Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit f807d14

Browse filesBrowse files
Cydonia7wouterj
authored andcommitted
Fixes
1 parent 5b015f2 commit f807d14
Copy full SHA for f807d14

File tree

Expand file treeCollapse file tree

2 files changed

+9
-25
lines changed
Filter options
Expand file treeCollapse file tree

2 files changed

+9
-25
lines changed

‎book/security.rst

Copy file name to clipboardExpand all lines: book/security.rst
+7-21Lines changed: 7 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -802,33 +802,18 @@ the ``^``) would match ``/admin/foo`` but would also match URLs like ``/foo/admi
802802

803803
To learn about all of this, see :doc:`/cookbook/security/access_control`.
804804

805-
Securing other Services
806-
~~~~~~~~~~~~~~~~~~~~~~~
807-
808-
In fact, anything in Symfony can be protected using a strategy similar to
809-
the one seen in the previous section. For example, suppose you have a service
810-
(i.e. a PHP class) whose job is to send emails from one user to another.
811-
You can restrict use of this class - no matter where it's being used from -
812-
to users that have a specific role.
813-
814805
.. _`book-security-securing-controller`:
815806

816807
Securing Controllers and other Code
817808
...................................
818809

819-
You can easily deny access from inside a controller:
820-
821-
.. versionadded:: 2.6
822-
The ``denyAccessUnlessGranted()`` method was introduced in Symfony 2.6. Previously (and
823-
still now), you could check access directly and throw the ``AccessDeniedException`` as shown
824-
in the example below).
825-
826-
.. code-block:: php
810+
You can easily deny access from inside a controller::
827811

828812
// ...
829813

830814
public function helloAction($name)
831815
{
816+
// The second parameter is used to specify on what object the role is tested.
832817
$this->denyAccessUnlessGranted('ROLE_ADMIN', null, 'Unable to access this page!');
833818

834819
// Old way :
@@ -839,6 +824,11 @@ You can easily deny access from inside a controller:
839824
// ...
840825
}
841826

827+
.. versionadded:: 2.6
828+
The ``denyAccessUnlessGranted()`` method was introduced in Symfony 2.6. Previously (and
829+
still now), you could check access directly and throw the ``AccessDeniedException`` as shown
830+
in the example above).
831+
842832
In both cases, a special
843833
:class:`Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException`
844834
is thrown, which ultimately triggers a 403 HTTP response inside Symfony.
@@ -860,10 +850,6 @@ using annotations::
860850
*/
861851
public function helloAction($name)
862852
{
863-
$this->denyAccessUnlessGranted(new Expression(
864-
'"ROLE_ADMIN" in roles or (user and user.isSuperAdmin())'
865-
));
866-
867853
// ...
868854
}
869855

‎cookbook/expression/expressions.rst

Copy file name to clipboardExpand all lines: cookbook/expression/expressions.rst
+2-4Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,9 @@ accepts an :class:`Symfony\\Component\\ExpressionLanguage\\Expression` object::
3333

3434
public function indexAction()
3535
{
36-
if (!$this->get('security.authorization_checker')->isGranted(new Expression(
36+
$this->denyAccessUnlessGranted(new Expression(
3737
'"ROLE_ADMIN" in roles or (user and user.isSuperAdmin())'
38-
))) {
39-
throw $this->createAccessDeniedException();
40-
}
38+
));
4139

4240
// ...
4341
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.