Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit44b6ad7

Browse files
committed
Show user account status errors
1 parent34994f1 commit44b6ad7

File tree

10 files changed

+71
-10
lines changed

10 files changed

+71
-10
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ public function getConfigTreeBuilder()
9191
->defaultValue(SessionAuthenticationStrategy::MIGRATE)
9292
->end()
9393
->booleanNode('hide_user_not_found')->defaultTrue()->end()
94+
->booleanNode('show_account_status_exceptions')->defaultFalse()->end()
9495
->booleanNode('always_authenticate_before_granting')
9596
->defaultFalse()
9697
->setDeprecated('symfony/security-bundle','5.4')

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ public function load(array $configs, ContainerBuilder $container)
170170

171171
$container->setParameter('security.access.always_authenticate_before_granting',$config['always_authenticate_before_granting']);
172172
$container->setParameter('security.authentication.hide_user_not_found',$config['hide_user_not_found']);
173+
$container->setParameter('security.authentication.show_account_status_exceptions',$config['show_account_status_exceptions']);
173174

174175
if (class_exists(Application::class)) {
175176
$loader->load('debug_console.php');

‎src/Symfony/Bundle/SecurityBundle/Resources/config/guard.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
service('logger')->nullOnInvalid(),
5151
param('security.authentication.hide_user_not_found'),
5252
service('security.token_storage'),
53+
param('security.authentication.show_account_status_exceptions'),
5354
])
5455
->tag('monolog.logger', ['channel' =>'security'])
5556
->deprecate('symfony/security-bundle','5.3','The "%service_id%" service is deprecated, use the new authenticator system instead.')

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_authenticator.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
param('security.authentication.manager.erase_credentials'),
4747
param('security.authentication.hide_user_not_found'),
4848
abstract_arg('required badges'),
49+
param('security.authentication.show_account_status_exceptions'),
4950
])
5051
->tag('monolog.logger', ['channel' =>'security'])
5152

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_legacy.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@
122122
abstract_arg('Provider-shared Key'),
123123
service('security.password_hasher_factory'),
124124
param('security.authentication.hide_user_not_found'),
125+
param('security.authentication.show_account_status_exceptions'),
125126
])
126127
->deprecate('symfony/security-bundle','5.3','The "%service_id%" service is deprecated, use the new authenticator system instead.')
127128

@@ -136,6 +137,7 @@
136137
param('security.authentication.hide_user_not_found'),
137138
abstract_arg('search dn'),
138139
abstract_arg('search password'),
140+
param('security.authentication.show_account_status_exceptions'),
139141
])
140142
->deprecate('symfony/security-bundle','5.3','The "%service_id%" service is deprecated, use the new authenticator system instead.')
141143

‎src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,9 @@ class DaoAuthenticationProvider extends UserAuthenticationProvider
4242
/**
4343
* @param PasswordHasherFactoryInterface $hasherFactory
4444
*/
45-
publicfunction__construct(UserProviderInterface$userProvider,UserCheckerInterface$userChecker,string$providerKey,$hasherFactory,bool$hideUserNotFoundExceptions =true)
45+
publicfunction__construct(UserProviderInterface$userProvider,UserCheckerInterface$userChecker,string$providerKey,$hasherFactory,bool$hideUserNotFoundExceptions =true,bool$showAccountStatusExceptions =false)
4646
{
47-
parent::__construct($userChecker,$providerKey,$hideUserNotFoundExceptions);
47+
parent::__construct($userChecker,$providerKey,$hideUserNotFoundExceptions,$showAccountStatusExceptions);
4848

4949
if ($hasherFactoryinstanceof EncoderFactoryInterface) {
5050
trigger_deprecation('symfony/security-core','5.3','Passing a "%s" instance to the "%s" constructor is deprecated, use "%s" instead.', EncoderFactoryInterface::class,__CLASS__, PasswordHasherFactoryInterface::class);

‎src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,9 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
4242
private$searchDn;
4343
private$searchPassword;
4444

45-
publicfunction__construct(UserProviderInterface$userProvider,UserCheckerInterface$userChecker,string$providerKey,LdapInterface$ldap,string$dnString ='{user_identifier}',bool$hideUserNotFoundExceptions =true,string$searchDn ='',string$searchPassword ='')
45+
publicfunction__construct(UserProviderInterface$userProvider,UserCheckerInterface$userChecker,string$providerKey,LdapInterface$ldap,string$dnString ='{user_identifier}',bool$hideUserNotFoundExceptions =true,string$searchDn ='',string$searchPassword ='',bool$showAccountStatusExceptions =false)
4646
{
47-
parent::__construct($userChecker,$providerKey,$hideUserNotFoundExceptions);
47+
parent::__construct($userChecker,$providerKey,$hideUserNotFoundExceptions,$showAccountStatusExceptions);
4848

