8000 [Security] Do not save the target path in the session for a stateless… · craue/symfony@3358253 · GitHub
[go: up one dir, main page]
Skip to content

Commit 3358253

Browse files
lyrixxfabpot
lyrixx
authored and
fabpot
committed
[Security] Do not save the target path in the session for a stateless firewall
1 parent f1ebfd7 commit 3358253

File tree

3 files changed

+10
-4
lines changed

3 files changed

+10
-4
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -349,7 +349,7 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
349349< 8000 code class="diff-text syntax-highlighted-line">
$listeners[] = new Reference('security.access_listener');
350350

351351
// Exception listener
352-
$exceptionListener = new Reference($this->createExceptionListener($container, $firewall, $id, $configuredEntryPoint ?: $defaultEntryPoint));
352+
$exceptionListener = new Reference($this->createExceptionListener($container, $firewall, $id, $configuredEntryPoint ?: $defaultEntryPoint, $firewall['stateless']));
353353

354354
return array($matcher, $listeners, $exceptionListener);
355355
}
@@ -534,12 +534,13 @@ private function getUserProviderId($name)
534534
return 'security.user.provider.concrete.'.$name;
535535
}
536536

537-
private function createExceptionListener($container, $config, $id, $defaultEntryPoint)
537+
private function createExceptionListener($container, $config, $id, $defaultEntryPoint, $stateless)
538538
{
539539
$exceptionListenerId = 'security.exception_listener.'.$id;
540540
$listener = $container->setDefinition($exceptionListenerId, new DefinitionDecorator('security.exception_listener'));
541541
$listener->replaceArgument(3, $id);
542542
$listener->replaceArgument(4, null === $defaultEntryPoint ? null : new Reference($defaultEntryPoint));
543+
$listener->replaceArgument(8, $stateless);
543544

544545
// access denied handler setup
545546
if (isset($config['access_denied_handler'])) {

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_listeners.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@
186186
<argument>%security.access.denied_url%</argument>
187187
<argument type="service" id="security.access.denied_handler" on-invalid="null" />
188188
<argument type="service" id="logger" on-invalid="null" />
189+
<argument>false</argument> <!-- Stateless -->
189190
</service>
190191

191192
<service id="security.authentication.switchuser_listener" class="%security.authentication.switchuser_listener.class%" public="false" abstract="true">

‎src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,9 @@ class ExceptionListener
4646
private $errorPage;
4747
private $logger;
4848
private $httpUtils;
49+
private $stateless;
4950

50-
public function __construct(SecurityContextInterface $context, AuthenticationTrustResolverInterface $trustResolver, HttpUtils $httpUtils, $providerKey, AuthenticationEntryPointInterface $authenticationEntryPoint = null, $errorPage = null, AccessDeniedHandlerInterface $accessDeniedHandler = null, LoggerInterface $logger = null)
51+
public function __construct(SecurityContextInterface $context, AuthenticationTrustResolverInterface $trustResolver, HttpUtils $httpUtils, $providerKey, AuthenticationEntryPointInterface $authenticationEntryPoint = null, $errorPage = null, AccessDeniedHandlerInterface $accessDeniedHandler = null, LoggerInterface $logger = null, $stateless = false)
5152
{
5253
$this->context = $context;
5354
$this->accessDeniedHandler = $accessDeniedHandler;
@@ -57,6 +58,7 @@ public function __construct(SecurityContextInterface $context, AuthenticationTru
5758
$this->authenticationTrustResolver = $trustResolver;
5859
$this->errorPage = $errorPage;
5960
$this->logger = $logger;
61+
$this->stateless = $stateless;
6062
}
6163

6264
/**
@@ -178,7 +180,9 @@ private function startAuthentication(Request $request, AuthenticationException $
178180
$this->logger->debug('Calling Authentication entry point');
179181
}
180182

181-
$this->setTargetPath($request);
183+
if (!$this->stateless) {
184+
$this->setTargetPath($request);
185+
}
182186

183187
if ($authException instanceof AccountStatusException) {
184188
// remove the security token to prevent infinite redirect loops

0 commit comments

Comments
 (0)
0