Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 860d454

Browse files
Iltar van der Bergfabpot
Iltar van der Berg
authored and
fabpot
committed
No more support for custom anon/remember tokens based on FQCN
1 parent 57a1dd1 commit 860d454

File tree

9 files changed

+214
-19
lines changed

9 files changed

+214
-19
lines changed

‎UPGRADE-4.2.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,16 @@ Security
55
--------
66

77
* Using the `has_role()` function in security expressions is deprecated, use the `is_granted()` function instead.
8+
* Passing custom class names to the
9+
`Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver` to define
10+
custom anonymous and remember me token classes is deprecated. To
11+
use custom tokens, extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
12+
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
13+
14+
SecurityBundle
15+
--------------
16+
17+
* Using the `security.authentication.trust_resolver.anonymous_class` and
18+
`security.authentication.trust_resolver.rememberme_class` parameters to define
19+
the token classes is deprecated. To use
20+
custom tokens extend the existing AnonymousToken and RememberMeToken.

‎UPGRADE-5.0.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,16 @@ Security
7878
* The `ContextListener::setLogoutOnUserChange()` method has been removed.
7979
* The `Symfony\Component\Security\Core\User\AdvancedUserInterface` has been removed.
8080
* The `ExpressionVoter::addExpressionLanguageProvider()` method has been removed.
81+
* The `AuthenticationTrustResolver` constructor arguments have been removed.
8182

8283
SecurityBundle
8384
--------------
8485

8586
* The `logout_on_user_change` firewall option has been removed.
8687
* The `switch_user.stateless` firewall option has been removed.
8788
* The `SecurityUserValueResolver` class has been removed.
89+
* The `security.authentication.trust_resolver.anonymous_class` parameter has been removed.
90+
* The `security.authentication.trust_resolver.rememberme_class` parameter has been removed.
8891

8992
Translation
9093
-----------

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
CHANGELOG
22
=========
33

4+
4.2.0
5+
-----
6+
7+
* Using the `security.authentication.trust_resolver.anonymous_class` and
8+
`security.authentication.trust_resolver.rememberme_class` parameters to define
9+
the token classes is deprecated. To use
10+
custom tokens extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
11+
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
12+
413
4.1.0
514
-----
615

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
66

77
<parameters>
8-
<parameter key="security.authentication.trust_resolver.anonymous_class">Symfony\Component\Security\Core\Authentication\Token\AnonymousToken</parameter>
9-
<parameter key="security.authentication.trust_resolver.rememberme_class">Symfony\Component\Security\Core\Authentication\Token\RememberMeToken</parameter>
8+
<parameter key="security.authentication.trust_resolver.anonymous_class">null</parameter>
9+
<parameter key="security.authentication.trust_resolver.rememberme_class">null</parameter>
1010
<parameter key="security.role_hierarchy.roles" type="collection" />
1111
</parameters>
1212

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ CHANGELOG
66

77
* added the `is_granted()` function in security expressions
88
* deprecated the `has_role()` function in security expressions, use `is_granted()` instead
9+
* Passing custom class names to the
10+
`Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver` to define
11+
custom anonymous and remember me token classes is deprecated. To
12+
use custom tokens, extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
13+
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
914

1015
4.1.0
1116
-----

‎src/Symfony/Component/Security/Core/Authentication/AuthenticationTrustResolver.php

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
namespace Symfony\Component\Security\Core\Authentication;
1313

14+
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
15+
use Symfony\Component\Security\Core\Authentication\Token\RememberMeToken;
1416
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1517

1618
/**
@@ -23,10 +25,18 @@ class AuthenticationTrustResolver implements AuthenticationTrustResolverInterfac
2325
private $anonymousClass;
2426
private $rememberMeClass;
2527

26-
public function __construct(string $anonymousClass, string $rememberMeClass)
28+
public function __construct(?string $anonymousClass = null, ?string $rememberMeClass = null)
2729
{
2830
$this->anonymousClass = $anonymousClass;
2931
$this->rememberMeClass = $rememberMeClass;
32+
33+
if (null !== $anonymousClass && !is_a($anonymousClass, AnonymousToken::class, true)) {
34+
@trigger_error(sprintf('Configuring a custom anonymous token class is deprecated since Symfony 4.2; have the "%s" class extend the "%s" class instead, and remove the "%s" constructor argument.', $anonymousClass, AnonymousToken::class, self::class), E_USER_DEPRECATED);
35+
}
36+
37+
if (null !== $rememberMeClass && !is_a($rememberMeClass, RememberMeToken::class, true)) {
38+
@trigger_error(sprintf('Configuring a custom remember me token class is deprecated since Symfony 4.2; have the "%s" class extend the "%s" class instead, and remove the "%s" constructor argument.', $rememberMeClass, RememberMeToken::class, self::class), E_USER_DEPRECATED);
39+
}
3040
}
3141

3242
/**
@@ -38,7 +48,11 @@ public function isAnonymous(TokenInterface $token = null)
3848
return false;
3949
}
4050

41-
return $token instanceof $this->anonymousClass;
51+
if (null !== $this->anonymousClass) {
52+
return $token instanceof $this->anonymousClass;
53+
}
54+
55+
return $token instanceof AnonymousToken;
4256
}
4357