4949
$this->userProvider =$userProvider;
5050
$this->ldap =$ldap;

‎src/Symfony/Component/Security/Core/Authentication/Provider/UserAuthenticationProvider.php

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
namespaceSymfony\Component\Security\Core\Authentication\Provider;
1313

14+
useException;
1415
useSymfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
1516
useSymfony\Component\Security\Core\Authentication\Token\TokenInterface;
1617
useSymfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
@@ -37,11 +38,12 @@ abstract class UserAuthenticationProvider implements AuthenticationProviderInter
3738
private$hideUserNotFoundExceptions;
3839
private$userChecker;
3940
private$providerKey;
41+
private$showAccountStatusExceptions;
4042

4143
/**
4244
* @throws \InvalidArgumentException
4345
*/
44-
publicfunction__construct(UserCheckerInterface$userChecker,string$providerKey,bool$hideUserNotFoundExceptions =true)
46+
publicfunction__construct(UserCheckerInterface$userChecker,string$providerKey,bool$hideUserNotFoundExceptions =true,bool$showAccountStatusExceptions =false)
4547
{
4648
if (empty($providerKey)) {
4749
thrownew \InvalidArgumentException('$providerKey must not be empty.');
@@ -50,6 +52,7 @@ public function __construct(UserCheckerInterface $userChecker, string $providerK
5052
$this->userChecker =$userChecker;
5153
$this->providerKey =$providerKey;
5254
$this->hideUserNotFoundExceptions =$hideUserNotFoundExceptions;
55+
$this->showAccountStatusExceptions =$showAccountStatusExceptions;
5356
}
5457

5558
/**
@@ -86,7 +89,7 @@ public function authenticate(TokenInterface $token)
8689
$this->checkAuthentication($user,$token);
8790
$this->userChecker->checkPostAuth($user);
8891
}catch (AccountStatusException|BadCredentialsException$e) {
89-
if ($this->hideUserNotFoundExceptions && !$einstanceof CustomUserMessageAccountStatusException) {
92+
if ($this->isFilteredException($e)) {
9093
thrownewBadCredentialsException('Bad credentials.',0,$e);
9194
}
9295

@@ -131,4 +134,17 @@ abstract protected function retrieveUser(string $username, UsernamePasswordToken
131134
* @throws AuthenticationException if the credentials could not be validated
132135
*/
133136
abstractprotectedfunctioncheckAuthentication(UserInterface$user,UsernamePasswordToken$token);
137+
138+
privatefunctionisFilteredException(Exception$exception):bool
139+
{
140+
if (!$this->hideUserNotFoundExceptions) {
141+
returnfalse;
142+
}
143+
144+
if ($this->showAccountStatusExceptions) {
145+
returnfalse;
146+
}
147+
148+
return !$exceptioninstanceof CustomUserMessageAccountStatusException;
149+
}
134150
}

‎src/Symfony/Component/Security/Guard/Firewall/GuardAuthenticationListener.php

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
namespaceSymfony\Component\Security\Guard\Firewall;
1313

14+
useException;
1415
usePsr\Log\LoggerInterface;
1516
useSymfony\Component\HttpFoundation\Request;
1617
useSymfony\Component\HttpFoundation\Response;
@@ -51,12 +52,13 @@ class GuardAuthenticationListener extends AbstractListener
5152
private$rememberMeServices;
5253
private$hideUserNotFoundExceptions;
5354
private$tokenStorage;
55+
private$showAccountStatusExceptions;
5456

5557
/**
5658
* @param string $providerKey The provider (i.e. firewall) key
5759
* @param iterable<array-key, AuthenticatorInterface> $guardAuthenticators The authenticators, with keys that match what's passed to GuardAuthenticationProvider
5860
*/
59-
publicfunction__construct(GuardAuthenticatorHandler$guardHandler,AuthenticationManagerInterface$authenticationManager,string$providerKey,iterable$guardAuthenticators, ?LoggerInterface$logger =null,bool$hideUserNotFoundExceptions =true, ?TokenStorageInterface$tokenStorage =null)
61+
publicfunction__construct(GuardAuthenticatorHandler$guardHandler,AuthenticationManagerInterface$authenticationManager,string$providerKey,iterable$guardAuthenticators, ?LoggerInterface$logger =null,bool$hideUserNotFoundExceptions =true, ?TokenStorageInterface$tokenStorage =null,bool$showAccountStatusExceptions =false)
6062
{
6163
if (empty($providerKey)) {
6264
thrownew \InvalidArgumentException('$providerKey must not be empty.');
@@ -69,6 +71,7 @@ public function __construct(GuardAuthenticatorHandler $guardHandler, Authenticat
6971
$this->logger =$logger;
7072
$this->hideUserNotFoundExceptions =$hideUserNotFoundExceptions;
7173
$this->tokenStorage =$tokenStorage;
74+
$this->showAccountStatusExceptions =$showAccountStatusExceptions;
7275
}
7376

