Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ca62f65

Browse files
fabpotfabpot
committed
merged branch fabpot/expression-engine (PR #8913)
This PR was merged into the master branch. Discussion ---------- New Component: Expression Language | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #8850, #7352 | License | MIT | Doc PR | not yet TODO: - [ ] write documentation - [x] add tests for the new component - [x] implement expression support for access rules in the security component - [x] find a better character/convention for expressions in the YAML format - [x] check the performance of the evaluation mode - [x] better error messages in the evaluation mode - [x] add support in the Routing - [x] add support in the Validator The ExpressionLanguage component provides an engine that can compile and evaluate expressions. An expression is a one-liner that returns a value (mostly, but not limited to, Booleans). It is a strip-down version of Twig (only the expression part of it is implemented.) Like Twig, the expression is lexed, parsed, and compiled/evaluated. So, it is immune to external injections by design. If we compare it to Twig, here are the main big differences: * only support for Twig expressions * no ambiguity for calls (foo.bar is only valid for properties, foo['bar'] is only valid for array calls, and foo.bar() is required for method calls) * no support for naming conventions in method calls (if the method is named getFoo(), you must use getFoo() and not foo()) * no notion of a line for errors, but a cursor (we are mostly talking about one-liners here) * removed everything specific to the templating engine (like output escaping or filters) * no support for named arguments in method calls * only one extension point with functions (no possibility to define new operators, ...) * and probably even more I don't remember right now * there is no need for a runtime environment, the compiled PHP string is self-sufficient An open question is whether we keep the difference betweens arrays and hashes. The other big difference with Twig is that it can work in two modes (possible because of the restrictions described above): * compilation: the expression is compiled to PHP and is self-sufficient * evaluation: the expression is evaluated without being compiled to PHP (the node tree produced by the parser can be serialized and evaluated afterwards -- so it can be saved on disk or in a database to speed up things when needed) Let's see a simple example: ```php $language = new ExpressionLanguage(); echo $language->evaluate('1 + 1'); // will echo 2 echo $language->compile('1 + 2'); // will echo "(1 + 2)" ``` The language supports: * all basic math operators (with precedence rules): * unary: not, !, -, + * binary: or, ||, and, &&, b-or, b-xor, b-and, ==, ===, !=, !==, <, >, >=, <=, not in, in, .., +, -, ~, *, /, %, ** * all literals supported by Twig: strings, numbers, arrays (`[1, 2]`), hashes (`{a: "b"}`), Booleans, and null. * simple variables (`foo`), array accesses (`foo[1]`), property accesses (`foo.bar`), and method calls (`foo.bar(1, 2)`). * the ternary operator: `true ? true : false` (and all the shortcuts implemented in Twig). * function calls (`constant('FOO')` -- `constant` is the only built-in functions). * and of course, any combination of the above. The compilation is better for performances as the end result is just a plain PHP string without any runtime. For the evaluation, we need to tokenize, parse, and evaluate the nodes on the fly. This can be optimized by using a `ParsedExpression` or a `SerializedParsedExpression` instead: ```php $nodes = $language->parse($expr, $names); $expression = new SerializedParsedExpression($expr, serialize($nodes)); // You can now store the expression in a DB for later reuse // a SerializedParsedExpression can be evaluated like any other expressions, // but under the hood, the lexer and the parser won't be used at all, so it''s much faster. $language->evaluate($expression); ``` That's all folks! I can see many use cases for this new component, and we have two use cases in Symfony that we can implement right away. ## Using Expressions in the Service Container The first one is expression support in the service container (it would replace #8850) -- anywhere you can pass an argument in the service container, you can use an expression: ```php $c->register('foo', 'Foo')->addArgument(new Expression('bar.getvalue()')); ``` You have access to the service container via `this`: container.get("bar").getvalue(container.getParameter("value")) The implementation comes with two functions that simplifies expressions (`service()` to get a service, and `parameter` to get a parameter value). The previous example can be simplified to: service("bar").getvalue(parameter("value")) Here is how to use it in XML: ```xml <parameters> <parameter key="value">foobar</parameter> </parameters> <services> <service id="foo" class="Foo"> <argument type="expression">service('bar').getvalue(parameter('value'))</argument> </service> <service