php
	src/Symfony/Component/Security/Http/Firewall/ContextListener.php
	src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php
	src/Symfony/Component/Security/Http/Firewall/ListenerInterface.php
	src/Symfony/Component/Security/Http/Firewall/LogoutListener.php
	src/Symfony/Component/Security/Http/Firewall/RememberMeListener.php
	src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php
	tests/Symfony/Tests/Component/Security/Http/Firewall/RememberMeListenerTest.php
2011-03-13 19:15:25 +01:00
Johannes Schmitt
70867f06e9 re-added a __toString method for debugging purposes 2011-03-12 13:24:57 +01:00
Klaas Naaijkens
02cb362ae6 use username instead of token object in logging 2011-03-12 13:24:57 +01:00
Johannes Schmitt
97125269d2 [Security] fixed some tests 2011-03-11 12:50:52 +01:00
Johannes Schmitt
d8022e34eb [Security] removed core.security event 2011-03-11 01:43:22 +01:00
Johannes M. Schmitt
3d97638813 [Security] refactored remember-me code 2011-03-11 01:19:55 +01:00
Johannes M. Schmitt
a64cc0e3cc [Security] some more visibility changes 2011-03-10 10:25:33 +01:00
Johannes M. Schmitt
13665fc113 [Security] added some more tests 2011-03-10 10:25:33 +01:00
Johannes M. Schmitt
5127ece259 [Security] fixed some left-overs 2011-03-10 10:25:32 +01:00
Johannes Schmitt
1d5538fc60 [Security] various changes, see below
- visibility changes from protected to private
- AccountInterface -> UserInterface
- SecurityContext::vote() -> SecurityContext::isGranted()
2011-03-10 10:25:32 +01:00
Bernhard Schussek
2cf3779a2c Renamed EventArgs classes and adapted remaining code to EventManager
The only missing part is ContainerAwareEventManager::addEventSubscriberService(),
because I'm not sure how to find out the class name of a service in the DIC.

Also, inline documentation of this code needs to be finished once it is accepted.
2011-03-07 19:16:05 +01:00
Bernhard Schussek
a54d3e6fb0 Merge remote branch 'symfony/master' into event-manager 2011-03-07 19:15:57 +01:00
Fabien Potencier
8c423edfef replaced symfony-project.org by symfony.com 2011-03-06 12:40:06 +01:00
Bernhard Schussek
f1393d7b1f Replaced EventDispatcher by Doctrine's EventManager implementation
Doctrine's EventManager implementation has several advantages over the
EventDispatcher implementation of Symfony2. Therefore I suggest that we
use their implementation.

Advantages:

 * Event Listeners are objects, not callbacks. These objects have handler
   methods that have the same name as the event. This helps a lot when
   reading the code and makes the code for adding an event listener shorter.
 * You can create Event Subscribers, which are event listeners with an
   additional getSubscribedEvents() method. The benefit here is that the
   code that registers the subscriber doesn't need to know about its
   implementation.
 * All events are defined in static Events classes, so users of IDEs benefit
   of code completion
 * The communication between the dispatching class of an event and all
   listeners is done through a subclass of EventArgs. This subclass can be
   tailored to the type of event. A constructor, setters and getters can be
   implemented that verify the validity of the data set into the object.
   See examples below.
 * Because each event type corresponds to an EventArgs implementation,
   developers of event listeners can look up the available EventArgs methods
   and benefit of code completion.
 * EventArgs::stopPropagation() is more flexible and (IMO) clearer to use
   than notifyUntil(). Also, it is a concept that is also used in other
   event implementations

Before:

    class EventListener
    {
        public function handle(EventInterface $event, $data) { ... }
    }

    $dispatcher->connect('core.request', array($listener, 'handle'));
    $dispatcher->notify('core.request', new Event(...));

After (with listeners):

    final class Events
    {
        const onCoreRequest = 'onCoreRequest';
    }

    class EventListener
    {
        public function onCoreRequest(RequestEventArgs $eventArgs) { ... }
    }

    $evm->addEventListener(Events::onCoreRequest, $listener);
    $evm->dispatchEvent(Events::onCoreRequest, new RequestEventArgs(...));

After (with subscribers):

    class EventSubscriber
    {
        public function onCoreRequest(RequestEventArgs $eventArgs) { ... }

        public function getSubscribedEvents()
        {
            return Events::onCoreRequest;
        }
    }