4458
/**
@@ -50,7 +64,11 @@ public function isRememberMe(TokenInterface $token = null)
5064
return false;
5165
}
5266

53-
return $token instanceof $this->rememberMeClass;
67+
if (null !== $this->rememberMeClass) {
68+
return $token instanceof $this->rememberMeClass;
69+
}
70+
71+
return $token instanceof RememberMeToken;
5472
}
5573

5674
/**

‎src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationTrustResolverTest.php

Lines changed: 159 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,36 +13,112 @@
1313

1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver;
16+
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
17+
use Symfony\Component\Security\Core\Authentication\Token\RememberMeToken;
18+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1619

1720
class AuthenticationTrustResolverTest extends TestCase
1821
{
1922
public function testIsAnonymous()
23+
{
24+
$resolver = new AuthenticationTrustResolver();
25+
$this->assertFalse($resolver->isAnonymous(null));
26+
$this->assertFalse($resolver->isAnonymous($this->getToken()));
27+
$this->assertFalse($resolver->isAnonymous($this->getRememberMeToken()));
28+
$this->assertFalse($resolver->isAnonymous(new FakeCustomToken()));
29+
$this->assertTrue($resolver->isAnonymous(new RealCustomAnonymousToken()));
30+
$this->assertTrue($resolver->isAnonymous($this->getAnonymousToken()));
31+
}
32+
33+
public function testIsRememberMe()
34+
{
35+
$resolver = new AuthenticationTrustResolver();
36+
37+
$this->assertFalse($resolver->isRememberMe(null));
38+
$this->assertFalse($resolver->isRememberMe($this->getToken()));
39+
$this->assertFalse($resolver->isRememberMe($this->getAnonymousToken()));
40+
$this->assertFalse($resolver->isRememberMe(new FakeCustomToken()));
41+
$this->assertTrue($resolver->isRememberMe(new RealCustomRememberMeToken()));
42+
$this->assertTrue($resolver->isRememberMe($this->getRememberMeToken()));
43+
}
44+
45+
public function testisFullFledged()
46+
{
47+
$resolver = new AuthenticationTrustResolver();
48+
49+
$this->assertFalse($resolver->isFullFledged(null));
50+
$this->assertFalse($resolver->isFullFledged($this->getAnonymousToken()));
51+
$this->assertFalse($resolver->isFullFledged($this->getRememberMeToken()));
52+
$this->assertFalse($resolver->isFullFledged(new RealCustomAnonymousToken()));
53+
$this->assertFalse($resolver->isFullFledged(new RealCustomRememberMeToken()));
54+
$this->assertTrue($resolver->isFullFledged($this->getToken()));
55+
$this->assertTrue($resolver->isFullFledged(new FakeCustomToken()));
56+
}
57+
58+
/**
59+
* @group legacy
60+
* @expectedDeprecation Configuring a custom anonymous token class is deprecated since Symfony 4.2; have the "Symfony\Component\Security\Core\Tests\Authentication\FakeCustomToken" class extend the "Symfony\Component\Security\Core\Authentication\Token\AnonymousToken" class instead, and remove the "Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver" constructor argument.
61+
*/
62+
public function testsAnonymousDeprecationWithCustomClasses()
63+
{
64+
$resolver = new AuthenticationTrustResolver(FakeCustomToken::class);
65+
66+
$this->assertTrue($resolver->isAnonymous(new FakeCustomToken()));
67+
}
68+
69+
/**
70+
* @group legacy
71+
* @expectedDeprecation Configuring a custom remember me token class is deprecated since Symfony 4.2; have the "Symfony\Component\Security\Core\Tests\Authentication\FakeCustomToken" class extend the "Symfony\Component\Security\Core\Authentication\Token\RememberMeToken" class instead, and remove the "Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver" constructor argument.
72+
*/
73+
public function testIsRememberMeDeprecationWithCustomClasses()
74+
{
75+
$resolver = new AuthenticationTrustResolver(null, FakeCustomToken::class);
76+
77+
$this->assertTrue($resolver->isRememberMe(new FakeCustomToken()));
78+
}
79+
80+
/**
81+
* @group legacy
82+
* @expectedDeprecation Configuring a custom remember me token class is deprecated since Symfony 4.2; have the "Symfony\Component\Security\Core\Tests\Authentication\FakeCustomToken" class extend the "Symfony\Component\Security\Core\Authentication\Token\RememberMeToken" class instead, and remove the "Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver" constructor argument.
83+
*/
84+
public function testIsFullFledgedDeprecationWithCustomClasses()
85+
{
86+
$resolver = new AuthenticationTrustResolver(FakeCustomToken::class, FakeCustomToken::class);
87+
88+
$this->assertFalse($resolver->isFullFledged(new FakeCustomToken()));
89+
}
90+
91+
public function testIsAnonymousWithClassAsConstructorButStillExtending()
2092
{
2193
$resolver = $this->getResolver();
2294