7477
/**
@@ -180,7 +183,7 @@ private function executeGuardAuthenticator(string $uniqueGuardKey, Authenticator
180183

181184
// Avoid leaking error details in case of invalid user (e.g. user not found or invalid account status)
182185
// to prevent user enumeration via response content
183-
if ($this->hideUserNotFoundExceptions &&($einstanceof UsernameNotFoundException || ($einstanceof AccountStatusException && !$einstanceof CustomUserMessageAccountStatusException))) {
186+
if ($this->isFilteredException($e)) {
184187
$e =newBadCredentialsException('Bad credentials.',0,$e);
185188
}
186189

@@ -247,4 +250,21 @@ private function triggerRememberMe(AuthenticatorInterface $guardAuthenticator, R
247250

248251
$this->rememberMeServices->loginSuccess($request,$response,$token);
249252
}
253+
254+
privatefunctionisFilteredException(Exception$exception):bool
255+
{
256+
if (!$this->hideUserNotFoundExceptions) {
257+
returnfalse;
258+
}
259+
260+
if ($exceptioninstanceof UsernameNotFoundException) {
261+
returntrue;
262+
}
263+
264+
if ($this->showAccountStatusExceptions) {
265+
returnfalse;
266+
}
267+
268+
return$exceptioninstanceof AccountStatusException && !$exceptioninstanceof CustomUserMessageAccountStatusException;
269+
}
250270
}

‎src/Symfony/Component/Security/Http/Authentication/AuthenticatorManager.php

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,12 @@ class AuthenticatorManager implements AuthenticatorManagerInterface, UserAuthent
5454
private$firewallName;
5555
private$hideUserNotFoundExceptions;
5656
private$requiredBadges;
57+
private$showAccountStatusExceptions;
5758

5859
/**
5960
* @param iterable<mixed, AuthenticatorInterface> $authenticators
6061
*/
61-
publicfunction__construct(iterable$authenticators,TokenStorageInterface$tokenStorage,EventDispatcherInterface$eventDispatcher,string$firewallName, ?LoggerInterface$logger =null,bool$eraseCredentials =true,bool$hideUserNotFoundExceptions =true,array$requiredBadges = [])
62+
publicfunction__construct(iterable$authenticators,TokenStorageInterface$tokenStorage,EventDispatcherInterface$eventDispatcher,string$firewallName, ?LoggerInterface$logger =null,bool$eraseCredentials =true,bool$hideUserNotFoundExceptions =true,array$requiredBadges = [],bool$showAccountStatusExceptions =false)
6263
{
6364
$this->authenticators =$authenticators;
6465
$this->tokenStorage =$tokenStorage;
@@ -68,6 +69,7 @@ public function __construct(iterable $authenticators, TokenStorageInterface $tok
6869
$this->eraseCredentials =$eraseCredentials;
6970
$this->hideUserNotFoundExceptions =$hideUserNotFoundExceptions;
7071
$this->requiredBadges =$requiredBadges;
72+
$this->showAccountStatusExceptions =$showAccountStatusExceptions;
7173
}
7274

7375
/**
@@ -269,7 +271,7 @@ private function handleAuthenticationFailure(AuthenticationException $authentica
269271

270272
// Avoid leaking error details in case of invalid user (e.g. user not found or invalid account status)
271273
// to prevent user enumeration via response content comparison
272-
if ($this->hideUserNotFoundExceptions &&($authenticationExceptioninstanceof UserNotFoundException || ($authenticationExceptioninstanceof AccountStatusException && !$authenticationExceptioninstanceof CustomUserMessageAccountStatusException))) {
274+
if ($this->isFilteredException($authenticationException)) {
273275
$authenticationException =newBadCredentialsException('Bad credentials.',0,$authenticationException);
274276
}
275277

@@ -283,4 +285,21 @@ private function handleAuthenticationFailure(AuthenticationException $authentica
283285
// returning null is ok, it means they want the request to continue
284286
return$loginFailureEvent->getResponse();
285287
}
288+
289+
privatefunctionisFilteredException(AuthenticationException$exception):bool
290+
{
291+
if (!$this->hideUserNotFoundExceptions) {
292+
returnfalse;
293+
}
294+
295+
if ($exceptioninstanceof UserNotFoundException) {
296+
returntrue;
297+
}
298+
299+
if ($this->showAccountStatusExceptions) {
300+
returnfalse;
301+
}
302+
303+
return$exceptioninstanceof AccountStatusException && !$exceptioninstanceof CustomUserMessageAccountStatusException;
304+
}
286305
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp