Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 6b9d78d

Browse filesBrowse files
wouterjwouterj
committed
Added tests
1 parent 59f49b2 commit 6b9d78d
Copy full SHA for 6b9d78d

21 files changed

+1193
-107
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginFactory.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginFactory.php
+2-3Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,9 +104,8 @@ public function createAuthenticator(ContainerBuilder $container, string $id, arr
104104
$options = array_merge($defaultOptions, array_intersect_key($config, $defaultOptions));
105105
$container
106106
->setDefinition($authenticatorId, new ChildDefinition('security.authenticator.form_login'))
107-
->replaceArgument(1, isset($config['csrf_token_generator']) ? new Reference($config['csrf_token_generator']) : null)
108-
->replaceArgument(2, new Reference($userProviderId))
109-
->replaceArgument(3, $options);
107+
->replaceArgument(1, new Reference($userProviderId))
108+
->replaceArgument(2, $options);
110109

111110
return $authenticatorId;
112111
}

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_authenticator.xml

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Resources/config/security_authenticator.xml
-2Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,13 @@
8484
abstract="true">
8585
<argument type="abstract">realm name</argument>
8686
<argument type="abstract">user provider</argument>
87-
<argument type="service" id="security.encoder_factory" />
8887
<argument type="service" id="logger" on-invalid="null" />
8988
</service>
9089

9190
<service id="security.authenticator.form_login"
9291
class="Symfony\Component\Security\Http\Authenticator\FormLoginAuthenticator"
9392
abstract="true">
9493
<argument type="service" id="security.http_utils" />
95-
<argument /> <!-- csrf token generator -->
9694
<argument type="abstract">user provider</argument>
9795
<argument type="abstract">options</argument>
9896
</service>

‎src/Symfony/Component/Security/Http/Authentication/AuthenticatorManager.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Authentication/AuthenticatorManager.php
+5-24Lines changed: 5 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
2424
use Symfony\Component\Security\Core\User\UserInterface;
2525
use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
26-
use Symfony\Component\Security\Http\Authenticator\Token\PreAuthenticationToken;
2726
use Symfony\Component\Security\Http\Event\InteractiveLoginEvent;
2827
use Symfony\Component\Security\Http\Event\LoginFailureEvent;
2928
use Symfony\Component\Security\Http\Event\LoginSuccessEvent;
@@ -40,8 +39,6 @@
4039
*/
4140
class AuthenticatorManager implements AuthenticatorManagerInterface, UserAuthenticatorInterface
4241
{
43-
use AuthenticatorManagerTrait;
44-
4542
private $authenticators;
4643
private $tokenStorage;
4744
private $eventDispatcher;
@@ -131,7 +128,9 @@ private function executeAuthenticators(array $authenticators, Request $request):
131128
// lazily (after initialization). This is important for e.g. the AnonymousAuthenticator
132129
// as its support is relying on the (initialized) token in the TokenStorage.
133130
if (false === $authenticator->supports($request)) {
134-
$this->logger->debug('Skipping the "{authenticator}" authenticator as it did not support the request.', ['authenticator' => \get_class($authenticator)]);
131+
if (null !== $this->logger) {
132+
$this->logger->debug('Skipping the "{authenticator}" authenticator as it did not support the request.', ['authenticator' => \get_class($authenticator)]);
133+
}
135134
continue;
136135
}
137136

@@ -215,21 +214,14 @@ private function authenticateViaAuthenticator(AuthenticatorInterface $authentica
215214
throw new UsernameNotFoundException(sprintf('Null returned from "%s::getUser()".', \get_class($authenticator)));
216215
}
217216

218-
if (!$user instanceof UserInterface) {
219-
throw new \UnexpectedValueException(sprintf('The %s::getUser() method must return a UserInterface. You returned %s.', \get_class($authenticator), \is_object($user) ? \get_class($user) : \gettype($user)));
220-
}
221-
222217
$event = new VerifyAuthenticatorCredentialsEvent($authenticator, $credentials, $user);
223218
$this->eventDispatcher->dispatch($event);
224219
if (true !== $event->areCredentialsValid()) {
225220
throw new BadCredentialsException(sprintf('Authentication failed because "%s" did not approve the credentials.', \get_class($authenticator)));
226221
}
227222