id="bar" class="Bar" /> </services> ``` and in YAML (I chose the syntax randomly ;)): ```yaml parameters: value: foobar services: bar: class: Bar foo: class: Foo arguments: [@=service("bar").getvalue(parameter("value"))] ``` When using the container builder, Symfony uses the evaluator, but with the PHP dumper, the compiler is used, and there is no overhead as the expression engine is not needed at runtime. The expression above would be compiled to: ```php $this->get("bar")->getvalue($this->getParameter("value")) ``` ## Using Expression for Security Access Control Rules The second use case in Symfony is for access rules. As we all know, the way to configure the security access control rules is confusing, which might lead to insecure applications (see http://symfony.com/blog/security-access-control-documentation-issue for more information). Here is how the new `allow_if` works: ```yaml access_control: - { path: ^/_internal/secure, allow_if: "'127.0.0.1' == request.getClientIp() or has_role('ROLE_ADMIN')" } ``` This one restricts the URLs starting with `/_internal/secure` to people browsing from the localhost. Here, `request` is the current Request instance. In the expression, there is access to the following variables: * `request` * `token` * `user` And to the following functions: * `is_anonymous` * `is_authenticated` * `is_fully_authenticated` * `is_rememberme` * `has_role` You can also use expressions in Twig, which works well with the `is_granted` function: ```jinja {% if is_granted(expression('has_role("FOO")')) %} ... {% endif %} ``` ## Using Expressions in the Routing Out of the box, Symfony can only match an incoming request based on some pre-determined variables (like the path info, the method, the scheme, ...). But some people want to be able to match on more complex logic, based on other information of the Request object. That's why we introduced `RequestMatcherInterface` recently (but we no default implementation in Symfony itself). The first change I've made (not related to expression support) is implement this interface for the default `UrlMatcher`. It was simple enough. Then, I've added a new `condition` configuration for Route objects, which allow you to add any valid expression. An expression has access to the `request` and to the routing `context`. Here is how one would configure it in a YAML file: ```yaml hello: path: /hello/{name} condition: "context.getMethod() in ['GET', 'HEAD'] and request.headers.get('User-Agent') =~ '/firefox/i'" ``` Why do I keep the context as all the data are also available in the request? Because you can also use the condition without using the RequestMatcherInterface, in which case, you don't have access to the request. So, the previous example is equivalent to: ```yaml hello: path: /hello/{name} condition: "request.getMethod() in ['GET', 'HEAD'] and request.headers.get('User-Agent') =~ '/firefox/i'" ``` When using the PHP dumper, there is no overhead as the condition is compiled. Here is how it looks like: ```php // hello if (0 === strpos($pathinfo, '/hello') && preg_match('#^/hello/(?P<name>[^/]++)$#s', $pathinfo, $matches) && (in_array($context->getMethod(), array(0 => "GET", 1 => "HEAD")) && preg_match("/firefox/i", $request->headers->get("User-Agent")))) { return $this->mergeDefaults(array_replace($matches, array('_route' => 'hello')), array ()); } ``` Be warned that conditions are not taken into account when generating a URL. ## Using Expressions in the Validator There is a new Expression constraint that you can put on a class. The expression is then evaluated for validation: ```php use Symfony\Component\Validator\Constraints as Assert; /** * @Assert\Condition(condition="this.getFoo() == 'fo'", message="Not good!") */ class Obj { public function getFoo() { return 'foo'; } } ``` In the expression, you get access to the current object via the `this` variable. ## Dynamic annotations The expression language component is also very useful in annotations. the SensoLabs FrameworkExtraBundle leverages this possibility to implement HTTP validation caching in the `@Cache` annotation and to add a new `@Security` annotation (see sensiolabs/SensioFrameworkExtraBundle#238.) Commits ------- d4ebbfd [Validator] Renamed Condition to Expression and added possibility to set it onto properties a3b3a78 [Validator] added a constraint that runs an expression 1bcfb40 added optimized versions of expressions 984bd38 mades things more consistent for the end user d477f15 [Routing] added support for expression conditions in routes 86ac8d7 [ExpressionLanguage] improved performance e369d14 added a Twig extension to create Expression instances 38b7fde added support for expression in control access rules 2777ac7 [HttpFoundation] added ExpressionRequestMatcher c25abd9 [DependencyInjection] added support for expressions in the service container 3a41781 [ExpressionLanguage] added support for regexes 9d98fa2 [ExpressionLanguage] added the component
2 parents ed60d39 + d4ebbfd commit ca62f65