    $evm->addEventSubscriber($subscriber);
    $evm->dispatchEvent(Events::onCoreRequest, new RequestEventArgs(...));
2011-03-05 15:30:34 +01:00
Johannes Schmitt
b67a1dd677 [Security] forward the entire access denied exception instead of only the message 2011-03-05 14:30:08 +01:00
Johannes Schmitt
63dbcea8ee Merge branch 'lewinski-fix-acl-schema-generator' into security 2011-03-05 14:13:53 +01:00
Johannes Schmitt
0eb4f49061 Merge branch 'fix-acl-schema-generator' of https://github.com/lewinski/symfony into lewinski-fix-acl-schema-generator 2011-03-05 13:54:10 +01:00
Johannes Schmitt
4c7aa343d3 Merge branch 'opensky-hotfix/remember-me-token-fix' into security 2011-03-05 13:51:52 +01:00
Johannes Schmitt
e03958f5b0 Merge branch 'cyqui-TICKET_9557' into security 2011-03-05 13:50:14 +01:00
Johannes Schmitt
f82b89cdc5 [Security] changed defaults for MessageDigestEncoder
- encode_as_base64 set to true
- iterations increased to 5000 from 1
2011-03-05 13:45:35 +01:00
Cyril Quintin
310a6c99a2 TICKET #9557: session isn't required when using http basic authentification mecanism for example 2011-03-05 13:33:56 +01:00
Johannes Schmitt
f010742e45 [Security] improved entropy to make collision attacks harder 2011-03-05 13:30:27 +01:00
Bulat Shakirzyanov
dbde41c082 [Security] added the 'key' attribute of RememberMeToken to serialized string to be stored in session 2011-03-04 13:26:08 -05:00
Pascal Borreli
843d5a8399 [Security] Fixed Typo 2011-03-01 18:58:08 +01:00
Matthew Lewinski
cde5f528c2 Fix the Acl schema generator script.
Change 3e818846 in doctrine/dbal introduced a number of new classes in
the Doctrine\DBAL\Platforms\Keywords namespace, so we need to be more
careful here when generating Acl schema, so as to only load Platform
classes and not any others in the same directory.
2011-02-27 16:56:47 -06:00
Fabien Potencier
c99a44b1e8 Merge remote branch 'schmittjoh/security'
* schmittjoh/security:
  [Security] added method to retrieve the configured remember-me parameter
  [Security] Copy token attributes when auth providers create a new token from another
2011-02-27 22:20:44 +01:00
Fabien Potencier
cdf6851eb3 fixed merge 2011-02-27 21:16:13 +01:00
Fabien Potencier
49f84f1997 Merge remote branch 'lsmith77/code_analyzer_2011_02_27'
* lsmith77/code_analyzer_2011_02_27:
  corrected NonceExpiredException namespace
  issues found by static code analysis
2011-02-27 21:12:31 +01:00
Christophe Coevoet
92bfbf575c Fixed CS 2011-02-27 20:56:29 +01:00
Lukas Kahwe Smith
2bf30f8bb7 corrected NonceExpiredException namespace 2011-02-27 19:46:40 +01:00
Lukas Kahwe Smith
4b3c49550f issues found by static code analysis 2011-02-27 19:34:02 +01:00
Pascal Borreli
787812d968 [Security] Removed useless else 2011-02-27 18:36:38 +01:00
Johannes Schmitt
97ee92e7b0 Merge branch 'CopyTokenAttributesInProviders' of https://github.com/opensky/symfony into opensky-CopyTokenAttributesInProviders 2011-02-26 21:47:57 +01:00
Johannes Schmitt
621a79f1f2 [Security] added method to retrieve the configured remember-me parameter 2011-02-26 21:44:40 +01:00
Pascal Borreli
2fbb8e07f8 [Security] Fixed typo 2011-02-26 20:02:06 +01:00
Jeremy Mikola
5113886f34 [Security] Copy token attributes when auth providers create a new token from another
PreAuthenticatedAuthenticationProvider and UserAuthenticationProvider tend to copy a token instead of modifying it during their authenticate() methods, which is probably a good idea if the token might be immutable. Ensure that the token's attributes get copied along with everything else.
2011-02-23 16:03:01 -05:00
Fabien Potencier
f54cedfe5e added LICENSE files for the subtree repositories 2011-02-22 18:58:15 +01:00
Fabien Potencier
353177d1d6 replaced Response::createRedirect by a new RedirectResponse class 2011-02-21 18:10:53 +01:00
Fabien Potencier
d94acd85f9 remove response as a service
The Response is not available in the DIC anymore.

