Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 59126e0

Browse filesBrowse files
author
Robin Chalas
committed
bug #34738 [SecurityBundle] Passwords are not encoded when algorithm set to "true" (nieuwenhuisen)
This PR was merged into the 3.4 branch. Discussion ---------- [SecurityBundle] Passwords are not encoded when algorithm set to "true" | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #34725 | License | MIT | Doc PR | - If the algorithm is set to `true`, password will be encode as plain password. ``` security: encoders: App\User\User: algorithm: true ``` The reason for this is the not strict comparison of php switches. ``` switch ($config['algorithm']) { case 'plaintext': } ``` `true == 'plaintext'` is `true`, so the first case is hit. My first solution was to cast the algorithm to a string, to prevent this. After some feedback I have catch this problem earlier and does not allow true as valid value to the algorithm option. Ps. This is my first PR for Symfony, any feedback is welcome :-)! Commits ------- 83a5517 [SecurityBundle] Passwords are not encoded when algorithm set to \"true\"
2 parents cb429cd + 83a5517 commit 59126e0
Copy full SHA for 59126e0

File tree

Expand file treeCollapse file tree

1 file changed

+7
-1
lines changed
Filter options
Expand file treeCollapse file tree

1 file changed

+7
-1
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
+7-1Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -421,7 +421,13 @@ private function addEncodersSection(ArrayNodeDefinition $rootNode)
421421
->performNoDeepMerging()
422422
->beforeNormalization()->ifString()->then(function ($v) { return ['algorithm' => $v]; })->end()
423423
->children()
424-
->scalarNode('algorithm')->cannotBeEmpty()->end()
424+
->scalarNode('algorithm')
425+
->cannotBeEmpty()
426+
->validate()
427+
->ifTrue(function ($v) { return !\is_string($v); })
428+
->thenInvalid('You must provide a string value.')
429+
->end()
430+
->end()
425431
->scalarNode('hash_algorithm')->info('Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.')->defaultValue('sha512')->end()
426432
->scalarNode('key_length')->defaultValue(40)->end()
427433
->booleanNode('ignore_case')->defaultFalse()->end()

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.