Skip to content

Commit 6471842

Browse files
fabpotfabpot
committed
bug #19218 [Security][Guard] check if session exist before using it (pasdeloup)
This PR was squashed before being merged into the 2.8 branch (closes #19218). Discussion ---------- [Security][Guard] check if session exist before using it | Q | A | ------------- | --- | Branch? | 2.8 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #18958 | License | MIT | Doc PR | - As stated by @Shekhovtsovy when the Guard component is used without the Symfony full stack (for instance in Laravel), $request->getSession() may be null. An additionnal PR will be needed for 3.1 but it may be better to check this one before. Commits ------- a3f7510 [Security][Guard] check if session exist before using it
2 parents e0f1476 + a3f7510 commit 6471842

File tree

2 files changed

+222
-2
lines changed

2 files changed

+222
-2
lines changed

‎src/Symfony/Component/Security/Guard/Authenticator/AbstractFormLoginAuthenticator.php

+10-2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
namespace Symfony\Component\Security\Guard\Authenticator;
1313

14+
use Symfony\Component\HttpFoundation\Session\SessionInterface;
1415
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
1516
use Symfony\Component\HttpFoundation\RedirectResponse;
1617
use Symfony\Component\HttpFoundation\Request;
@@ -52,7 +53,10 @@ abstract protected function getDefaultSuccessRedirectUrl();
5253
*/
5354
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
5455
{
55-
$request->getSession()->set(Security::AUTHENTICATION_ERROR, $exception);
56+
if ($request->getSession() instanceof SessionInterface) {
57+
$request->getSession()->set(Security::AUTHENTICATION_ERROR, $exception);
58+
}
59+
5660
$url = $this->getLoginUrl();
5761

5862
return new RedirectResponse($url);
@@ -69,9 +73,13 @@ public function onAuthenticationFailure(Request $request, AuthenticationExceptio
6973
*/
7074
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
7175
{
76+
$targetPath = null;
77+
7278
// if the user hit a secure page and start() was called, this was
7379
// the URL they were on, and probably where you want to redirect to
74-
$targetPath = $request->getSession()->get('_security.'.$providerKey.'.target_path');
80+
if ($request->getSession() instanceof SessionInterface) {
81+
$targetPath = $request->getSession()->get('_security.'.$providerKey.'.target_path');
82+
}
7583

7684
if (!$targetPath) {
7785
$targetPath = $this->getDefaultSuccessRedirectUrl();

‎src/Symfony/Component/Security/Guard/Tests/Authenticator/FormLoginAuthenticatorTest.php

