Skip to content

[Security] Remove is_anonymous expesssion language function #21030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: 6.4
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions workflow.rst
Original file line number Diff line number Diff line change
Expand Up @@ -818,7 +818,7 @@
from: draft
to: reviewed
publish:
# or "is_anonymous", "is_remember_me", "is_fully_authenticated", "is_granted", "is_valid"
# or "is_remember_me", "is_fully_authenticated", "is_granted", "is_valid"
guard: "is_authenticated"
from: reviewed
to: published
Expand All @@ -826,7 +826,7 @@
# or any valid expression language with "subject" referring to the supported object
guard: "is_granted('ROLE_ADMIN') and subject.isRejectable()"
from: reviewed
to: rejected

Check failure on line 829 in workflow.rst

View workflow job for this annotation

GitHub Actions / Code Blocks

[Cache Warmup] In ArrayNode.php line 233: The child config "places" under "framework.workflows.workflows.blog_publish ing" must be configured. 2025-06-01T13:49:59+00:00 [info] User Deprecated: Method "Symfony\Component\HttpKernel\Bundle\Bundle::build()" might add "void" as a native return type declaration in the future. Do the same in child class "Sensio\Bundle\FrameworkExtraBundle\SensioFrameworkExtraBundle" now to avoid errors or add an explicit @return annotation to suppress this message.

.. code-block:: xml

Expand All @@ -853,7 +853,7 @@
</framework:transition>

<framework:transition name="publish">
<!-- or "is_anonymous", "is_remember_me", "is_fully_authenticated", "is_granted" -->
<!-- or "is_remember_me", "is_fully_authenticated", "is_granted" -->
<framework:guard>is_authenticated</framework:guard>
<framework:from>reviewed</framework:from>
<framework:to>published</framework:to>
Expand Down Expand Up @@ -889,7 +889,7 @@

$blogPublishing->transition()
->name('publish')
// or "is_anonymous", "is_remember_me", "is_fully_authenticated", "is_granted"
// or "is_remember_me", "is_fully_authenticated", "is_granted"
->guard('is_authenticated')
->from(['reviewed'])
->to(['published']);
Expand All @@ -900,7 +900,7 @@
->guard('is_granted("ROLE_ADMIN") and subject.isStatusReviewed()')
->from(['reviewed'])
->to(['rejected']);
};

Check failure on line 903 in workflow.rst

View workflow job for this annotation

GitHub Actions / Code Blocks

[Cache Warmup] In ArrayNode.php line 233: The child config "places" under "framework.workflows.workflows.blog_publish ing" must be configured. 2025-06-01T13:50:01+00:00 [info] User Deprecated: Method "Symfony\Component\HttpKernel\Bundle\Bundle::build()" might add "void" as a native return type declaration in the future. Do the same in child class "Sensio\Bundle\FrameworkExtraBundle\SensioFrameworkExtraBundle" now to avoid errors or add an explicit @return annotation to suppress this message.

You can also use transition blockers to block and return a user-friendly error
message when you stop a transition from happening.
Expand Down
Loading