NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.7k

[Security] Remove using multiple attributes with #[IsGranted]#47144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:6.2fromHypeMC:remove-isgranted-multiple-attributes

Aug 2, 2022

Merged

[Security] Remove using multiple attributes with #[IsGranted]#47144

nicolas-grekas merged 1 commit intosymfony:6.2fromHypeMC:remove-isgranted-multiple-attributes

Aug 2, 2022

Conversation

Copy link

Member

HypeMC commentedAug 1, 2022

Q	A
Branch?	6.2
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix#46978 (comment)
License	MIT
Doc PR	-

Passing multiple attributes toisGranted() has been removed in#33584, so the following doesn't work any more:

#[IsGranted(attributes: ['ROLE_ADMIN'])]publicfunctionindex(Post$post){}#[IsGranted(attributes: ['ROLE_USER','ROLE_ADMIN'])]publicfunctionindex(Post$post){}

As mentioned insensiolabs/SensioFrameworkExtraBundle#648 , expressions should be used instead, see#46978 . This PR removes the possibility of using multiple attributes with#[IsGranted].

Also, it's currently possible to use#[IsGranted()] with no attributes (null). Since this doesn't seem to work either, nor can I find a reason why it even should, this PR removes that option as well. If I'm wrong about this one, please let me know.