Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit df539e2

Browse filesBrowse files
MatTheCatMatTheCat
committed
[SecurityBundle] Fix logout.csrf_token_generator default value
1 parent fc0f8da commit df539e2
Copy full SHA for df539e2

File tree

Expand file treeCollapse file tree

4 files changed

+40
-2
lines changed
Filter options
Expand file treeCollapse file tree

4 files changed

+40
-2
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
222222
if (isset($v['csrf_token_generator'])) {
223223
$v['enable_csrf'] = true;
224224
} elseif ($v['enable_csrf']) {
225-
$v['csrf_token_generator'] = 'security.csrf.token_generator';
225+
$v['csrf_token_generator'] = 'security.csrf.token_manager';
226226
}
227227

228228
return $v;

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/MainConfigurationTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/MainConfigurationTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ public function testLogoutCsrf()
122122

123123
$assertions = [
124124
'custom_token_generator' => [true, 'a_token_generator'],
125-
'default_token_generator' => [true, 'security.csrf.token_generator'],
125+
'default_token_generator' => [true, 'security.csrf.token_manager'],
126126
'disabled_csrf' => [false, null],
127127
'empty' => [false, null],
128128
];

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php
+13Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,19 @@ public function testCookieClearingOnLogout()
6969
$this->assertNull($cookieJar->get('flavor'));
7070
}
7171

72+
public function testEnabledCsrf()
73+
{
74+
$client = $this->createClient(['test_case' => 'Logout', 'root_config' => 'config_csrf_enabled.yml']);
75+
76+
$cookieJar = $client->getCookieJar();
77+
$cookieJar->set(new Cookie('flavor', 'chocolate', strtotime('+1 day'), null, 'somedomain'));
78+
79+
$client->request('POST', '/login', ['_username' => 'johannes', '_password' => 'test']);
80+
$client->request('GET', '/logout');
81+
82+
$this->assertResponseStatusCodeSame(Response::HTTP_FORBIDDEN);
83+
}
84+
7285
private function callInRequestContext(KernelBrowser $client, callable $callable): void
7386
{
7487
/** @var EventDispatcherInterface $eventDispatcher */

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Logout/config_csrf_enabled.yml

Copy file name to clipboard
+25Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
imports:
2+
- { resource: ./../config/framework.yml }
3+
4+
security:
5+
password_hashers:
6+
Symfony\Component\Security\Core\User\InMemoryUser: plaintext
7+
8+
providers:
9+
in_memory:
10+
memory:
11+
users:
12+
johannes: { password: test, roles: [ROLE_USER] }
13+
14+
firewalls:
15+
default:
16+
form_login:
17+
check_path: login
18+
remember_me: true
19+
require_previous_session: false
20+
logout:
21+
enable_csrf: true
22+
23+
access_control:
24+
- { path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
25+
- { path: .*, roles: IS_AUTHENTICATED_FULLY }

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.