Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[Security] Initialize lazy users before serializing them#64337

Merged
nicolas-grekas merged 1 commit into
symfony:6.4symfony/symfony:6.4from
MatTheCat:load_uninitialized_usersMatTheCat/symfony:load_uninitialized_usersCopy head branch name to clipboard
May 23, 2026
Merged

[Security] Initialize lazy users before serializing them#64337
nicolas-grekas merged 1 commit into
symfony:6.4symfony/symfony:6.4from
MatTheCat:load_uninitialized_usersMatTheCat/symfony:load_uninitialized_usersCopy head branch name to clipboard

Conversation

@MatTheCat
Copy link
Copy Markdown
Contributor

Q A
Branch? 6.4
Bug fix? yes
New feature? no
Deprecations? no
Issues Fix #64017
License MIT

Follow-up of #64331.

No tests yet; waiting to be sure if it’s okay to depend on Doctrine and ProxyManager interfaces.

@MatTheCat MatTheCat requested a review from chalasr as a code owner May 22, 2026 23:37
@carsonbot carsonbot changed the title [Security] Initialize lazy users before serializing them Initialize lazy users before serializing them May 22, 2026
@carsonbot carsonbot added this to the 6.4 milestone May 22, 2026
@carsonbot carsonbot changed the title Initialize lazy users before serializing them [Security] Initialize lazy users before serializing them May 22, 2026
@MatTheCat MatTheCat force-pushed the load_uninitialized_users branch from f16b083 to 8bbb6f0 Compare May 23, 2026 10:58
@nicolas-grekas nicolas-grekas force-pushed the load_uninitialized_users branch from 8bbb6f0 to c343ce9 Compare May 23, 2026 14:35
@nicolas-grekas
Copy link
Copy Markdown
Member

Thank you @MatTheCat.

@nicolas-grekas nicolas-grekas merged commit 92ac8ee into symfony:6.4 May 23, 2026
8 of 13 checks passed
@MatTheCat
Copy link
Copy Markdown
Contributor Author

Noticed that ProxyManager’s proxies are supposed to be initialized on serialization, but the test fails when removing the explicit initialization in the ContextListener.

@nicolas-grekas
Copy link
Copy Markdown
Member

Likely because the fixture doesn't mimic exactly how the lib behaves? Should we really care more?

@MatTheCat
Copy link
Copy Markdown
Contributor Author

Guess not; that way we ensure such proxies are initialized whatever their implementation 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.