Archived

This repository has been archived on 2023-08-20. You can view files and clone it, but cannot push or open issues or pull requests.

Fabien Potencier 374d70568c feature #37620 [Security] Use NullToken while checking authorization (wouterj)

This PR was merged into the 5.2-dev branch.

Discussion
----------

[Security] Use NullToken while checking authorization

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | Fix #37523
| License       | MIT
| Doc PR        | tbd

This allows voters to grant access to unauthenticated users. E.g. some objects can be viewed by anyone, in this case the voter has to be able to grant access to unauthenticated users.

This *does break* the interface PHPdoc of `TokenInterface`: `getUser()` returns `null` instead of `string|UserInterface`. This is only true when using the new system, so not a real BC break. I think the only thing we can do to "guide" users is to add some custom handling for type errors related to `null` and `UserInterface` methods ("Did you forgot to check for `null` in the Voter?"). Is this something I should add to this PR?

Commits
-------

e37091541c Use NullToken while checking authorization

2020-07-31 08:44:47 +02:00

1.1 KiB

Raw Blame History

UPGRADE FROM 5.1 to 5.2

DependencyInjection

Deprecated Definition::setPrivate() and Alias::setPrivate(), use setPublic() instead

Mime

Deprecated Address::fromString(), use Address::create() instead

TwigBundle

Deprecated the public twig service to private.

TwigBridge

Changed 2nd argument type of TranslationExtension::__construct() to TranslationNodeVisitor

Validator

Deprecated the allowEmptyString option of the Length constraint.

Before:

use Symfony\Component\Validator\Constraints as Assert;

/**
 * @Assert\Length(min=5, allowEmptyString=true)
 */

After:

use Symfony\Component\Validator\Constraints as Assert;

/**
 * @Assert\AtLeastOneOf({
 *     @Assert\Blank(),
 *     @Assert\Length(min=5)
 * })
 */

Security

[BC break] In the experimental authenticator-based system, * TokenInterface::getUser() returns null in case of unauthenticated session.

1.1 KiB Raw Blame History