When you need to create a response, create an instance of
Symfony\Component\HttpFoundation\Response instead.

As a side effect, the Controller::createResponse() and Controller::redirect()
methods have been removed and can easily be replaced as follows:

  return $this->createResponse('content', 200, array('foo' => 'bar'));
  return new Response('content', 200, array('foo' => 'bar'));

  return $this->redirect($url);
  return Response::createRedirect($url);
2011-02-21 17:36:04 +01:00
Johannes M. Schmitt
53f3ff8258 [Security] adds a chain user provider 2011-02-16 23:00:27 +01:00
Johannes Schmitt
82c6844147 [Security] moved Security classes out of DoctrineBundle, cleaned-up SecurityExtension accordingly
Note that this commit removes the built-in support for MongoDB user providers.
This code can be moved back in once there is a stable release for MongoDB, but
for now you have to set-up that user provider just like you would set-up any
custom user provider:

    security:
         providers:
             document_provider:
                 id: my.mongo.provider
2011-02-16 23:00:27 +01:00
Johannes Schmitt
dfd921822a [Security/Http] Adds CSRF protection to the form-login 2011-02-16 23:00:27 +01:00
Johannes M. Schmitt
d22743cf3a [Security] removed defaults from boolean columns 2011-02-16 23:00:27 +01:00
Victor Berchet
1d7f8120e0 Update code with latest Finder changes 2011-02-16 22:53:11 +01:00
Jeremy Mikola
cc4eb6b40f [Security] Add providerKey to PreAuthenticatedToken tokens constructed by PreAuthenticatedAuthenticationProvider 2011-02-15 21:55:24 +01:00
Jeremy Mikola
b8d574087f [Security] Allow authentication tokens to hold attributes 2011-02-15 21:50:02 +01:00
Johannes M. Schmitt
bc05bef2b9 [Security] fixes a bug in DigestAuthenticationListener 2011-02-14 20:55:07 +01:00
Johannes M. Schmitt
44b89e5ac3 [Security] fixes a bug when clearing cookies on logout 2011-02-14 20:55:07 +01:00
Johannes Schmitt
b685b3ab4d [Security] adds logout success handler 2011-02-14 20:55:07 +01:00
Johannes Schmitt
9e6fc0a11e [Security] fixes a bug where authentication errors might have leaked confidential information 2011-02-14 20:55:06 +01:00
Johannes Schmitt
5c7fe8f866 [Security] simplified encoder factory implementation 2011-02-14 20:55:06 +01:00
Johannes M. Schmitt
b9f4eab5c2 [Security/Acl] added pre-generated schemas 2011-02-14 20:55:06 +01:00
Deni
657f90a931 [Security] Fixed missed argument in call custom handler when authentication is successful. 2011-02-13 22:27:28 +01:00
dordille
205621dee8 Changed namepace use of SecurityContext to SecurityContextInterface so that constant SecurityContextInterface::LAST_USERNAME would resolve properly
Also changed method signature of __construct to take and instance of SecurityContextInterface instead of SecurityContext
2011-02-13 10:36:15 +01:00
Johannes M. Schmitt
3dfc09cd8d [Security] fixes some regressions 2011-02-13 00:15:57 +01:00
Jordi Boggiano
9bcd1b3e5f [Security] Fixed indenting 2011-02-12 22:14:16 +01:00
Johannes Schmitt
9749da6e52 [Security] performance improvements of PermissionGrantingStrategy 2011-02-12 21:53:04 +01:00
Johannes Schmitt
19bbafc441 [Security] Refactored security context, moved getUser() implementation to templating 2011-02-12 21:53:04 +01:00
Johannes Schmitt
66fbbd6b17 [Security] removed __toString() from AccountInterface 2011-02-12 21:53:04 +01:00
Christophe Coevoet
74b87294c2 Fixed access denied handling 2011-02-10 15:32:59 +01:00
Fabien Potencier
37537e3e8c fixed previous commit 2011-02-04 19:38:42 +01:00
Lukas Kahwe Smith
dd71501f54 some fixes by just "blindly" trying to make phpStorm code analysis happier 2011-02-04 19:30:28 +01:00
