Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4a0869d

Browse files
derrabusderrabus
committed
Deprecate returning non-boolean values from checkCredentials().
1 parent 0fa1246 commit 4a0869d

File tree

6 files changed

+45
-4
lines changed

6 files changed

+45
-4
lines changed

‎UPGRADE-4.4.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ Security
194194

195195
* The `LdapUserProvider` class has been deprecated, use `Symfony\Component\Ldap\Security\LdapUserProvider` instead.
196196
* Implementations of `PasswordEncoderInterface` and `UserPasswordEncoderInterface` should add a new `needsRehash()` method
197+
* Deprecated returning a non-boolean value when implementing `Guard\AuthenticatorInterface::checkCredentials()`. Please explicitly return `false` to indicate invalid credentials.
197198

198199
Stopwatch
199200
---------

‎UPGRADE-5.0.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,7 @@ Security
467467
* The `BCryptPasswordEncoder` class has been removed, use `NativePasswordEncoder` instead.
468468
* Classes implementing the `TokenInterface` must implement the two new methods
469469
`__serialize` and `__unserialize`
470+
* Implementations of `Guard\AuthenticatorInterface::checkCredentials()` must return a boolean value now. Please explicitly return `false` to indicate invalid credentials.
470471

471472
SecurityBundle
472473
--------------

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ CHANGELOG
1111
* Added `Guard\PasswordAuthenticatedInterface`, an optional interface
1212
for "guard" authenticators that deal with user passwords
1313
* Marked all dispatched event classes as `@final`
14+
* Deprecated returning a non-boolean value when implementing `Guard\AuthenticatorInterface::checkCredentials()`.
1415

1516
4.3.0
1617
-----

‎src/Symfony/Component/Security/Guard/AuthenticatorInterface.php

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,8 @@ public function getUser($credentials, UserProviderInterface $userProvider);
8383
/**
8484
* Returns true if the credentials are valid.
8585
*
86-
* If any value other than true is returned, authentication will
87-
* fail. You may also throw an AuthenticationException if you wish
88-
* to cause authentication to fail.
86+
* If false is returned, authentication will fail. You may also throw
87+
* an AuthenticationException if you wish to cause authentication to fail.
8988
*
9089
* The *credentials* are the return value from getCredentials()
9190
*

‎src/Symfony/Component/Security/Guard/Provider/GuardAuthenticationProvider.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,11 @@ private function authenticateViaGuard(AuthenticatorInterface $guardAuthenticator
113113
}
114114

115115
$this->userChecker->checkPreAuth($user);
116-
if (true !== $guardAuthenticator->checkCredentials($token->getCredentials(), $user)) {
116+
if (true !== $checkCredentialsResult = $guardAuthenticator->checkCredentials($token->getCredentials(), $user)) {
117+
if (false !== $checkCredentialsResult) {
118+
@trigger_error(sprintf('%s::checkCredentials() must return a boolean value. You returned %s. This behavior is deprecated in Symfony 4.4 and will trigger a TypeError in Symfony 5.', \get_class($guardAuthenticator), \is_object($checkCredentialsResult) ? \get_class($checkCredentialsResult) : \gettype($checkCredentialsResult)), E_USER_DEPRECATED);
119+
}
120+
117121
throw new BadCredentialsException(sprintf('Authentication failed because %s::checkCredentials() did not return true.', \get_class($guardAuthenticator)));
118122
}
119123
if ($this->userProvider instanceof PasswordUpgraderInterface && $guardAuthenticator instanceof PasswordAuthenticatedInterface && null !== $this->passwordEncoder && (null !== $password = $guardAuthenticator->getPassword($token->getCredentials())) && method_exists($this->passwordEncoder, 'needsRehash') && $this->passwordEncoder->needsRehash($user)) {

‎src/Symfony/Component/Security/Guard/Tests/Provider/GuardAuthenticationProviderTest.php

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,41 @@ public function testAuthenticate()
8787
$this->assertSame($authedToken, $actualAuthedToken);
8888
}
8989

90+
public function testCheckCredentialsReturningFalseFailsAuthentication()
91+
{
92+
$this->expectException('Symfony\Component\Security\Core\Exception\BadCredentialsException');
93+
$providerKey = 'my_uncool_firewall';
94+
95+
$authenticator = $this->getMockBuilder(AuthenticatorInterface::class)->getMock();
96+
97+
// make sure the authenticator is used
98+
$this->preAuthenticationToken->expects($this->any())
99+
->method('getGuardProviderKey')
100+
// the 0 index, to match the only authenticator
101+
->willReturn('my_uncool_firewall_0');
102+
103+
$this->preAuthenticationToken->expects($this->atLeastOnce())
104+
->method('getCredentials')
105+
->willReturn('non-null-value');
106+
107+
$mockedUser = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
108+
$authenticator->expects($this->once())
109+
->method('getUser')
110+
->willReturn($mockedUser);
111+
// checkCredentials is called
112+
$authenticator->expects($this->once())
113+
->method('checkCredentials')
114+
// authentication fails :(
115+
->willReturn(false);
116+
117+
$provider = new GuardAuthenticationProvider([$authenticator], $this->userProvider, $providerKey, $this->userChecker);
118+
$provider->authenticate($this->preAuthenticationToken);
119+
}
120+
121+
/**
122+
* @group legacy
123+
* @expectedDeprecation %s::checkCredentials() must return a boolean value. You returned NULL. This behavior is deprecated in Symfony 4.4 and will trigger a TypeError in Symfony 5.
124+
*/
90125
public function testCheckCredentialsReturningNonTrueFailsAuthentication()
91126
{
92127
$this->expectException('Symfony\Component\Security\Core\Exception\BadCredentialsException');

0 commit comments

Comments
 (0)