Skip to content
This repository was archived by the owner on May 31, 2024. It is now read-only.

Commit 6156910

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '4.0'
* 4.0: [appveyor] set memory_limit=-1 [Console] Keep the modified exception handler [Console] Fix restoring exception handler [Router] Skip anonymous classes when loading annotated routes allow dashes in cwd pathname when running the tests Fixed Request::__toString ignoring cookies Make sure we only build once and have one time the prefix when importing routes [Security] Fix fatal error on non string username [FrameworkBundle] Automatically enable the CSRF if component *+ session* are loaded
2 parents 36d6c2a + cd93942 commit 6156910

File tree

4 files changed

+55
-19
lines changed

4 files changed

+55
-19
lines changed

‎Http/Firewall/ContextListener.php

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,6 @@ class ContextListener implements ListenerInterface
4444
private $registered;
4545
private $trustResolver;
4646

47-
private static $unserializeExceptionCode = 0x37313bc;
48-
4947
/**
5048
* @param TokenStorageInterface $tokenStorage
5149
* @param iterable|UserProviderInterface[] $userProviders
@@ -221,7 +219,7 @@ private function safelyUnserialize($serializedToken)
221219
$prevUnserializeHandler = ini_set('unserialize_callback_func', __CLASS__.'::handleUnserializeCallback');
222220
$prevErrorHandler = set_error_handler(function ($type, $msg, $file, $line, $context = array()) use (&$prevErrorHandler) {
223221
if (__FILE__ === $file) {
224-
throw new \UnexpectedValueException($msg, self::$unserializeExceptionCode);
222+
throw new \UnexpectedValueException($msg, 0x37313bc);
225223
}
226224

227225
return $prevErrorHandler ? $prevErrorHandler($type, $msg, $file, $line, $context) : false;
@@ -235,7 +233,7 @@ private function safelyUnserialize($serializedToken)
235233
restore_error_handler();
236234
ini_set('unserialize_callback_func', $prevUnserializeHandler);
237235
if ($e) {
238-
if (!$e instanceof \UnexpectedValueException || self::$unserializeExceptionCode !== $e->getCode()) {
236+
if (!$e instanceof \UnexpectedValueException || 0x37313bc !== $e->getCode()) {
239237
throw $e;
240238
}
241239
if ($this->logger) {
@@ -251,6 +249,6 @@ private function safelyUnserialize($serializedToken)
251249
*/
252250
public static function handleUnserializeCallback($class)
253251
{
254-
throw new \UnexpectedValueException('Class not found: '.$class, self::$unserializeExceptionCode);
252+
throw new \UnexpectedValueException('Class not found: '.$class, 0x37313bc);
255253
}
256254
}

‎Http/Firewall/SimpleFormAuthenticationListener.php

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
use Symfony\Component\EventDispatcher\EventDispatcherInterface;
1515
use Symfony\Component\HttpFoundation\Request;
16+
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
1617
use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
1718
use Symfony\Component\Security\Csrf\CsrfToken;
1819
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
@@ -84,15 +85,17 @@ protected function attemptAuthentication(Request $request)
8485
}
8586
}
8687

87-
if ($this->options['post_only']) {
88-
$username = trim(ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']));
89-
$password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
90-
} else {
91-
$username = trim(ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']));
92-
$password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
88+
$requestBag = $this->options['post_only'] ? $request->request : $request;
89+
$username = ParameterBagUtils::getParameterBagValue($requestBag, $this->options['username_parameter']);
90+
$password = ParameterBagUtils::getParameterBagValue($requestBag, $this->options['password_parameter']);
91+
92+
if (!\is_string($username) || (\is_object($username) && !\method_exists($username, '__toString'))) {
93+
throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));
9394
}
9495

95-
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
96+
$username = trim($username);
97+
98+
if (\strlen($username) > Security::MAX_USERNAME_LENGTH) {
9699
throw new BadCredentialsException('Invalid username.');
97100
}
98101

‎Http/Firewall/UsernamePasswordFormAuthenticationListener.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
use Symfony\Component\HttpFoundation\Request;
1515
use Psr\Log\LoggerInterface;
16+
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
1617
use Symfony\Component\Security\Csrf\CsrfToken;
1718
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
1819
use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
@@ -76,14 +77,16 @@ protected function attemptAuthentication(Request $request)
7677
}
7778
}
7879

79-
if ($this->options['post_only']) {
80-
$username = trim(ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']));
81-
$password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
82-
} else {
83-
$username = trim(ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']));
84-
$password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
80+
$requestBag = $this->options['post_only'] ? $request->request : $request;
81+
$username = ParameterBagUtils::getParameterBagValue($requestBag, $this->options['username_parameter']);
82+
$password = ParameterBagUtils::getParameterBagValue($requestBag, $this->options['password_parameter']);
83+
84+
if (!\is_string($username) || (\is_object($username) && !\method_exists($username, '__toString'))) {
85+
throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));
8586
}
8687

88+
$username = trim($username);
89+
8790
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
8891
throw new BadCredentialsException('Invalid username.');
8992
}

‎Http/Tests/Firewall/UsernamePasswordFormAuthenticationListenerTest.php

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,15 @@
1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Component\HttpFoundation\Request;
1616
use Symfony\Component\HttpFoundation\Response;
17-
use Symfony\Component\Security\Http\Firewall\UsernamePasswordFormAuthenticationListener;
17+
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
18+
use Symfony\Component\HttpKernel\HttpKernelInterface;
19+
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
1820
use Symfony\Component\Security\Core\Security;
21+
use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationFailureHandler;
22+
use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationSuccessHandler;
23+
use Symfony\Component\Security\Http\Firewall\UsernamePasswordFormAuthenticationListener;
24+
use Symfony\Component\Security\Http\HttpUtils;
25+
use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy;
1926

2027
class UsernamePasswordFormAuthenticationListenerTest extends TestCase
2128
{
@@ -69,6 +76,31 @@ public function testHandleWhenUsernameLength($username, $ok)
6976
$listener->handle($event);
7077
}
7178

79+
/**
80+
* @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
81+
* @expectedExceptionMessage The key "_username" must be a string, "array" given.
82+
*/
83+
public function testHandleNonStringUsername()
84+
{
85+
$request = Request::create('/login_check', 'POST', array('_username' => array()));
86+
$request->setSession($this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
87+
88+
$listener = new UsernamePasswordFormAuthenticationListener(
89+
new TokenStorage(),
90+
$this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface')->getMock(),
91+
new SessionAuthenticationStrategy(SessionAuthenticationStrategy::NONE),
92+
$httpUtils = new HttpUtils(),
93+
'foo',
94+
new DefaultAuthenticationSuccessHandler($httpUtils),
95+
new DefaultAuthenticationFailureHandler($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $httpUtils),
96+
array('require_previous_session' => false)
97+
);
98+
99+
$event = new GetResponseEvent($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $request, HttpKernelInterface::MASTER_REQUEST);
100+
101+
$listener->handle($event);
102+
}
103+
72104
public function getUsernameForLength()
73105
{
74106
return array(

0 commit comments

Comments
 (0)