228-
// turn the UserInterface into a TokenInterface
223+
// turn the UserInterface into a TokenInterface
229224
$authenticatedToken = $authenticator->createAuthenticatedToken($user, $this->providerKey);
230-
if (!$authenticatedToken instanceof TokenInterface) {
231-
throw new \UnexpectedValueException(sprintf('The %s::createAuthenticatedToken() method must return a TokenInterface. You returned %s.', \get_class($authenticator), \is_object($authenticatedToken) ? \get_class($authenticatedToken) : \gettype($authenticatedToken)));
232-
}
233225

234226
if (true === $this->eraseCredentials) {
235227
$authenticatedToken->eraseCredentials();
@@ -259,21 +251,10 @@ private function handleAuthenticationSuccess(TokenInterface $token, Request $req
259251
return $loginSuccessEvent->getResponse();
260252
}
261253

262-
private function handleAuthenticationFailure(AuthenticationException $exception, TokenInterface $token)
263-
{
264-
if (null !== $this->eventDispatcher) {
265-
$this->eventDispatcher->dispatch(new AuthenticationFailureEvent($token, $exception), AuthenticationEvents::AUTHENTICATION_FAILURE);
266-
}
267-
268-
$exception->setToken($token);
269-
270-
throw $exception;
271-
}
272-
273254
/**
274255
* Handles an authentication failure and returns the Response for the authenticator.
275256
*/
276-
private function handleAuthenticatorFailure(AuthenticationException $authenticationException, Request $request, AuthenticatorInterface $authenticator): ?Response
257+
private function handleAuthenticationFailure(AuthenticationException $authenticationException, Request $request, AuthenticatorInterface $authenticator): ?Response
277258
{
278259
$response = $authenticator->onAuthenticationFailure($request, $authenticationException);
279260

‎src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php
+2-8Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020
use Symfony\Component\Security\Core\Security;
2121
use Symfony\Component\Security\Core\User\UserInterface;
2222
use Symfony\Component\Security\Core\User\UserProviderInterface;
23-
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
2423
use Symfony\Component\Security\Http\HttpUtils;
2524
use Symfony\Component\Security\Http\ParameterBagUtils;
2625
use Symfony\Component\Security\Http\Util\TargetPathTrait;
@@ -38,13 +37,11 @@ class FormLoginAuthenticator extends AbstractLoginFormAuthenticator implements P
3837

3938
private $options;
4039
private $httpUtils;
41-
private $csrfTokenManager;
4240
private $userProvider;
4341

44-
public function __construct(HttpUtils $httpUtils, ?CsrfTokenManagerInterface $csrfTokenManager, UserProviderInterface $userProvider, array $options)
42+
public function __construct(HttpUtils $httpUtils, UserProviderInterface $userProvider, array $options)
4543
{
4644
$this->httpUtils = $httpUtils;
47-
$this->csrfTokenManager = $csrfTokenManager;
4845
$this->options = array_merge([
4946
'username_parameter' => '_username',
5047
'password_parameter' => '_password',
@@ -75,10 +72,7 @@ public function supports(Request $request): bool
7572
public function getCredentials(Request $request): array
7673
{
7774
$credentials = [];
78-
79-
if (null !== $this->csrfTokenManager) {
80-
$credentials['csrf_token'] = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
81-
}
75+
$credentials['csrf_token'] = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
8276

8377
if ($this->options['post_only']) {
8478
$credentials['username'] = ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']);

‎src/Symfony/Component/Security/Http/Authenticator/HttpBasicAuthenticator.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Authenticator/HttpBasicAuthenticator.php
+1-4Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
use Symfony\Component\HttpFoundation\Response;
1717
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1818
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
19-
use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
2019
use Symfony\Component\Security\Core\Exception\AuthenticationException;
2120
use Symfony\Component\Security\Core\User\UserInterface;
2221
use Symfony\Component\Security\Core\User\UserProviderInterface;
@@ -33,14 +32,12 @@ class HttpBasicAuthenticator implements AuthenticatorInterface, AuthenticationEn
3332
{
3433
private $realmName;
3534
private $userProvider;
36-
private $encoderFactory;
3735
private $logger;
3836