File tree

121 files changed

+3730
-54
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

121 files changed

+3730
-54
lines changed

‎composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
"symfony/doctrine-bridge": "self.version",
3434
"symfony/dom-crawler": "self.version",
3535
"symfony/event-dispatcher": "self.version",
36+
"symfony/expression-language": "self.version",
3637
"symfony/filesystem": "self.version",
3738
"symfony/finder": "self.version",
3839
"symfony/form": "self.version",

‎src/Symfony/Bridge/Twig/Extension/ExpressionExtension.php

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <[email protected]>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bridge\Twig\Extension;
13+
14+
use Symfony\Component\ExpressionLanguage\Expression;
15+
16+
/**
17+
* ExpressionExtension gives a way to create Expressions from a template.
18+
*
19+
* @author Fabien Potencier <[email protected]>
20+
*/
21+
class ExpressionExtension extends \Twig_Extension
22+
{
23+
/**
24+
* {@inheritdoc}
25+
*/
26+
public function getFunctions()
27+
{
28+
return array(
29+
new \Twig_SimpleFunction('expression', array($this, 'createExpression')),
30+
);
31+
}
32+
33+
private function createExpression($expression)
34+
{
35+
return new Expression($expression);
36+
}
37+
38+
/**
39+
* Returns the name of the extension.
40+
*
41+
* @return string The extension name
42+
*/
43+
public function getName()
44+
{
45+
return 'expression';
46+
}
47+
}

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ public function load(array $configs, ContainerBuilder $container)
4949
// will be used and everything will still work as expected.
5050
$loader->load('translation.xml');
5151

52+
// Property access is used by both the Form and the Validator component
53+
$loader->load('property_access.xml');
54+
5255
$loader->load('debug_prod.xml');
5356

5457
if ($container->getParameter('kernel.debug')) {

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/form.xml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
<parameter key="form.factory.class">Symfony\Component\Form\FormFactory</parameter>
1111
<parameter key="form.extension.class">Symfony\Component\Form\Extension\DependencyInjection\DependencyInjectionExtension</parameter>
1212
<parameter key="form.type_guesser.validator.class">Symfony\Component\Form\Extension\Validator\ValidatorTypeGuesser</parameter>
13-
<parameter key="property_accessor.class">Symfony\Component\PropertyAccess\PropertyAccessor</parameter>
1413
</parameters>
1514

1615
<services>
@@ -54,9 +53,6 @@
5453
<argument type="service" id="validator.mapping.class_metadata_factory" />
5554
</service>
5655

57-
<!-- PropertyAccessor -->
58-
<service id="property_accessor" class="%property_accessor.class%" />
59-
6056
<!-- CoreExtension -->
6157
<service id="form.type.form" class="Symfony\Component\Form\Extension\Core\Type\FormType">
6258
<argument type="service" id="property_accessor"/>

