[Security] Make sure RoleVoter only votes for RoleInterface objects and strings #19965
Conversation
|
👍 for this change, but the CS needs some fixing. Please review the fabbot patch (once it's available). Status: needs work |
…fatal error on non-strings
|
what's need to merge it in ? |
|
👍 This looks like "the right thing to do" ... but we need to think carefully about the possible BC breaks. |
|
The only BC break was mentioned in the start post: When someone uses an object with __toString method without implementing the RoleInterface and using this object as an attribute to be checked by the role voter. I would consider this as a usage out of scope of the role voter API, because this voter is meant to operate on real strings or objects of type RoleInterface. |
|
merged in 2.7 via #19725 |
|
@fabpot great but it still not solved in the master branch |
|
@Gladhon that's the process: bugs are fixed in the lowest branch where they apply, then these branches are merged up to master regularly by mergers. This could happen a few hours up to a few days later. |
make sure RoleVoter only vote for roles and don't produce fatal error on non-strings.
The BC-Break happen, if someone use a Object as Role by not implementing the RoleInterface but adding a toString method which gives "ROLE_SOMETHING" back. This "feature" breaks.