NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.8k

[FrameworkBundle] Fix denyAccessUnlessGranted for mixed attributes#49493

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:5.4fromdelbertooo:fix-deny-access

Feb 23, 2023

Merged

[FrameworkBundle] Fix denyAccessUnlessGranted for mixed attributes#49493

nicolas-grekas merged 1 commit intosymfony:5.4fromdelbertooo:fix-deny-access

Feb 23, 2023

Conversation

Copy link

Contributor

delbertooo commentedFeb 22, 2023•
edited by nicolas-grekas
Loading

Q	A
Branch?	5.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	-
License	MIT
Doc PR	-

Checking authorization against anything that isn'tarray|string will cause PHP errors now. The methodAbstractController::denyAccessUnlessGranted() sets the givensingle attribute into the exception in case of denied access. TheAuthorizationCheckerInterface defines that the attribute can be anything, even objects. The parameter type hintarray|string ofAccessDeniedException::setAttributes() want's an array of attributes (or a string for convenience).

Example

useSymfony\Bundle\FrameworkBundle\Controller\AbstractController;class MyCustomAttribute{}class ProfileControllerextends AbstractController{publicfunctionindex():Response    {$this->denyAccessUnlessGranted(newMyCustomAttribute());// 💥 ERROR: Symfony\Component\Security\Core\Exception\AccessDeniedException::setAttributes(): Argument #1 ($attributes) must be of type array|string, [...]$user =$this->getUser();returnnewResponse('Well hi there'.$user->getFirstName());    }}

The fix

As the given attribute is asingle attribute: always wrap it into an array when creating the exception, because the exception expects an array of attributes.

carsonbot added Status: Needs Review Bug FrameworkBundle labels

Feb 22, 2023

carsonbot added this to the6.2 milestone

Feb 22, 2023

Copy link

carsonbot commentedFeb 22, 2023

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

Always add tests
Keep backward compatibility (seehttps://symfony.com/bc).
Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
Features and deprecations must be submitted against the 6.3 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

Copy link

ContributorAuthor

delbertooo commentedFeb 22, 2023

Can someone re-run the checks or something? I don't think this issue is caused by my code:

There was 1 failure:1) Symfony\Component\Clock\Tests\MonotonicClockTest::testSleepFailed asserting that 1677065608.00641 is equal to 1677065608.0064101 or is greater than 1677065608.0064101.

nicolas-grekas reviewed

Feb 23, 2023

View reviewed changes

src/Symfony/Bundle/FrameworkBundle/Tests/Controller/AbstractControllerTest.php OutdatedShow resolvedHide resolved

nicolas-grekas modified the milestones:6.2,5.4

Feb 23, 2023

[FrameworkBundle] Fix denyAccessUnlessGranted for mixed attributes

9ed77f3

Fix AbstractController::denyAccessUnlessGranted() for attributes that aren't string or array. Always wrap the given single attribute into an array to not break the parameter type of AccessDeniedException#setAttributes() (which supports strings only for convenience).

nicolas-grekas changed the base branch from6.2 to5.4

February 23, 2023 09:17