Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5486c68

Browse files
fabpotfabpot
committed
feature #16722 [Security][SecurityBundle] Use csrf_token_id instead of deprecated intention (jakzal)
This PR was squashed before being merged into the 2.8 branch (closes #16722). Discussion ---------- [Security][SecurityBundle] Use csrf_token_id instead of deprecated intention | Q | A | ------------- | --- | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #16720 | License | MIT | Doc PR | - Commits ------- 0450865 [Security][SecurityBundle] Use csrf_token_id instead of deprecated intention
2 parents f94c6d4 + 0450865 commit 5486c68

File tree

10 files changed

+53
-11
lines changed

10 files changed

+53
-11
lines changed

‎UPGRADE-2.8.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,15 @@ Security
455455
* The `VoterInterface::supportsClass` and `supportsAttribute` methods were
456456
deprecated and will be removed from the interface in 3.0.
457457

458+
* The `intention` option is deprecated for all the authentication listeners,
459+
and will be removed in 3.0. Use the `csrf_token_id` option instead.
460+
461+
SecurityBundle
462+
--------------
463+
464+
* The `intention` firewall listener setting is deprecated, and will be removed in 3.0.
465+
Use the `csrf_token_id` option instead.
466+
458467
Config
459468
------
460469

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ CHANGELOG
66

77
* deprecated the `key` setting of `anonymous`, `remember_me` and `http_digest`
88
in favor of the `secret` setting.
9+
* deprecated the `intention` firewall listener setting in favor of the `csrf_token_id`.
910

1011
2.6.0
1112
-----

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginFactory.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public function __construct()
2929
$this->addOption('username_parameter', '_username');
3030
$this->addOption('password_parameter', '_password');
3131
$this->addOption('csrf_parameter', '_csrf_token');
32-
$this->addOption('intention', 'authenticate');
32+
$this->addOption('csrf_token_id', 'authenticate');
3333
$this->addOption('post_only', true);
3434
}
3535

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
299299
$listener = $container->setDefinition($listenerId, new DefinitionDecorator('security.logout_listener'));
300300
$listener->replaceArgument(3, array(
301301
'csrf_parameter' => $firewall['logout']['csrf_parameter'],
302-
'intention' => $firewall['logout']['csrf_token_id'],
302+
'csrf_token_id' => $firewall['logout']['csrf_token_id'],
303303
'logout_path' => $firewall['logout']['path'],
304304
));
305305
$listeners[] = new Reference($listenerId);

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/CsrfFormLoginBundle/Form/UserLoginType.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,12 +79,12 @@ public function buildForm(FormBuilderInterface $builder, array $options)
7979
*/
8080
public function configureOptions(OptionsResolver $resolver)
8181
{
82-
/* Note: the form's intention must correspond to that for the form login
82+
/* Note: the form's csrf_token_id must correspond to that for the form login
8383
* listener in order for the CSRF token to validate successfully.
8484
*/
8585

8686
$resolver->setDefaults(array(
87-
'intention' => 'authenticate',
87+
'csrf_token_id' => 'authenticate',
8888
));
8989
}
9090
}

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ CHANGELOG
1818
`Symfony\Component\Security\Core\Authorization\Voter\VoterInterface`.
1919
* deprecated `getSupportedAttributes()` and `getSupportedClasses()` methods of
2020
`Symfony\Component\Security\Core\Authorization\Voter\AbstractVoter`, use `supports()` instead.
21+
* deprecated the `intention` option for all the authentication listeners,
22+
use the `csrf_token_id` option instead.
2123

2224
2.7.0
2325
-----

‎src/Symfony/Component/Security/Http/Firewall/LogoutListener.php

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,21 @@ public function __construct(TokenStorageInterface $tokenStorage, HttpUtils $http
5757
throw new InvalidArgumentException('The CSRF token manager should be an instance of CsrfProviderInterface or CsrfTokenManagerInterface.');
5858
}
5959

60+
if (isset($options['intention'])) {
61+
if (isset($options['csrf_token_id'])) {
62+
throw new \InvalidArgumentException(sprintf('You should only define an option for one of "intention" or "csrf_token_id" for the "%s". Use the "csrf_token_id" as it replaces "intention".', __CLASS__));
63+
}
64+
65+
@trigger_error('The "intention" option for the '.__CLASS__.' is deprecated since version 2.8 and will be removed in 3.0. Use the "csrf_token_id" option instead.', E_USER_DEPRECATED);
66+
67+
$options['csrf_token_id'] = $options['intention'];
68+
}
69+
6070
$this->tokenStorage = $tokenStorage;
6171
$this->httpUtils = $httpUtils;
6272
$this->options = array_merge(array(
6373
'csrf_parameter' => '_csrf_token',
64-
'intention' => 'logout',
74+
'csrf_token_id' => 'logout',
6575
'logout_path' => '/logout',
6676
), $options);
6777
$this->successHandler = $successHandler;
@@ -101,7 +111,7 @@ public function handle(GetResponseEvent $event)
101111
if (null !== $this->csrfTokenManager) {
102112
$csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
103113

