Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[FrameworkBundle][TwigBridge] make csrf_token() usable without forms#25197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged

Conversation

@xabbuh
Copy link
Member

QA
Branch?master
Bug fix?no
New feature?yes
BC breaks?no
Deprecations?no
Tests pass?yes
Fixed tickets
LicenseMIT
Doc PR

The Twig functioncsrf_token() is currently only registered when the
Form component is installed. However, this function is also useful, for
example, when creating simple login forms for which you do not need the
full Form component.

apetitpa, fsevestre, and PhPPgAdminBug reacted with thumbs up emoji
);

if (null !==$this->csrfTokenManager) {
$functions[] =newTwigFunction('csrf_token',array($this,'getCsrfToken'));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Regarding DX, wouldn't it be better to always add the method but throw if nocsrfTokenManager injected?

Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I would say it's better this way because you will notice the error when templates are parsed. Having the function fail at runtime can just go without notice.

chalasr and fabpot reacted with thumbs up emoji
private$csrfTokenManager;

publicfunction__construct(AuthorizationCheckerInterface$securityChecker =null)
publicfunction__construct(AuthorizationCheckerInterface$securityChecker =null,CsrfTokenManagerInterface$csrfTokenManager =null)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Adding the CSRF manager adds more deps, would it be better to create a Twig runtime class at this point?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

#24692 does it also

@stof
Copy link
Member

Rather than coupling it to thesecurity-core twig integration (which would forbid you to use CSRF without installing the security-core and then gettingis_granted), I would rather define a separate Twig extension for the CSRF (and deprecate the fact of passing a CsrfManager to the FormExtension).

The authorization layer and the CSRF layer are totally independant components (the CSRF one is not even configured by SecurityBundle but by FrameworkBundle)

The Twig function `csrf_token()` is currently only registered when theForm component is installed. However, this function is also useful, forexample, when creating simple login forms for which you do not need thefull Form component.
@xabbuhxabbuhforce-pushed thesecurity-extension-csrf-token branch from2abd80e to709efa3CompareDecember 1, 2017 09:41
@xabbuh
Copy link
MemberAuthor

xabbuh commentedDec 1, 2017
edited
Loading

I moved the new function into a new extension class inside FrameworkBundle. Do we nonetheless want to use a runtime class here?

@javiereguiluz
Copy link
Member

@xabbuh just asking: is there any reason yo create so many small Twig extensions inhttps://github.com/xabbuh/symfony/tree/master/src/Symfony/Bridge/Twig/Extension? Could we add this tiny new function in the existing SecurityExtension instead? Thanks!

@xabbuhxabbuh changed the title[SecurityBundle][TwigBridge] make csrf_token() usable without forms[FrameworkBundle][TwigBridge] make csrf_token() usable without formsDec 4, 2017
@xabbuh
Copy link
MemberAuthor

Copy link
Contributor

@TobionTobion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Isn't this missing the deprecation of the csrf_token in the FormExtension and FormRenderer? Otherwise we have the same thing in two different ways.

@xabbuhxabbuh added the ❄️ Feature FreezeImportant Pull Requests to finish before the next Symfony "feature freeze" labelMar 12, 2018
@xabbuh
Copy link
MemberAuthor

Isn't this missing the deprecation of the csrf_token in the FormExtension and FormRenderer? Otherwise we have the same thing in two different ways.

Maybe I am missing something, but I don't see how to deprecate registering a single function from a Twig extension. But as far as I can see that's not a big deal as the extension being registered later will just replace the existing definition which does no harm as both implementations internally work the same.

@fabpot
Copy link
Member

@xabbuh
Copy link
MemberAuthor

@fabpot in our case both filters have the same name. We could make registering the additional filters an opt-out feature. But I am not sure if it's worth it.

@fabpot
Copy link
Member

Thank you@xabbuh.

@fabpotfabpot merged commit709efa3 intosymfony:masterMar 21, 2018
fabpot added a commit that referenced this pull requestMar 21, 2018
… without forms (xabbuh)This PR was merged into the 4.1-dev branch.Discussion----------[FrameworkBundle][TwigBridge] make csrf_token() usable without forms| Q             | A| ------------- | ---| Branch?       | master| Bug fix?      | no| New feature?  | yes| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets || License       | MIT| Doc PR        |The Twig function `csrf_token()` is currently only registered when theForm component is installed. However, this function is also useful, forexample, when creating simple login forms for which you do not need thefull Form component.Commits-------709efa3 make csrf_token() usable without forms
@xabbuhxabbuh deleted the security-extension-csrf-token branchMarch 21, 2018 09:13
@fabpotfabpot mentioned this pull requestMay 7, 2018
@rejinka
Copy link

@xabbuh Thank you! 👍

fabpot added a commit that referenced this pull requestMay 31, 2018
…endency on CSRF token storage (tgalopin)This PR was merged into the 4.1 branch.Discussion----------[FrameworkBundle][TwigBridge] Fix BC break from strong dependency on CSRF token storage| Q             | A| ------------- | ---| Branch?       | 4.1| Bug fix?      | yes| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | -| License       | MIT| Doc PR        | -The PR#25197 introduced the `csrf_token` function in Twig. This extension relies on `CsrfTokenManagerInterface`, which itself relies on the session. In some contexts such as when sessions are stored in Redis and we try to warmup the cache in CLI without Redis available, this makes the process fails.This PR fixes this by using a Twig runtime instead of a direct extension to avoid a strong dependency on `CsrfTokenManagerInterface`.Commits-------68994a6 [FrameworkBundle][TwigBridge] Fix BC break from strong dependency on CSRF token storage
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@fabpotfabpotfabpot approved these changes

@chalasrchalasrchalasr approved these changes

+2 more reviewers

@TobionTobionTobion requested changes

@ogizanagiogizanagiogizanagi approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

FeatureFrameworkBundle❄️ Feature FreezeImportant Pull Requests to finish before the next Symfony "feature freeze"Status: Needs WorkTwigBridge

Projects

None yet

Milestone

4.1

Development

Successfully merging this pull request may close these issues.

9 participants

@xabbuh@stof@javiereguiluz@fabpot@rejinka@Tobion@ogizanagi@chalasr@carsonbot

[8]ページ先頭

©2009-2025 Movatter.jp