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/property_access.xml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" ?>
2+
3+
<container xmlns="http://symfony.com/schema/dic/services"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
6+
7+
<parameters>
8+
<parameter key="property_accessor.class">Symfony\Component\PropertyAccess\PropertyAccessor</parameter>
9+
</parameters>
10+
11+
<services>
12+
<service id="property_accessor" class="%property_accessor.class%" />
13+
</services>
14+
</container>

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/validator.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
<parameter key="validator.validator_factory.class">Symfony\Bundle\FrameworkBundle\Validator\ConstraintValidatorFactory</parameter>
1818
<parameter key="validator.mapping.loader.xml_files_loader.mapping_files" type="collection" />
1919
<parameter key="validator.mapping.loader.yaml_files_loader.mapping_files" type="collection" />
20+
<parameter key="validator.expression.class">Symfony\Component\Validator\Constraints\ExpressionValidator</parameter>
2021
</parameters>
2122

2223
<services>
@@ -63,5 +64,10 @@
6364
<service id="validator.mapping.loader.yaml_files_loader" class="%validator.mapping.loader.yaml_files_loader.class%" public="false">
6465
<argument>%validator.mapping.loader.yaml_files_loader.mapping_files%</argument>
6566
</service>
67+
68+
<service id="validator.expression" class="%validator.expression.class%">
69+
<argument type="service" id="property_accessor" />
70+
<tag name="validator.constraint_validator" alias="validator.expression" />
71+
</service>
6672
</services>
6773
</container>

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ private function addAccessControlSection(ArrayNodeDefinition $rootNode)
169169
->beforeNormalization()->ifString()->then(function($v) { return preg_split('/\s*,\s*/', $v); })->end()
170170
->prototype('scalar')->end()
171171
->end()
172+
->scalarNode('allow_if')->defaultNull()->end()
172173
->end()
173174
->fixXmlConfig('role')
174175
->children()

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
use Symfony\Component\DependencyInjection\Reference;
2424
use Symfony\Component\DependencyInjection\Parameter;
2525
use Symfony\Component\Config\FileLocator;
26+
use Symfony\Component\ExpressionLanguage\Expression;
27+
use Symfony\Component\Security\Core\Authorization\ExpressionLanguage;
2628

2729
/**
2830
* SecurityExtension.
@@ -33,10 +35,12 @@
3335
class SecurityExtension extends Extension
3436
{
3537
private $requestMatchers = array();
38+
private $expressions = array();
3639
private $contextListeners = array();
3740
private $listenerPositions = array('pre_auth', 'form', 'http', 'remember_me');
3841
private $factories = array();
3942
private $userProviderFactories = array();
43+
private $expressionLanguage;
4044

4145
public function __construct()
4246
{
@@ -188,8 +192,13 @@ private function createAuthorization($config, ContainerBuilder $container)
188192
$access['ips']
189193
);
190194

195+
$attributes = $access['roles'];
196+
if ($access['allow_if']) {
197+
$attributes[] = $this->createExpression($container, $access['allow_if']);
198+
}
199+
191200
$container->getDefinition('security.access_map')
192-
->addMethodCall('add', array($matcher, $access['roles'], $access['requires_channel']));
201+
->addMethodCall('add', array($matcher, $attributes, $access['requires_channel']));
193202
}
194203
}
195204

@@ -596,6 +605,22 @@ private function createSwitchUserListener($container, $id, $config, $defaultProv
596605
return $switchUserListenerId;
597606
}
598607