Lukas Kahwe Smith
661d5d236c fixed method call, cosmetic variable rename 2011-02-04 00:32:15 +01:00
Fabien Potencier
5288381f61 Revert "[Security] Missing Event namespace in SwitchUserListener"
This reverts commit 0169892dcd.
2011-02-02 14:35:29 +01:00
Jeremy Mikola
0169892dcd [Security] Missing Event namespace in SwitchUserListener 2011-02-02 11:32:56 +01:00
Johannes M. Schmitt
2b697423b4 [Security] bug fix in FormAuthenticationEntryPoint 2011-02-02 11:31:28 +01:00
Sebastian Utz
4d5853866a [Security] fixed a Token serialization bug 2011-02-02 11:31:28 +01:00
Johannes M. Schmitt
fbc21fedf7 [Security] some bug fixes 2011-02-02 11:31:28 +01:00
Sergey Linnik
92ddaa11cd Fixed typo 2011-01-28 18:46:27 +01:00
Bulat Shakirzyanov
81219bba15 [Security] fixed typo 2011-01-28 18:20:59 +01:00
Johannes M. Schmitt
8ccb8eb8c2 added two events "security.interactive_login", and "security.switch_user" 2011-01-27 13:49:01 +01:00
Johannes M. Schmitt
00d3d8c3bc renamed PreAuthenticatedListener to AbstractPreAuthenticatedListener to be consistent 2011-01-27 13:49:01 +01:00
Johannes Schmitt
139510a78e added some doc comments 2011-01-27 13:49:00 +01:00
Johannes M. Schmitt
cf64d2cfe7 namespace changes
Symfony\Component\Security -> Symfony\Component\Security\Core
Symfony\Component\Security\Acl remains unchanged
Symfony\Component\HttpKernel\Security -> Symfony\Component\Security\Http
2011-01-26 22:23:20 +01:00
Johannes Schmitt
e0fe42d050 removed isAuthenticated() from SecurityContext 2011-01-26 16:38:54 +01:00
Johannes Schmitt
57ae50e894 [Security] many improvements, and fixes 2011-01-26 16:38:54 +01:00
Lukas Kahwe Smith
ddea635a51 fixes else -> } else 2011-01-19 07:20:23 +01:00
Dominique Bongiraud
64fb94c725 normalized license messages in PHP files 2011-01-18 08:07:46 +01:00
Fabien Potencier
1c3a01b25c removed duplicate code 2011-01-07 17:14:41 +01:00
Johannes M. Schmitt
314defa8b4 added generic encoder factory 2011-01-06 19:20:56 +01:00
Johannes M. Schmitt
0449dbdc5d added extra exception if only a partial result is found 2011-01-05 22:51:05 +01:00
Johannes M. Schmitt
55a48bcfa6 optimized AclVoter, added unit test 2011-01-03 07:46:16 +01:00
Johannes M. Schmitt
a99d8c8558 fix possible duplicate security identities 2011-01-02 10:53:54 +01:00
Johannes Schmitt
b4288459cc added ACL system to the Security Component 2010-12-31 09:25:53 +01:00
Johannes Schmitt
27f540463a added generic encoder factory 2010-12-21 16:23:46 +01:00
Fabien Potencier
b57411b5ec renamed reloadUserByAccount() to loadUserByAccount() 2010-12-18 08:15:13 +01:00
Johannes Schmitt
df6ffbbf07 remove user provider name 2010-12-18 08:10:53 +01:00
Johannes Schmitt
3c692bd160 fixed user refreshing after unserialization 2010-12-15 17:38:30 +01:00
Johannes Schmitt
abe8047262 added authentication trust resolver 2010-12-12 10:49:43 +01:00
Fabien Potencier
9944542811 [Security] fixed method visibility 2010-12-12 08:02:13 +01:00
Fabien Potencier
131776001f removed ForbiddenHttpException
Both HttpKernel and Security define a 403 exception:

* Symfony\Component\HttpKernel\Exception\ForbiddenHttpException
* Symfony\Component\Security\Exception\AccessDeniedException

The one in HttpKernel has been removed in favor of the Security one.
2010-12-10 09:00:06 +01:00
Fabien Potencier
944d91c1df made some method name changes to have a better coherence throughout the framework
When an object has a "main" many relation with related "things" (objects,
parameters, ...), the method names are normalized:

 * get()
 * set()
 * all()
 * replace()
 * remove()
 * clear()
 * isEmpty()
 * add()
 * register()
 * count()
 * keys()

