merged branch simensen/framework-secret (PR symfony#5631)

fabpot · fabpot · commit 264a5ccc0c39 · 2012-09-29T23:33:07.000+02:00
This PR was merged into the master branch. Commits ------- 8bc9f75 Make secret not be required Discussion ---------- [FrameworkBundle] Make secret not be required Bug fix: no Feature addition: yes Backwards compatibility break: no (questionable) Symfony2 tests pass: yes License of the code: MIT Fixes the following tickets: - Todo: - License of the code: MIT Documentation PR: - Framework bundle currently requires that the `secret` key under `framework` be set. The end result is that `kernel.secret` is made available. This is, as far as I can tell, the only required configuration for Framework bundle. The only thing that currently uses `kernel.secret` is the Form component and then only if CSRF protection is enabled. In the spirit of making Framework more decoupled and not requiring things in the case you don't need them I would like to make framework secret optional. I followed the pattern used by CSRF support for when Session is disabled to throw a `LogicException` stating that if CSRF support is enabled then the secret should be set. For anyone who currently depends on `kernel.secret`, if someone ends up *not* defining `kernel.secret` there will be a dependency error on kernel configuration as `kernel.secret` will not be made available. The biggest downside to this that I could see is that the error message may be slightly confusing; it will complain that there is a dependency on `kernel.secret` when that is generally set by way of adding the Framework secret to the configuration. As this relates to Symfony Standard Edition, there should be no changes as there is a default secret set there already anyway.
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -62,7 +62,7 @@ public function getConfigTreeBuilder()
                     ->end()
                 ->end()
                 ->scalarNode('trust_proxy_headers')->defaultFalse()->end()
-                ->scalarNode('secret')->isRequired()->end()
+                ->scalarNode('secret')->end()
                 ->scalarNode('ide')->defaultNull()->end()
                 ->booleanNode('test')->end()
                 ->scalarNode('default_locale')->defaultValue('en')->end()
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -59,7 +59,9 @@ public function load(array $configs, ContainerBuilder $container)
         $configuration = $this->getConfiguration($configs, $container);
         $config = $this->processConfiguration($configuration, $configs);
 
-        $container->setParameter('kernel.secret', $config['secret']);
+        if (isset($config['secret'])) {
+            $container->setParameter('kernel.secret', $config['secret']);
+        }
 
         $container->setParameter('kernel.trust_proxy_headers', $config['trust_proxy_headers']);
 
@@ -156,6 +158,9 @@ private function registerFormConfiguration($config, ContainerBuilder $container,
             if (!isset($config['session'])) {
                 throw new \LogicException('CSRF protection needs that sessions are enabled.');
             }
+            if (!isset($config['secret'])) {
+                throw new \LogicException('CSRF protection needs a secret to be set.');
+            }
             $loader->load('form_csrf.xml');
 
             $container->setParameter('form.type_extension.csrf.enabled', $config['csrf_protection']['enabled']);
