Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[SecurityBundle] Fix valid provider considered undefined #24132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 9, 2017
Merged

[SecurityBundle] Fix valid provider considered undefined #24132

merged 1 commit into from
Sep 9, 2017

Conversation

chalasr
Copy link
Member

@chalasr chalasr commented Sep 7, 2017

Q A
Branch? 3.4
Bug fix? yes
New feature? no
BC breaks? no
Deprecations? no
Tests pass? yes
Fixed tickets n/a
License MIT
Doc PR n/a

Silly mistake.

@chalasr chalasr mentioned this pull request Sep 7, 2017
Merged
@mvrhov
Copy link

mvrhov commented Sep 7, 2017

This still doesn't work.
The content of array is:

array(1) {
  [0] =>
  string(32) "account.security.user_provider"
}

but $userProvider contains security.user.provider.concrete.account

@chalasr chalasr force-pushed the secu-fix-valid-provider branch from 37f7ac0 to 33e2952 Compare September 7, 2017 18:59
@chalasr
Copy link
Member Author

chalasr commented Sep 7, 2017 •
edited
Loading

@mvrhov That should be better now (using { provider_name: { id: some_service } was not handled). Could you please retry?

@chalasr chalasr force-pushed the secu-fix-valid-provider branch 2 times, most recently from c924b61 to 7fab70e Compare September 7, 2017 21:27
@chalasr chalasr added this to the 3.4 milestone Sep 7, 2017
@mvrhov
Copy link

mvrhov commented Sep 8, 2017

This seem to work now

@chalasr
Copy link
Member Author

chalasr commented Sep 8, 2017 •
edited
Loading

Thanks for confirming.

Build failures unrelated. Ready

@nicolas-grekas
Copy link
Member

any test case?

@chalasr chalasr force-pushed the secu-fix-valid-provider branch 2 times, most recently from 796be6d to 8bde4ae Compare September 8, 2017 11:42
@chalasr
Copy link
Member Author

chalasr commented Sep 8, 2017

now with tests :)

@jrysig
Copy link

jrysig commented Sep 8, 2017

This patch works fine for me, thank you.
With current Symfony 3.4.x-dev I'm getting error:
Invalid firewall "main": user provider "fos_userbundle" not found.

@chalasr chalasr force-pushed the secu-fix-valid-provider branch from 8bde4ae to 6c61fd2 Compare September 9, 2017 06:50
@chalasr
Copy link
Member Author

chalasr commented Sep 9, 2017

Rebased

ro0NL
ro0NL reviewed Sep 9, 2017
View reviewed changes
src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php Outdated
throw new InvalidConfigurationException(sprintf('Invalid firewall "%s": user provider "%s" not found.', $id, $firewall['provider']));
}
$defaultProvider = $providerIds[$firewall['provider']];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldnt the str_replace conversion happen here as well then?

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php Outdated
throw new InvalidConfigurationException(sprintf('Invalid firewall "%s": user provider "%s" not found.', $id, $firewall[$key]['provider']));
}
$userProvider = $this->getUserProviderId($firewall[$key]['provider']);
$userProvider = $providerIds[$firewall[$key]['provider']];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php Outdated
@@ -596,7 +596,7 @@ private function createUserProviders($config, ContainerBuilder $container)
$providerIds = array();
foreach ($config['providers'] as $name => $provider) {
$id = $this->createUserDaoProvider($name, $provider, $container);
$providerIds[] = $id;
$providerIds[$name] = $id;
Copy link
Contributor

@ro0NL ro0NL Sep 9, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or normalize here :) (throw on duplicates?)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch, not sure about handling duplicates now

ro0NL
ro0NL reviewed Sep 9, 2017
View reviewed changes
src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php Outdated
@@ -647,6 +647,11 @@ private function getUserProviderId($name)
return 'security.user.provider.concrete.'.strtolower($name);
}

private function isValidProviderName($providerName, array $allowedProviders)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

perhaps make this a getter.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

finally removed

@chalasr chalasr force-pushed the secu-fix-valid-provider branch from 6c61fd2 to 13cda57 Compare September 9, 2017 10:13
@chalasr chalasr force-pushed the secu-fix-valid-provider branch from 13cda57 to efa4cb9 Compare September 9, 2017 10:20
ro0NL
ro0NL reviewed Sep 9, 2017
View reviewed changes
src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php
@@ -596,7 +596,7 @@ private function createUserProviders($config, ContainerBuilder $container)
$providerIds = array();
foreach ($config['providers'] as $name => $provider) {
$id = $this->createUserDaoProvider($name, $provider, $container);
$providerIds[] = $id;
$providerIds[str_replace('-', '_', $name)] = $id;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

by now i think the conversion should happen in getUserProviderId actually 🤔 and simply make the check below $userProvider. That would be more robust.

$userProvider = $this->getUserProviderId($firewall[$key]['provider']);
if (!isset($providerIds[$userProvider])) {
   // throw
}

sorry :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure about BC :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

point is we create a different id 2 lines above by passing $name as is to createUserDaoProvider.. that looks weird.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get your point but yes, changing this is not fine regarding BC. Note also that when using a custom provider (specifying my_provider: { id: some_service }), createUserDaoProvider returns the some_service id, it doesn't rely on getUserProviderId. Let's avoid any behavior change here, not the right moment for that :)
I'm going to review this part of the extension in 2.7 once this merged, I believe there are some bugs. Right now, 3.4's security setup is broken, this covers all edge cases and makes it work again. I would like to quickly move on and polish afterwards if needed.
Btw, thanks for your review, it was useful actually.

@mvrhov
Copy link

mvrhov commented Sep 9, 2017

IMO this should get merged ASAP as 3.4 is broken ATM. And then as @chalasr said it can be polished.

@fabpot
Copy link
Member

fabpot commented Sep 9, 2017

Thank you @chalasr.

@fabpot fabpot merged commit efa4cb9 into symfony:3.4 Sep 9, 2017
fabpot added a commit that referenced this pull request Sep 9, 2017
@fabpot
bug #24132 [SecurityBundle] Fix valid provider considered undefined (…
a0bdd5a 
…chalasr)

This PR was merged into the 3.4 branch.

Discussion
----------

[SecurityBundle] Fix valid provider considered undefined

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Silly mistake.

Commits
-------

efa4cb9 [SecurityBundle] Fix valid provider considered undefined
@chalasr chalasr deleted the secu-fix-valid-provider branch September 10, 2017 08:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ro0NL ro0NL ro0NL approved these changes

Assignees
No one assigned
Labels
Bug SecurityBundle Status: Needs Review
Projects
None yet
Milestone
3.4
Development

Successfully merging this pull request may close these issues.
7 participants
@chalasr @mvrhov @nicolas-grekas @jrysig @fabpot @ro0NL @carsonbot