104-
if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['intention'], $csrfToken))) {
114+
if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
105115
throw new LogoutException('Invalid CSRF token.');
106116
}
107117
}

‎src/Symfony/Component/Security/Http/Firewall/SimpleFormAuthenticationListener.php

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,14 +70,24 @@ public function __construct(TokenStorageInterface $tokenStorage, AuthenticationM
7070
throw new InvalidArgumentException('The CSRF token manager should be an instance of CsrfProviderInterface or CsrfTokenManagerInterface.');
7171
}
7272

73+
if (isset($options['intention'])) {
74+
if (isset($options['csrf_token_id'])) {
75+
throw new \InvalidArgumentException(sprintf('You should only define an option for one of "intention" or "csrf_token_id" for the "%s". Use the "csrf_token_id" as it replaces "intention".', __CLASS__));
76+
}
77+
78+
@trigger_error('The "intention" option for the '.__CLASS__.' is deprecated since version 2.8 and will be removed in 3.0. Use the "csrf_token_id" option instead.', E_USER_DEPRECATED);
79+
80+
$options['csrf_token_id'] = $options['intention'];
81+
}
82+
7383
$this->simpleAuthenticator = $simpleAuthenticator;
7484
$this->csrfTokenManager = $csrfTokenManager;
7585

7686
$options = array_merge(array(
7787
'username_parameter' => '_username',
7888
'password_parameter' => '_password',
7989
'csrf_parameter' => '_csrf_token',
80-
'intention' => 'authenticate',
90+
'csrf_token_id' => 'authenticate',
8191
'post_only' => true,
8292
), $options);
8393

@@ -104,7 +114,7 @@ protected function attemptAuthentication(Request $request)
104114
if (null !== $this->csrfTokenManager) {
105115
$csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
106116

107-
if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['intention'], $csrfToken))) {
117+
if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
108118
throw new InvalidCsrfTokenException('Invalid CSRF token.');
109119
}
110120
}

‎src/Symfony/Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,21 @@ public function __construct(TokenStorageInterface $tokenStorage, AuthenticationM
4848
throw new InvalidArgumentException('The CSRF token manager should be an instance of CsrfProviderInterface or CsrfTokenManagerInterface.');
4949
}
5050

51+
if (isset($options['intention'])) {
52+
if (isset($options['csrf_token_id'])) {
53+
throw new \InvalidArgumentException(sprintf('You should only define an option for one of "intention" or "csrf_token_id" for the "%s". Use the "csrf_token_id" as it replaces "intention".', __CLASS__));
54+
}
55+
56+
@trigger_error('The "intention" option for the '.__CLASS__.' is deprecated since version 2.8 and will be removed in 3.0. Use the "csrf_token_id" option instead.', E_USER_DEPRECATED);
57+
58+
$options['csrf_token_id'] = $options['intention'];
59+
}
60+
5161
parent::__construct($tokenStorage, $authenticationManager, $sessionStrategy, $httpUtils, $providerKey, $successHandler, $failureHandler, array_merge(array(
5262
'username_parameter' => '_username',
5363
'password_parameter' => '_password',
5464
'csrf_parameter' => '_csrf_token',
55-
'intention' => 'authenticate',
65+
'csrf_token_id' => 'authenticate',
5666
'post_only' => true,
5767
), $options), $logger, $dispatcher);
5868

@@ -79,7 +89,7 @@ protected function attemptAuthentication(Request $request)
7989
if (null !== $this->csrfTokenManager) {
8090
$csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
8191

82-
if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['intention'], $csrfToken))) {
92+
if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
8393
throw new InvalidCsrfTokenException('Invalid CSRF token.');
8494
}
8595
}

‎src/Symfony/Component/Security/Http/Tests/Firewall/LogoutListenerTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ private function getListener($successHandler = null, $tokenManager = null)
213213
$successHandler ?: $this->getSuccessHandler(),
214214
$options = array(
215215
'csrf_parameter' => '_csrf_token',
216-
'intention' => 'logout',
216+
'csrf_token_id' => 'logout',
217217
'logout_path' => '/logout',
218218
'target_url' => '/',
219219
),

0 commit comments

Comments
 (0)