+212
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Guard\Tests\Authenticator;
13+
14+
use Symfony\Component\HttpFoundation\Request;
15+
use Symfony\Component\Security\Core\Exception\AuthenticationException;
16+
use Symfony\Component\Security\Core\User\UserInterface;
17+
use Symfony\Component\Security\Core\User\UserProviderInterface;
18+
use Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator;
19+
20+
/**
21+
* @author Jean Pasdeloup <jpasdeloup@sedona.fr>
22+
*/
23+
class FormLoginAuthenticatorTest extends \PHPUnit_Framework_TestCase
24+
{
25+
private $requestWithoutSession;
26+
private $requestWithSession;
27+
private $authenticator;
28+
29+
const LOGIN_URL = 'http://login';
30+
const DEFAULT_SUCCESS_URL = 'http://defaultsuccess';
31+
const CUSTOM_SUCCESS_URL = 'http://customsuccess';
32+
33+
public function testAuthenticationFailureWithoutSession()
34+
{
35+
$failureResponse = $this->authenticator->onAuthenticationFailure($this->requestWithoutSession, new AuthenticationException());
36+
37+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $failureResponse);
38+
$this->assertEquals(self::LOGIN_URL, $failureResponse->getTargetUrl());
39+
}
40+
41+
public function testAuthenticationFailureWithSession()
42+
{
43+
$this->requestWithSession->getSession()
44+
->expects($this->once())
45+
->method('set');
46+
47+
$failureResponse = $this->authenticator->onAuthenticationFailure($this->requestWithSession, new AuthenticationException());
48+
49+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $failureResponse);
50+
$this->assertEquals(self::LOGIN_URL, $failureResponse->getTargetUrl());
51+
}
52+
53+
public function testAuthenticationSuccessWithoutSession()
54+
{
55+
$token = $this->getMockBuilder('Symfony\\Component\\Security\\Core\\Authentication\\Token\\TokenInterface')
56+
->disableOriginalConstructor()
57+
->getMock();
58+
59+
$redirectResponse = $this->authenticator->onAuthenticationSuccess($this->requestWithoutSession, $token, 'providerkey');
60+
61+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $redirectResponse);
62+
$this->assertEquals(self::DEFAULT_SUCCESS_URL, $redirectResponse->getTargetUrl());
63+
}
64+
65+
public function testAuthenticationSuccessWithSessionButEmpty()
66+
{
67+
$token = $this->getMockBuilder('Symfony\\Component\\Security\\Core\\Authentication\\Token\\TokenInterface')
68+
->disableOriginalConstructor()
69+
->getMock();
70+
$this->requestWithSession->getSession()
71+
->expects($this->once())
72+
->method('get')
73+
->will($this->returnValue(null));
74+
75+
$redirectResponse = $this->authenticator->onAuthenticationSuccess($this->requestWithSession, $token, 'providerkey');
76+
77+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $redirectResponse);
78+
$this->assertEquals(self::DEFAULT_SUCCESS_URL, $redirectResponse->getTargetUrl());
79+
}
80+
81+
public function testAuthenticationSuccessWithSessionAndTarget()
82+
{
83+
$token = $this->getMockBuilder('Symfony\\Component\\Security\\Core\\Authentication\\Token\\TokenInterface')
84+
->disableOriginalConstructor()
85+
->getMock();
86+
$this->requestWithSession->getSession()
87+
->expects($this->once())
88+
->method('get')
89+
->will($this->returnValue(self::CUSTOM_SUCCESS_URL));
90+
91+
$redirectResponse = $this->authenticator->onAuthenticationSuccess($this->requestWithSession, $token, 'providerkey');
92+
93+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $redirectResponse);
94+
$this->assertEquals(self::CUSTOM_SUCCESS_URL, $redirectResponse->getTargetUrl());
95+
}
96+
97+
public function testRememberMe()
98+
{
99+
$doSupport = $this->authenticator->supportsRememberMe();
100+
101+
$this->assertTrue($doSupport);
102+
}
103+
104+
public function testStartWithoutSession()
105+
{
106+
$failureResponse = $this->authenticator->start($this->requestWithoutSession, new AuthenticationException());
107+
108+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $failureResponse);
109+
$this->assertEquals(self::LOGIN_URL, $failureResponse->getTargetUrl());
110+
}
111+
112+
public function testStartWithSession()
113+
{
114+
$failureResponse = $this->authenticator->start($this->requestWithSession, new AuthenticationException());
115+
116+
$this->assertInstanceOf('Symfony\\Component\\HttpFoundation\\RedirectResponse', $failureResponse);
117+
$this->assertEquals(self::LOGIN_URL, $failureResponse->getTargetUrl());
118+
}
119+
120+
protected function setUp()
121+
{
122+
$this->requestWithoutSession = new Request(array(), array(), array(), array(), array(), array());
123+
$this->requestWithSession = new Request(array(), array(), array(), array(), array(), array());
124+
125+
$session = $this->getMockBuilder('Symfony\\Component\\HttpFoundation\\Session\\SessionInterface')
126+
->disableOriginalConstructor()
127+
->getMock();
128+
$this->requestWithSession->setSession($session);
129+
130+
$this->authenticator = new TestFormLoginAuthenticator();
131+
$this->authenticator
132+
->setLoginUrl(self::LOGIN_URL)
133+
->setDefaultSuccessRedirectUrl(self::DEFAULT_SUCCESS_URL)
134+
;
135+
}
136+
137+
protected function tearDown()
138+
{
139+
$this->request = null;
140+
$this->requestWithSession = null;
141+
}
142+
}
143+
144+
class TestFormLoginAuthenticator extends AbstractFormLoginAuthenticator
145+
{
146+
private $loginUrl;
147+
private $defaultSuccessRedirectUrl;
148+
149+
/**
150+
* @param mixed $defaultSuccessRedirectUrl
151+
*
152+
* @return TestFormLoginAuthenticator
153+
*/
154+
public function setDefaultSuccessRedirectUrl($defaultSuccessRedirectUrl)
155+
{
156+
$this->defaultSuccessRedirectUrl = $defaultSuccessRedirectUrl;
157+
158+
return $this;
159+
}
160+
161+
/**
162+
* @param mixed $loginUrl
163+
*
164+
* @return TestFormLoginAuthenticator
165+
*/
166+
public function setLoginUrl($loginUrl)
167+
{
168+
$this->loginUrl = $loginUrl;
169+
170+
return $this;
171+
}
172+
173+
/**
174+
* {@inheritdoc}
175+
*/
176+
protected function getLoginUrl()
177+
{
178+
return $this->loginUrl;
179+
}
180+
181+
/**
182+
* {@inheritdoc}
183+
*/
184+
protected function getDefaultSuccessRedirectUrl()
185+
{
186+
return $this->defaultSuccessRedirectUrl;
187+
}
188+
189+
/**
190+
* {@inheritdoc}
191+
*/
192+
public function getCredentials(Request $request)
193+
{
194+
return 'credentials';
195+
}
196+
197+
/**
198+
* {@inheritdoc}
199+
*/
200+
public function getUser($credentials, UserProviderInterface $userProvider)
201+
{
202+
return $userProvider->loadUserByUsername($credentials);
203+
}
204+
205+
/**
206+
* {@inheritdoc}
207+
*/
208+
public function checkCredentials($credentials, UserInterface $user)
209+
{
210+
return true;
211+
}
212+
}

0 commit comments

Comments
 (0)