608+
private function createExpression($container, $expression)
609+
{
610+
if (isset($this->expressions[$id = 'security.expression.'.sha1($expression)])) {
611+
return $this->expressions[$id];
612+
}
613+
614+
$container
615+
->register($id, 'Symfony\Component\ExpressionLanguage\SerializedParsedExpression')
616+
->setPublic(false)
617+
->addArgument($expression)
618+
->addArgument(serialize($this->getExpressionLanguage()->parse($expression, array('token', 'user', 'object', 'roles', 'request'))))
619+
;
620+
621+
return $this->expressions[$id] = new Reference($id);
622+
}
623+
599624
private function createRequestMatcher($container, $path = null, $host = null, $methods = array(), $ip = null, array $attributes = array())
600625
{
601626
$serialized = serialize(array($path, $host, $methods, $ip, $attributes));
@@ -654,4 +679,16 @@ public function getConfiguration(array $config, ContainerBuilder $container)
654679
// first assemble the factories
655680
return new MainConfiguration($this->factories, $this->userProviderFactories);
656681
}
682+
683+
private function getExpressionLanguage()
684+
{
685+
if (null === $this->expressionLanguage) {
686+
if (!class_exists('Symfony\Component\ExpressionLanguage\ExpressionLanguage')) {
687+
throw new RuntimeException('Unable to use expressions as the Symfony ExpressionLanguage component is not installed.');
688+
}
689+
$this->expressionLanguage = new ExpressionLanguage();
690+
}
691+
692+
return $this->expressionLanguage;
693+
}
657694
}

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,17 +32,21 @@
3232
<parameter key="security.access.simple_role_voter.class">Symfony\Component\Security\Core\Authorization\Voter\RoleVoter</parameter>
3333
<parameter key="security.access.authenticated_voter.class">Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter</parameter>
3434
<parameter key="security.access.role_hierarchy_voter.class">Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter</parameter>
35+
<parameter key="security.access.expression_voter.class">Symfony\Component\Security\Core\Authorization\Voter\ExpressionVoter</parameter>
3536

3637
<parameter key="security.firewall.class">Symfony\Component\Security\Http\Firewall</parameter>
3738
<parameter key="security.firewall.map.class">Symfony\Bundle\SecurityBundle\Security\FirewallMap</parameter>
3839
<parameter key="security.firewall.context.class">Symfony\Bundle\SecurityBundle\Security\FirewallContext</parameter>
3940
<parameter key="security.matcher.class">Symfony\Component\HttpFoundation\RequestMatcher</parameter>
41+
<parameter key="security.expression_matcher.class">Symfony\Component\HttpFoundation\ExpressionRequestMatcher</parameter>
4042

4143
<parameter key="security.role_hierarchy.class">Symfony\Component\Security\Core\Role\RoleHierarchy</parameter>
4244

4345
<parameter key="security.http_utils.class">Symfony\Component\Security\Http\HttpUtils</parameter>
4446

4547
<parameter key="security.validator.user_password.class">Symfony\Component\Security\Core\Validator\Constraints\UserPasswordValidator</parameter>
48+
49+
<parameter key="security.expression_language.class">Symfony\Component\Security\Core\Authorization\ExpressionLanguage</parameter>
4650
</parameters>
4751

4852
<services>
@@ -78,6 +82,7 @@
7882

7983
<service id="security.user_checker" class="%security.user_checker.class%" public="false" />
8084

85+
<service id="security.expression_language" class="%security.expression_language.class%" public="false" />
8186

8287
<!-- Authorization related services -->
8388
<service id="security.access.decision_manager" class="%security.access.decision_manager.class%" public="false">
@@ -104,6 +109,13 @@
104109
<tag name="security.voter" priority="245" />
105110
</service>
106111

112+
<service id="security.access.expression_voter" class="%security.access.expression_voter.class%" public="false">
113+
<argument type="service" id="security.expression_language" />
114+
<argument type="service" id="security.authentication.trust_resolver" />
115+
<argument type="service" id="security.role_hierarchy" on-invalid="null" />
116+
<tag name="security.voter" priority="245" />
117+
</service>
118+
107119

108120
<!-- Firewall related services -->
109121
<service id="security.firewall" class="%security.firewall.class%">

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTest.php

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
use Symfony\Bundle\SecurityBundle\SecurityBundle;
1818
use Symfony\Bundle\SecurityBundle\DependencyInjection\SecurityExtension;
1919
use Symfony\Component\DependencyInjection\ContainerBuilder;
20+
use Symfony\Component\ExpressionLanguage\Expression;
2021