The classes below follow this method naming convention:

 * BrowserKit\CookieJar -> Cookie
 * BrowserKit\History -> Request
 * Console\Application -> Command
 * Console\Application\Helper\HelperSet -> HelperInterface
 * DependencyInjection\Container -> services
 * DependencyInjection\ContainerBuilder -> services
 * DependencyInjection\ParameterBag\ParameterBag -> parameters
 * DependencyInjection\ParameterBag\FrozenParameterBag -> parameters
 * DomCrawler\Form -> FormField
 * EventDispatcher\Event -> parameters
 * Form\FieldGroup -> Field
 * HttpFoundation\HeaderBag -> headers
 * HttpFoundation\ParameterBag -> parameters
 * HttpFoundation\Session -> attributes
 * HttpKernel\Profiler\Profiler -> DataCollectorInterface
 * Routing\RouteCollection -> Route
 * Security\Authentication\AuthenticationProviderManager -> AuthenticationProviderInterface
 * Templating\Engine -> HelperInterface
 * Translation\MessageCatalogue -> messages

The usage of these methods are only allowed when it is clear that there is a
main relation:

 * a CookieJar has many Cookies;

 * a Container has many services and many parameters (as services is the main
   relation, we use the naming convention for this relation);

 * a Console Input has many arguments and many options. There is no "main"
   relation, and so the naming convention does not apply.

For many relations where the convention does not apply, the following methods
must be used instead (where XXX is the name of the related thing):

 * get()      -> getXXX()
 * set()      -> setXXX()
 * all()      -> getXXXs()
 * replace()  -> setXXXs()
 * remove()   -> removeXXX()
 * clear()    -> clearXXX()
 * isEmpty()  -> isEmptyXXX()
 * add()      -> addXXX()
 * register() -> registerXXX()
 * count()    -> countXXX()
 * keys()
2010-11-25 17:30:06 +01:00
Fabien Potencier
a19cdce1bc [Security] added some missing unit tests 2010-10-31 23:41:36 +01:00
Fabien Potencier
ec417578ca [Security] added unit tests to some authenticated providers (code coverage is more than 96% for the Security component now) 2010-10-31 15:41:15 +01:00
Fabien Potencier
3d5054f21f [Security] added unit tests for the Authentication sub-namespace 2010-10-31 13:39:12 +01:00
Johannes M. Schmitt
3463f47698 applies base64 encoding directly to the binary data instead of their hexadecimal representation 2010-10-24 10:57:06 +02:00
Dominique Bongiraud
a85bca395a [Security]Fixed markup 2010-10-24 09:55:32 +02:00
Dominique Bongiraud
66ff8073b9 [Security]Fixed CS 2010-10-24 09:55:31 +02:00
Fabien Potencier
4027f751e3 [Security] added more unit tests 2010-10-22 17:48:58 +02:00
Fabien Potencier
d2b184e058 [Security] removed type hint in AuthenticationException as the extra information can be of different classes 2010-10-22 15:19:13 +02:00
Johannes Schmitt
d077ac4158 [Security] changed encoders to use hash() function whenver possible and replaced sha1 with sha256 as default algorithm 2010-10-22 13:24:29 +02:00
Victor Berchet
4dacdcc4ec [Security] Use a negative length parameter to simplify the code 2010-10-21 18:24:57 +02:00
Fabien Potencier
82f8ab839f [Security] added some unit tests (WIP) 2010-10-21 18:14:32 +02:00
Fabien Potencier
836c512585 fixed interfaces problems 2010-10-21 17:16:31 +02:00
Artur Kotyrba
2682bc2be5 [Security] Fixed typo 2010-10-21 08:30:46 +02:00
Fabien Potencier
0749038e73 [Security] changed the way passwords are compared to avoid timing attacks 2010-10-21 07:36:55 +02:00
Pascal Borreli
437f8c7a86 [Security] Fixed typo 2010-10-20 07:07:54 +02:00
Pascal Borreli
d067d5da69 [Security] Fixed coding standard 2010-10-19 17:22:31 +02:00
Pascal Borreli
fde278d7a8 [Security] Fixed typo 2010-10-19 17:21:28 +02:00
Fabien Potencier
f216f313e8 added the Security Component and its integration into the MVC framework
Happy birthday symfony!
2010-10-19 13:33:17 +02:00