Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security] #[CurrentUser] arguments should resolve to null for "anon." #40286

Merged
merged 1 commit into from
Feb 24, 2021
Merged

[Security] #[CurrentUser] arguments should resolve to null for "anon." #40286

merged 1 commit into from
Feb 24, 2021
+14 −6

Conversation

chalasr
Copy link
Member

@chalasr chalasr commented Feb 23, 2021

Q A
Branch? 5.2
Bug fix? yes
New feature? no
Deprecations? no
Tickets -
License MIT
Doc PR -

The UserValueResolver should only resolve UserInterface (or subtype) typed arguments:

symfony/src/Symfony/Component/Security/Http/Controller/UserValueResolver.php

Lines 54 to 55 in bc9e946

// in case it's not an object we cannot do anything with it; E.g. "anon."
return $user instanceof UserInterface;

When using the #CurrentUser attribute with an AnonymousToken in the storage, the resolved argument value is anon.. This PR fixes it.

/cc @jvasseur

@chalasr chalasr requested a review from wouterj as a code owner February 23, 2021 23:08
@carsonbot carsonbot added this to the 5.2 milestone Feb 23, 2021
@chalasr chalasr force-pushed the fix-null-currentuser branch 2 times, most recently from ba4dd23 to dc7942b Compare February 23, 2021 23:49
jvasseur
jvasseur approved these changes Feb 24, 2021
View reviewed changes
Copy link
Contributor

@jvasseur jvasseur left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think my goal was to support nullable arguments when no user are present but I forgot that anonymous users where strings and not null.

But I guess the nullable use case is already solved by the DefaultValueResolver so this is fine.

@chalasr chalasr force-pushed the fix-null-currentuser branch from dc7942b to 8d3078d Compare February 24, 2021 13:48
@chalasr chalasr merged commit b037319 into symfony:5.2 Feb 24, 2021
@chalasr chalasr deleted the fix-null-currentuser branch February 24, 2021 14:02
@fabpot fabpot mentioned this pull request Mar 4, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wouterj wouterj

@jvasseur jvasseur

Assignees
No one assigned
Labels
Bug Security Status: Reviewed
Projects
None yet
Milestone
5.2
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@chalasr @wouterj @jvasseur @carsonbot