2395
$this->assertFalse($resolver->isAnonymous(null));
2496
$this->assertFalse($resolver->isAnonymous($this->getToken()));
2597
$this->assertFalse($resolver->isAnonymous($this->getRememberMeToken()));
2698
$this->assertTrue($resolver->isAnonymous($this->getAnonymousToken()));
99+
$this->assertTrue($resolver->isAnonymous(new RealCustomAnonymousToken()));
27100
}
28101

29-
public function testIsRememberMe()
102+
public function testIsRememberMeWithClassAsConstructorButStillExtending()
30103
{
31104
$resolver = $this->getResolver();
32105

33106
$this->assertFalse($resolver->isRememberMe(null));
34107
$this->assertFalse($resolver->isRememberMe($this->getToken()));
35108
$this->assertFalse($resolver->isRememberMe($this->getAnonymousToken()));
36109
$this->assertTrue($resolver->isRememberMe($this->getRememberMeToken()));
110+
$this->assertTrue($resolver->isRememberMe(new RealCustomRememberMeToken()));
37111
}
38112

39-
public function testisFullFledged()
113+
public function testisFullFledgedWithClassAsConstructorButStillExtending()
40114
{
41115
$resolver = $this->getResolver();
42116

43117
$this->assertFalse($resolver->isFullFledged(null));
44118
$this->assertFalse($resolver->isFullFledged($this->getAnonymousToken()));
45119
$this->assertFalse($resolver->isFullFledged($this->getRememberMeToken()));
120+
$this->assertFalse($resolver->isFullFledged(new RealCustomAnonymousToken()));
121+
$this->assertFalse($resolver->isFullFledged(new RealCustomRememberMeToken()));
46122
$this->assertTrue($resolver->isFullFledged($this->getToken()));
47123
}
48124

@@ -69,3 +145,84 @@ protected function getResolver()
69145
);
70146
}
71147
}
148+
149+
class FakeCustomToken implements TokenInterface
150+
{
151+
public function serialize()
152+
{
153+
}
154+
155+
public function unserialize($serialized)
156+
{
157+
}
158+
159+
public function __toString()
160+
{
161+
}
162+
163+
public function getRoles()
164+
{
165+
}
166+
167+
public function getCredentials()
168+
{
169+
}
170+
171+
public function getUser()
172+
{
173+
}
174+
175+
public function setUser($user)
176+
{
177+
}
178+
179+
public function getUsername()
180+
{
181+
}
182+
183+
public function isAuthenticated()
184+
{
185+
}
186+
187+
public function setAuthenticated($isAuthenticated)
188+
{
189+
}
190+
191+
public function eraseCredentials()
192+
{
193+
}
194+
195+
public function getAttributes()
196+
{
197+
}
198+
199+
public function setAttributes(array $attributes)
200+
{
201+
}
202+
203+
public function hasAttribute($name)
204+
{
205+
}
206+
207+
public function getAttribute($name)
208+
{
209+
}
210+
211+
public function setAttribute($name, $value)
212+
{
213+
}
214+
}
215+
216+
class RealCustomAnonymousToken extends AnonymousToken
217+
{
218+
public function __construct()
219+
{
220+
}
221+
}
222+
223+
class RealCustomRememberMeToken extends RememberMeToken
224+
{
225+
public function __construct()
226+
{
227+
}
228+
}

‎src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,8 @@ class ExpressionLanguageTest extends TestCase
3131
*/
3232
public function testIsAuthenticated($token, $expression, $result)
3333
{
34-
$anonymousTokenClass = 'Symfony\\Component\\Security\\Core\\Authentication\\Token\\AnonymousToken';
35-
$rememberMeTokenClass = 'Symfony\\Component\\Security\\Core\\Authentication\\Token\\RememberMeToken';
3634
$expressionLanguage = new ExpressionLanguage();
37-
$trustResolver = new AuthenticationTrustResolver($anonymousTokenClass, $rememberMeTokenClass);
35+
$trustResolver = new AuthenticationTrustResolver();
3836
$tokenStorage = new TokenStorage();
3937
$tokenStorage->setToken($token);
4038
$accessDecisionManager = new AccessDecisionManager(array(new RoleVoter()));

‎src/Symfony/Component/Security/Core/Tests/Authorization/Voter/AuthenticatedVoterTest.php

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class AuthenticatedVoterTest extends TestCase
2323
*/
2424
public function testVote($authenticated, $attributes, $expected)
2525
{
26-
$voter = new AuthenticatedVoter($this->getResolver());
26+
$voter = new AuthenticatedVoter(new AuthenticationTrustResolver());
2727

2828
$this->assertSame($expected, $voter->vote($this->getToken($authenticated), null, $attributes));
2929
}
@@ -52,14 +52,6 @@ public function getVoteTests()
5252
);
5353
}
5454

55-
protected function getResolver()
56-
{
57-
return new AuthenticationTrustResolver(
58-
'Symfony\\Component\\Security\\Core\\Authentication\\Token\\AnonymousToken',
59-
'Symfony\\Component\\Security\\Core\\Authentication\\Token\\RememberMeToken'
60-
);
61-
}
62-
6355
protected function getToken($authenticated)
6456
{
6557
if ('fully' === $authenticated) {

0 commit comments

Comments
 (0)