Skip to content

Commit 5818b75

Browse files
fabpotfabpot
committed
Merge branch '2.3' into 2.4
* 2.3: [Security] made code easier to understand, added some missing unit tests [DependencyInjection] fixed InlineServiceDefinitionsPass to not inline a service if it's part of the current definition (to avoid an infinite loop) [DomCrawler] Fixed creating form objects from form nodes. disabled php.ini changes when using HHVM in .travis.yml [Process] fixed HHVM support Add support for HHVM in the getting of the PHP executable [Security] fixed error 500 instead of 403 if previous exception is provided to AccessDeniedException
2 parents 535bfa3 + c8655fe commit 5818b75

File tree

1 file changed

+56
-57
lines changed

1 file changed

+56
-57
lines changed

‎Firewall/ExceptionListener.php

Lines changed: 56 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -87,84 +87,83 @@ public function unregister(EventDispatcherInterface $dispatcher)
8787
public function onKernelException(GetResponseForExceptionEvent $event)
8888
{
8989
$exception = $event->getException();
90-
$request = $event->getRequest();
90+
do {
91+
if ($exception instanceof AuthenticationException) {
92+
return $this->handleAuthenticationException($event, $exception);
93+
} elseif ($exception instanceof AccessDeniedException) {
94+
return $this->handleAccessDeniedException($event, $exception);
95+
} elseif ($exception instanceof LogoutException) {
96+
return $this->handleLogoutException($event, $exception);
97+
}
98+
} while (null !== $exception = $exception->getPrevious());
99+
}
91100

92-
// determine the actual cause for the exception
93-
while (null !== $previous = $exception->getPrevious()) {
94-
$exception = $previous;
101+
private function handleAuthenticationException(GetResponseForExceptionEvent $event, AuthenticationException $exception)
102+
{
103+
if (null !== $this->logger) {
104+
$this->logger->info(sprintf('Authentication exception occurred; redirecting to authentication entry point (%s)', $exception->getMessage()));
95105
}
96106

97-
if ($exception instanceof AuthenticationException) {
107+
try {
108+
$event->setResponse($this->startAuthentication($event->getRequest(), $exception));
109+
} catch (\Exception $e) {
110+
$event->setException($e);
111+
}
112+
}
113+
114+
private function handleAccessDeniedException(GetResponseForExceptionEvent $event, AccessDeniedException $exception)
115+
{
116+
$event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception));
117+
118+
$token = $this->context->getToken();
119+
if (!$this->authenticationTrustResolver->isFullFledged($token)) {
98120
if (null !== $this->logger) {
99-
$this->logger->info(sprintf('Authentication exception occurred; redirecting to authentication entry point (%s)', $exception->getMessage()));
121+
$this->logger->debug(sprintf('Access is denied (user is not fully authenticated) by "%s" at line %s; redirecting to authentication entry point', $exception->getFile(), $exception->getLine()));
100122
}
101123

102124
try {
103-
$response = $this->startAuthentication($request, $exception);
125+
$insufficientAuthenticationException = new InsufficientAuthenticationException('Full authentication is required to access this resource.', 0, $exception);
126+
$insufficientAuthenticationException->setToken($token);
127+
128+
$event->setResponse($this->startAuthentication($event->getRequest(), $insufficientAuthenticationException));
104129
} catch (\Exception $e) {
105130
$event->setException($e);
106-
107-
return;
108131
}
109-
} elseif ($exception instanceof AccessDeniedException) {
110-
$event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception));
111132

112-
$token = $this->context->getToken();
113-
if (!$this->authenticationTrustResolver->isFullFledged($token)) {
114-
if (null !== $this->logger) {
115-
$this->logger->debug(sprintf('Access is denied (user is not fully authenticated) by "%s" at line %s; redirecting to authentication entry point', $exception->getFile(), $exception->getLine()));
116-
}
133+
return;
134+
}
135+
136+
if (null !== $this->logger) {
137+
$this->logger->debug(sprintf('Access is denied (and user is neither anonymous, nor remember-me) by "%s" at line %s', $exception->getFile(), $exception->getLine()));
138+
}
117139

118-
try {
119-
$insufficientAuthenticationException = new InsufficientAuthenticationException('Full authentication is required to access this resource.', 0, $exception);
120-
$insufficientAuthenticationException->setToken($token);
121-
$response = $this->startAuthentication($request, $insufficientAuthenticationException);
122-
} catch (\Exception $e) {
123-
$event->setException($e);
140+
try {
141+
if (null !== $this->accessDeniedHandler) {
142+
$response = $this->accessDeniedHandler->handle($event->getRequest(), $exception);
124143

125-
return;
126-
}
127-
} else {
128-
if (null !== $this->logger) {
129-
$this->logger->debug(sprintf('Access is denied (and user is neither anonymous, nor remember-me) by "%s" at line %s', $exception->getFile(), $exception->getLine()));
144+
if ($response instanceof Response) {
145+
$event->setResponse($response);
130146
}
147+
} elseif (null !== $this->errorPage) {
148+
$subRequest = $this->httpUtils->createRequest($event->getRequest(), $this->errorPage);
149+
$subRequest->attributes->set(SecurityContextInterface::ACCESS_DENIED_ERROR, $exception);
131150

132-
try {
133-
if (null !== $this->accessDeniedHandler) {
134-
$response = $this->accessDeniedHandler->handle($request, $exception);
135-
136-
if (!$response instanceof Response) {
137-
return;
138-
}
139-
} elseif (null !== $this->errorPage) {
140-
$subRequest = $this->httpUtils->createRequest($request, $this->errorPage);
141-
$subRequest->attributes->set(SecurityContextInterface::ACCESS_DENIED_ERROR, $exception);
142-
143-
$response = $event->getKernel()->handle($subRequest, HttpKernelInterface::SUB_REQUEST, true);
144-
} else {
145-
return;
146-
}
147-
} catch (\Exception $e) {
148-
if (null !== $this->logger) {
149-
$this->logger->error(sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), $e->getMessage()));
150-
}
151-
152-
$event->setException(new \RuntimeException('Exception thrown when handling an exception.', 0, $e));
153-
154-
return;
155-
}
151+
$event->setResponse($event->getKernel()->handle($subRequest, HttpKernelInterface::SUB_REQUEST, true));
156152
}
157-
} elseif ($exception instanceof LogoutException) {
153+
} catch (\Exception $e) {
158154
if (null !== $this->logger) {
159-
$this->logger->info(sprintf('Logout exception occurred; wrapping with AccessDeniedHttpException (%s)', $exception->getMessage()));
155+
$this->logger->error(sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), $e->getMessage()));
160156
}
161157

162-
return;
163-
} else {
164-
return;
158+
$event->setException(new \RuntimeException('Exception thrown when handling an exception.', 0, $e));
165159
}
160+
}
166161

167-
$event->setResponse($response);
162+
private function handleLogoutException(GetResponseForExceptionEvent $event, LogoutException $exception)
163+
{
164+
if (null !== $this->logger) {
165+
$this->logger->info(sprintf('Logout exception occurred; wrapping with AccessDeniedHttpException (%s)', $exception->getMessage()));
166+
}
168167
}
169168

170169
/**

0 commit comments

Comments
 (0)