2122
abstract class CompleteConfigurationTest extends \PHPUnit_Framework_TestCase
2223
{
@@ -133,27 +134,31 @@ public function testAccess()
133134

134135
$matcherIds = array();
135136
foreach ($rules as $rule) {
136-
list($matcherId, $roles, $channel) = $rule;
137+
list($matcherId, $attributes, $channel) = $rule;
137138
$requestMatcher = $container->getDefinition($matcherId);
138139

139140
$this->assertFalse(isset($matcherIds[$matcherId]));
140141
$matcherIds[$matcherId] = true;
141142

142143
$i = count($matcherIds);
143144
if (1 === $i) {
144-
$this->assertEquals(array('ROLE_USER'), $roles);
145+
$this->assertEquals(array('ROLE_USER'), $attributes);
145146
$this->assertEquals('https', $channel);
146147
$this->assertEquals(
147148
array('/blog/524', null, array('GET', 'POST')),
148149
$requestMatcher->getArguments()
149150
);
150151
} elseif (2 === $i) {
151-
$this->assertEquals(array('IS_AUTHENTICATED_ANONYMOUSLY'), $roles);
152+
$this->assertEquals(array('IS_AUTHENTICATED_ANONYMOUSLY'), $attributes);
152153
$this->assertNull($channel);
153154
$this->assertEquals(
154155
array('/blog/.*'),
155156
$requestMatcher->getArguments()
156157
);
158+
} elseif (3 === $i) {
159+
$this->assertEquals('IS_AUTHENTICATED_ANONYMOUSLY', $attributes[0]);
160+
$expression = $container->getDefinition($attributes[1])->getArgument(0);
161+
$this->assertEquals("token.getUsername() =~ '/^admin/'", $expression);
157162
}
158163
}
159164
}

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@
8282
'access_control' => array(
8383
array('path' => '/blog/524', 'role' => 'ROLE_USER', 'requires_channel' => 'https', 'methods' => array('get', 'POST')),
8484
array('path' => '/blog/.*', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY'),
85+
array('path' => '/blog/524', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY', 'allow_if' => "token.getUsername() =~ '/^admin/'"),
8586
),
8687

8788
'role_hierarchy' => array(

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,5 +68,6 @@
6868

6969
<rule path="/blog/524" role="ROLE_USER" requires-channel="https" methods="get,POST" />
7070
<rule role='IS_AUTHENTICATED_ANONYMOUSLY' path="/blog/.*" />
71+
<rule role='IS_AUTHENTICATED_ANONYMOUSLY' allow-if="token.getUsername() =~ '/^admin/'" path="/blog/524" />
7172
</config>
7273
</srv:container>

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/yml/container1.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,3 +69,4 @@ security:
6969
-
7070
path: /blog/.*
7171
role: IS_AUTHENTICATED_ANONYMOUSLY
72+
- { path: /blog/524, role: IS_AUTHENTICATED_ANONYMOUSLY, allow_if: "token.getUsername() =~ '/^admin/'" }

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/FormLoginBundle/Resources/config/routing.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,6 @@ form_logout:
3737
form_secure_action:
3838
path: /secure-but-not-covered-by-access-control
3939
defaults: { _controller: FormLoginBundle:Login:secure }
40+
41+
protected-via-expression:
42+
path: /protected-via-expression

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/SecurityRoutingIntegrationTest.php

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,28 @@ public function testSecurityConfigurationForMultipleIPAddresses($config)
9191
$this->assertRestricted($barredClient, '/secured-by-two-ips');
9292
}
9393

