Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[Security/Core] Fix wrong roles comparison#35944
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
ajgarlag commentedMar 5, 2020
I've openedthlbaut#1 to PR author branch with an small change to reproduce the bug, and to prevent a future regression. |
nicolas-grekas commentedMar 31, 2020
This would deserve more tests I suppose (note the I don't know if this is correct.) |
chalasr left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
The added test looks good enough.
wouterj left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Agreed with Robin, the tweaked test covers the BC regression introduced in 4.4
fabpot commentedMay 22, 2020
Thank you@thlbaut. |
This PR was squashed before being merged into the 4.4 branch.Discussion----------[Security] Fixed AbstractToken::hasUserChanged()| Q | A| ------------- | ---| Branch? | 4.4| Bug fix? | yes| New feature? | no| Deprecations? | no| Tickets |Fix#36989| License | MIT| Doc PR | -This PR completely reverts#35944.That PR tried to fix a BC break (ref#35941,#35509) introduced by#31177. However, this broke many authentications (ref#36989), as the User is serialized in the session (as hinted by@stof). Many applications don't include the `roles` property in the serialization (at least, the MakerBundle doesn't include it).In 5.2, we should probably deprecate having different roles in token and user, which fixes the BC breaks all together.Commits-------f297beb [Security] Fixed AbstractToken::hasUserChanged()
Fix wrong roles comparison.