You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: UPGRADE-5.3.md
+82
Original file line number
Diff line number
Diff line change
@@ -71,6 +71,88 @@ PropertyInfo
71
71
Security
72
72
--------
73
73
74
+
* Deprecate `UserInterface::getPassword()`
75
+
If your `getPassword()` method does not return `null` (i.e. you are using password-based authentication),
76
+
you should implement `PasswordAuthenticatedUserInterface`.
77
+
78
+
Before:
79
+
```php
80
+
use Symfony\Component\Security\Core\User\UserInterface;
81
+
82
+
class User implements UserInterface
83
+
{
84
+
// ...
85
+
86
+
public function getPassword()
87
+
{
88
+
return $this->password;
89
+
}
90
+
}
91
+
```
92
+
93
+
After:
94
+
```php
95
+
use Symfony\Component\Security\Core\User\UserInterface;
96
+
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
97
+
98
+
class User implements UserInterface, PasswordAuthenticatedUserInterface
99
+
{
100
+
// ...
101
+
102
+
public function getPassword(): ?string
103
+
{
104
+
return $this->password;
105
+
}
106
+
}
107
+
```
108
+
109
+
* Deprecate `UserInterface::getSalt()`
110
+
If your `getSalt()` method does not return `null` (i.e. you are using password-based authentication with an old password hash algorithm that requires user-provided salts),
use Symfony\Component\Security\Core\User\UserInterface;
116
+
117
+
class User implements UserInterface
118
+
{
119
+
// ...
120
+
121
+
public function getPassword()
122
+
{
123
+
return $this->password;
124
+
}
125
+
126
+
public function getSalt()
127
+
{
128
+
return $this->salt;
129
+
}
130
+
}
131
+
```
132
+
133
+
After:
134
+
```php
135
+
use Symfony\Component\Security\Core\User\UserInterface;
136
+
use Symfony\Component\Security\Core\User\LegacyPasswordAuthenticatedUserInterface;
137
+
138
+
class User implements UserInterface, LegacyPasswordAuthenticatedUserInterface
139
+
{
140
+
// ...
141
+
142
+
public function getPassword(): ?string
143
+
{
144
+
return $this->password;
145
+
}
146
+
147
+
public function getSalt(): ?string
148
+
{
149
+
return $this->salt;
150
+
}
151
+
}
152
+
```
153
+
154
+
* Deprecate calling `PasswordUpgraderInterface::upgradePassword()` with a `UserInterface` instance that does not implement `PasswordAuthenticatedUserInterface`
155
+
* Deprecate calling methods `hashPassword()`, `isPasswordValid()` and `needsRehash()` on `UserPasswordHasherInterface` with a `UserInterface` instance that does not implement `PasswordAuthenticatedUserInterface`
74
156
* Deprecate all classes in the `Core\Encoder\` sub-namespace, use the `PasswordHasher` component instead
75
157
* Deprecated voters that do not return a valid decision when calling the `vote` method
Copy file name to clipboardExpand all lines: UPGRADE-6.0.md
+84
Original file line number
Diff line number
Diff line change
@@ -168,6 +168,90 @@ Routing
168
168
Security
169
169
--------
170
170
171
+
* Remove `UserInterface::getPassword()`
172
+
If your `getPassword()` method does not return `null` (i.e. you are using password-based authentication),
173
+
you should implement `PasswordAuthenticatedUserInterface`.
174
+
175
+
Before:
176
+
```php
177
+
use Symfony\Component\Security\Core\User\UserInterface;
178
+
179
+
class User implements UserInterface
180
+
{
181
+
// ...
182
+
183
+
public function getPassword()
184
+
{
185
+
return $this->password;
186
+
}
187
+
}
188
+
```
189
+
190
+
After:
191
+
```php
192
+
use Symfony\Component\Security\Core\User\UserInterface;
193
+
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
194
+
195
+
class User implements UserInterface, PasswordAuthenticatedUserInterface
196
+
{
197
+
// ...
198
+
199
+
public function getPassword(): ?string
200
+
{
201
+
return $this->password;
202
+
}
203
+
}
204
+
```
205
+
206
+
* Remove `UserInterface::getSalt()`
207
+
If your `getSalt()` method does not return `null` (i.e. you are using password-based authentication with an old password hash algorithm that requires user-provided salts),
use Symfony\Component\Security\Core\User\UserInterface;
213
+
214
+
class User implements UserInterface
215
+
{
216
+
// ...
217
+
218
+
public function getPassword()
219
+
{
220
+
return $this->password;
221
+
}
222
+
223
+
public function getSalt()
224
+
{
225
+
return $this->salt;
226
+
}
227
+
}
228
+
```
229
+
230
+
After:
231
+
```php
232
+
use Symfony\Component\Security\Core\User\UserInterface;
233
+
use Symfony\Component\Security\Core\User\LegacyPasswordAuthenticatedUserInterface;
234
+
235
+
class User implements UserInterface, LegacyPasswordAuthenticatedUserInterface
236
+
{
237
+
// ...
238
+
239
+
public function getPassword(): ?string
240
+
{
241
+
return $this->password;
242
+
}
243
+
244
+
public function getSalt(): ?string
245
+
{
246
+
return $this->salt;
247
+
}
248
+
}
249
+
```
250
+
251
+
* Calling `PasswordUpgraderInterface::upgradePassword()` with a `UserInterface` instance that
252
+
does not implement `PasswordAuthenticatedUserInterface` now throws a `\TypeError`.
253
+
* Calling methods `hashPassword()`, `isPasswordValid()` and `needsRehash()` on `UserPasswordHasherInterface`
254
+
with a `UserInterface` instance that does not implement `PasswordAuthenticatedUserInterface` now throws a `\TypeError`
171
255
* Drop all classes in the `Core\Encoder\` sub-namespace, use the `PasswordHasher` component instead
172
256
* Drop support for `SessionInterface $session` as constructor argument of `SessionTokenStorage`, inject a `\Symfony\Component\HttpFoundation\RequestStack $requestStack` instead
173
257
* Drop support for `session` provided by the ServiceLocator injected in `UsageTrackingTokenStorage`, provide a `request_stack` service instead
if (!$userinstanceof PasswordAuthenticatedUserInterface) {
123
+
trigger_deprecation('symfony/security-core', '5.3', 'The first argument of "%s:upgradePassword()" method should be an instance of "%s", you should make the "%s" class implement it.', PasswordUpgraderInterface::class, PasswordAuthenticatedUserInterface::class, \get_class($user));
124
+
}
125
+
121
126
$class = $this->getClass();
122
127
if (!$userinstanceof$class) {
123
128
thrownewUnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_debug_type($user)));
@@ -68,6 +69,11 @@ public function onCheckPassport(CheckPassportEvent $event)
68
69
thrownewBadCredentialsException('The presented password cannot be empty.');
69
70
}
70
71
72
+
$user = $passport->getUser();
73
+
if (!$userinstanceof PasswordAuthenticatedUserInterface) {
74
+
trigger_deprecation('symfony/ldap', '5.3', 'Not implementing the "%s" interface in class "%s" while using password-based authenticators is deprecated.', PasswordAuthenticatedUserInterface::class, \get_class($user));
0 commit comments