94+
/**
95+
* @dataProvider getConfigs
96+
*/
97+
public function testSecurityConfigurationForExpression($config)
98+
{
99+
$allowedClient = $this->createClient(array('test_case' => 'StandardFormLogin', 'root_config' => $config), array('HTTP_USER_AGENT' => 'Firefox 1.0'));
100+
$this->assertAllowed($allowedClient, '/protected-via-expression');
101+
102+
$barredClient = $this->createClient(array('test_case' => 'StandardFormLogin', 'root_config' => $config), array());
103+
$this->assertRestricted($barredClient, '/protected-via-expression');
104+
105+
$allowedClient = $this->createClient(array('test_case' => 'StandardFormLogin', 'root_config' => $config), array());
106+
107+
$allowedClient->request('GET', '/protected-via-expression');
108+
$form = $allowedClient->followRedirect()->selectButton('login')->form();
109+
$form['_username'] = 'johannes';
110+
$form['_password'] = 'test';
111+
$allowedClient->submit($form);
112+
$this->assertRedirect($allowedClient->getResponse(), '/protected-via-expression');
113+
$this->assertAllowed($allowedClient, '/protected-via-expression');
114+
}
115+
94116
private function assertAllowed($client, $path)
95117
{
96118
$client->request('GET', $path);

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/StandardFormLogin/config.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,5 @@ security:
3131
- { path: ^/secured-by-one-ip$, ip: 10.10.10.10, roles: IS_AUTHENTICATED_ANONYMOUSLY }
3232
- { path: ^/secured-by-two-ips$, ips: [1.1.1.1, 2.2.2.2], roles: IS_AUTHENTICATED_ANONYMOUSLY }
3333
- { path: ^/highly_protected_resource$, roles: IS_ADMIN }
34+
- { path: ^/protected-via-expression$, allow_if: "(is_anonymous() and request.headers.get('user-agent') =~ '/Firefox/i') or has_role('ROLE_USER')" }
3435
- { path: .*, roles: IS_AUTHENTICATED_FULLY }

‎src/Symfony/Bundle/SecurityBundle/composer.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@
2525
"symfony/twig-bundle": "~2.2",
2626
"symfony/form": "~2.1",
2727
"symfony/validator": "~2.2",
28-
"symfony/yaml": "~2.0"
28+
"symfony/yaml": "~2.0",
29+
"symfony/expression-language": "~2.4"
2930
},
3031
"autoload": {
3132
"psr-0": { "Symfony\\Bundle\\SecurityBundle\\": "" }

‎src/Symfony/Bundle/TwigBundle/Resources/config/twig.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
<parameter key="twig.extension.form.class">Symfony\Bridge\Twig\Extension\FormExtension</parameter>
2020
<parameter key="twig.extension.httpkernel.class">Symfony\Bridge\Twig\Extension\HttpKernelExtension</parameter>
2121
<parameter key="twig.extension.debug.stopwatch.class">Symfony\Bridge\Twig\Extension\StopwatchExtension</parameter>
22+
<parameter key="twig.extension.expression.class">Symfony\Bridge\Twig\Extension\ExpressionExtension</parameter>
2223
<parameter key="twig.form.engine.class">Symfony\Bridge\Twig\Form\TwigRendererEngine</parameter>
2324
<parameter key="twig.form.renderer.class">Symfony\Bridge\Twig\Form\TwigRenderer</parameter>
2425
<parameter key="twig.translation.extractor.class">Symfony\Bridge\Twig\Translation\TwigExtractor</parameter>
@@ -92,6 +93,10 @@
9293
<argument type="service" id="debug.stopwatch" on-invalid="ignore" />
9394
</service>
9495

96+
<service id="twig.extension.expression" class="%twig.extension.expression.class%" public="false">
97+
<tag name="twig.extension" />
98+
</service>
99+
95100
<service id="twig.extension.httpkernel" class="%twig.extension.httpkernel.class%" public="false">
96101
<argument type="service" id="fragment.handler" />
97102
</service>

‎src/Symfony/Component/DependencyInjection/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ CHANGELOG
44
2.4.0
55
-----
66

7+
* added support for expressions in service definitions
78
* added ContainerAwareTrait to add default container aware behavior to a class
89

910
2.2.0

0 commit comments

Comments
 (0)