39-
public function __construct(string $realmName, UserProviderInterface $userProvider, EncoderFactoryInterface $encoderFactory, ?LoggerInterface $logger = null)
37+
public function __construct(string $realmName, UserProviderInterface $userProvider, ?LoggerInterface $logger = null)
4038
{
4139
$this->realmName = $realmName;
4240
$this->userProvider = $userProvider;
43-
$this->encoderFactory = $encoderFactory;
4441
$this->logger = $logger;
4542
}
4643

‎src/Symfony/Component/Security/Http/Authenticator/RememberMeAuthenticator.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Authenticator/RememberMeAuthenticator.php
+14-13Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
* file that was distributed with this source code.
1010
*/
1111

12-
namespace Symfony\Component\Security\Http\Authenticator\Token;
12+
namespace Symfony\Component\Security\Http\Authenticator;
1313

1414
use Symfony\Component\HttpFoundation\Request;
1515
use Symfony\Component\HttpFoundation\Response;
@@ -18,9 +18,7 @@
1818
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1919
use Symfony\Component\Security\Core\Exception\AuthenticationException;
2020
use Symfony\Component\Security\Core\User\UserInterface;
21-
use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
2221
use Symfony\Component\Security\Http\RememberMe\AbstractRememberMeServices;
23-
use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy;
2422

2523
/**
2624
* The RememberMe *Authenticator* performs remember me authentication.
@@ -35,21 +33,22 @@
3533
*
3634
* @final
3735
*/
38-
class RememberMeAuthenticator implements AuthenticatorInterface
36+
class RememberMeAuthenticator implements AuthenticatorInterface, CustomAuthenticatedInterface
3937
{
4038
private $rememberMeServices;
4139
private $secret;
4240
private $tokenStorage;
43-
private $options;
44-
private $sessionStrategy;
41+
private $options = [
42+
'secure' => false,
43+
'httponly' => true,
44+
];
4545

46-
public function __construct(AbstractRememberMeServices $rememberMeServices, string $secret, TokenStorageInterface $tokenStorage, array $options, ?SessionAuthenticationStrategy $sessionStrategy = null)
46+
public function __construct(AbstractRememberMeServices $rememberMeServices, string $secret, TokenStorageInterface $tokenStorage, array $options)
4747
{
4848
$this->rememberMeServices = $rememberMeServices;
4949
$this->secret = $secret;
5050
$this->tokenStorage = $tokenStorage;
51-
$this->options = $options;
52-
$this->sessionStrategy = $sessionStrategy;
51+
$this->options = array_merge($this->options, $options);
5352
}
5453

5554
public function supports(Request $request): ?bool
@@ -87,6 +86,12 @@ public function getUser($credentials): ?UserInterface
8786
return $this->rememberMeServices->performLogin($credentials['cookie_parts'], $credentials['request']);
8887
}
8988

89+
public function checkCredentials($credentials, UserInterface $user): bool
90+
{
91+
// remember me always is valid (if a user could be found)
92+
return true;
93+
}
94+
9095
public function createAuthenticatedToken(UserInterface $user, string $providerKey): TokenInterface
9196
{
9297
return new RememberMeToken($user, $providerKey, $this->secret);
@@ -101,10 +106,6 @@ public function onAuthenticationFailure(Request $request, AuthenticationExceptio
101106

102107
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $providerKey): ?Response
103108
{
104-
if ($request->hasSession() && $request->getSession()->isStarted()) {
105-
$this->sessionStrategy->onAuthentication($request, $token);
106-
}
107-
108109
return null;
109110
}
110111
}

‎src/Symfony/Component/Security/Http/EventListener/PasswordMigratingListener.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/EventListener/PasswordMigratingListener.php
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ public function onCredentialsVerification(VerifyAuthenticatorCredentialsEvent $e
3636
return;
3737
}
3838

39-
if (null !== $password = $authenticator->getPassword($event->getCredentials())) {
39+
if (null === $password = $authenticator->getPassword($event->getCredentials())) {
4040
return;
4141
}
4242

@@ -46,11 +46,11 @@ public function onCredentialsVerification(VerifyAuthenticatorCredentialsEvent $e
4646
}
4747

