[Security] fix #39262, more defensive PasswordMigratingListener

Romaric Drigon · Romaric Drigon · commit 9baed0cdd741 · 2020-12-01T10:37:05.000+01:00
diff --git a/src/Symfony/Component/Security/Http/EventListener/PasswordMigratingListener.php b/src/Symfony/Component/Security/Http/EventListener/PasswordMigratingListener.php
@@ -56,7 +56,12 @@ public function onLoginSuccess(LoginSuccessEvent $event): void
         }
 
         $passwordUpgrader = $badge->getPasswordUpgrader();
+
         if (null === $passwordUpgrader) {
+            if (!$passport->hasBadge(UserBadge::class)) {
+                return;
+            }
+
             /** @var UserBadge $userBadge */
             $userBadge = $passport->getBadge(UserBadge::class);
             $userLoader = $userBadge->getUserLoader();
