Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[Security] Fix loading user from UserBadge#51104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
fabpot merged 1 commit intosymfony:6.3fromguillaumesmo:6.3
Aug 25, 2023

Conversation

@guillaumesmo
Copy link
Contributor

@guillaumesmoguillaumesmo commentedJul 25, 2023
edited
Loading

QA
Branch?6.3
Bug fix?yes
New feature?no
Deprecations?no
TicketsFix#50511
LicenseMIT
Doc PRnone

Fixed a breaking change fromhttps://github.com/symfony/symfony/pull/48272/files#diff-de9707bb338188f62878f2ebd42e7a7bf9547f6d0bf07a4fcd9c386c263c601b

@carsonbot
Copy link

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (seehttps://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
  • Features and deprecations must be submitted against the 6.4 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

@guillaumesmoguillaumesmoforce-pushed the6.3 branch 2 times, most recently from6f6bc12 to99a217fCompareJuly 25, 2023 22:29
@guillaumesmo
Copy link
ContributorAuthor

guillaumesmo commentedJul 25, 2023
edited
Loading

The fix is less clean than expected because the new OIDC feature relies on this bug.

The Badge user loader used to have priority over the firewall user provider. This was changed so that the OIDC Badge user loader only kicks in when no user provider is set (not sure how, however).

So the priorities are now as follows:

  1. Provided user loader in the new Badge constructor
  2. Firewall user provider
  3. OIDC user loader

Alternative solutions:

  • add a configuration to oidc to enable the default user loader
  • add a property to UserBadge to indicate the loader must not override the firewall user loader, instead of the callable wrapper

@nicolas-grekas
Copy link
Member

Can you add a test case please?

@vincentchalamon can you have a look please?

@carsonbotcarsonbot changed the titleRevert breaking change to AccessTokenAuthenticator[Security] Revert breaking change to AccessTokenAuthenticatorJul 26, 2023
Copy link
Contributor

@vincentchalamonvincentchalamon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Nice catch! (and sorry for the bug introduced in my PR)

In addition to my review, can you also add a non-regression functional test onAccessTokenTest please?

@guillaumesmoguillaumesmo changed the title[Security] Revert breaking change to AccessTokenAuthenticator[Security] Fix breaking change to AccessTokenAuthenticatorJul 28, 2023
@OskarStarkOskarStark changed the title[Security] Fix breaking change to AccessTokenAuthenticator[Security] Fix BC break toAccessTokenAuthenticatorAug 2, 2023
@guillaumesmo
Copy link
ContributorAuthor

Hi all, what can I do to move this PR forward?

@nicolas-grekas
Copy link
Member

"BC break" is not a proper description when fixing a regression. It doesn't tell which case is solved.
Can you please figure out something a bit more descriptive?

@guillaumesmoguillaumesmo changed the title[Security] Fix BC break toAccessTokenAuthenticator[Security] Fix loading user from UserBadgeAug 23, 2023
@guillaumesmo
Copy link
ContributorAuthor

"BC break" is not a proper description when fixing a regression. It doesn't tell which case is solved. Can you please figure out something a bit more descriptive?

Sure, done

Copy link
Member

@wouterjwouterj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Looks good to me.

@fabpot
Copy link
Member

Thank you@guillaumesmo.

@fabpotfabpot merged commit0ef6b32 intosymfony:6.3Aug 25, 2023
@fabpotfabpot mentioned this pull requestAug 26, 2023
nicolas-grekas added a commit that referenced this pull requestSep 11, 2023
This PR was merged into the 6.3 branch.Discussion----------[Security] Fix security tests| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes| New feature?  | no| Deprecations? | no| Tickets       | Follows#51622| License       | MIT| Doc PR        | -Related to issue#51104, after it security bundle at least requires `symfony/security-http:6.3.4`  to keep the tests is greenCommits-------26cff6c Fix security tests
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@wouterjwouterjwouterj approved these changes

@chalasrchalasrAwaiting requested review from chalasrchalasr is a code owner

@vincentchalamonvincentchalamonAwaiting requested review from vincentchalamon

@derrabusderrabusAwaiting requested review from derrabus

Assignees

No one assigned

Projects

None yet

Milestone

6.3

Development

Successfully merging this pull request may close these issues.

7 participants

@guillaumesmo@carsonbot@nicolas-grekas@fabpot@vincentchalamon@wouterj@derrabus

[8]ページ先頭

©2009-2025 Movatter.jp