4848
$passwordEncoder = $this->encoderFactory->getEncoder($user);
49-
if (!method_exists($passwordEncoder, 'needsRehash') || !$passwordEncoder->needsRehash($user)) {
49+
if (!$passwordEncoder->needsRehash($user->getPassword())) {
5050
return;
5151
}
5252

53-
$authenticator->upgradePassword($user, $passwordEncoder->encodePassword($user, $password));
53+
$authenticator->upgradePassword($user, $passwordEncoder->encodePassword($password, $user->getSalt()));
5454
}
5555

5656
public static function getSubscribedEvents(): array

‎src/Symfony/Component/Security/Http/EventListener/RememberMeListener.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/EventListener/RememberMeListener.php
+12-4Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,15 @@ public function __construct(RememberMeServicesInterface $rememberMeServices, str
3939

4040
public function onSuccessfulLogin(LoginSuccessEvent $event): void
4141
{
42-
if (!$this->isRememberMeEnabled($event->getAuthenticator(), $event->getProviderKey())) {
42+
if (!$this->isRememberMeEnabled($event->getProviderKey(), $event->getAuthenticator())) {
43+
return;
44+
}
45+
46+
if (null === $event->getResponse()) {
47+
if (null !== $this->logger) {
48+
$this->logger->debug('Remember me skipped: the authenticator did not set a success response.', ['authenticator' => \get_class($event->getAuthenticator())]);
49+
}
50+
4351
return;
4452
}
4553

@@ -48,21 +56,21 @@ public function onSuccessfulLogin(LoginSuccessEvent $event): void
4856

4957
public function onFailedLogin(LoginFailureEvent $event): void
5058
{
51-
if (!$this->isRememberMeEnabled($event->getAuthenticator(), $event->getProviderKey())) {
59+
if (!$this->isRememberMeEnabled($event->getProviderKey())) {
5260
return;
5361
}
5462

5563
$this->rememberMeServices->loginFail($event->getRequest(), $event->getException());
5664
}
5765

58-
private function isRememberMeEnabled(AuthenticatorInterface $authenticator, string $providerKey): bool
66+
private function isRememberMeEnabled(string $providerKey, ?AuthenticatorInterface $authenticator = null): bool
5967
{
6068
if ($providerKey !== $this->providerKey) {
6169
// This listener is created for a different firewall.
6270
return false;
6371
}
6472

65-
if (!$authenticator instanceof RememberMeAuthenticatorInterface || !$authenticator->supportsRememberMe()) {
73+
if (null !== $authenticator && (!$authenticator instanceof RememberMeAuthenticatorInterface || !$authenticator->supportsRememberMe())) {
6674
if (null !== $this->logger) {
6775
$this->logger->debug('Remember me skipped: your authenticator does not support it.', ['authenticator' => \get_class($authenticator)]);
6876
}

‎src/Symfony/Component/Security/Http/EventListener/UserCheckerListener.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/EventListener/UserCheckerListener.php
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,19 @@ public function __construct(UserCheckerInterface $userChecker)
2323

2424
public function preCredentialsVerification(VerifyAuthenticatorCredentialsEvent $event): void
2525
{
26+
if (null === $event->getUser()) {
27+
return;
28+
}
29+
2630
$this->userChecker->checkPreAuth($event->getUser());
2731
}
2832

2933
public function postCredentialsVerification(VerifyAuthenticatorCredentialsEvent $event): void
3034
{
35+
if (null === $event->getUser() || !$event->areCredentialsValid()) {
36+
return;
37+
}
38+
3139
$this->userChecker->checkPostAuth($event->getUser());
3240
}
3341

‎src/Symfony/Component/Security/Http/EventListener/VerifyAuthenticatorCredentialsListener.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/EventListener/VerifyAuthenticatorCredentialsListener.php
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ public function __construct(EncoderFactoryInterface $encoderFactory)
3131

3232
public function onAuthenticating(VerifyAuthenticatorCredentialsEvent $event): void
3333
{
34+
if ($event->areCredentialsValid()) {
35+
return;
36+
}
37+
3438
$authenticator = $event->getAuthenticator();
3539
if ($authenticator instanceof PasswordAuthenticatedInterface) {
3640
// Use the password encoder to validate the credentials

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.