8000 bug #57378 [Security] Change to `BadCredentialsException` when empty … · symfony/symfony@302938c · GitHub
[go: up one dir, main page]
Skip to content

Commit 302938c

Browse files
wouterjwouterj
committed
bug #57378 [Security] Change to BadCredentialsException when empty username / password (llupa)
This PR was merged into the 7.1 branch. Discussion ---------- [Security] Change to `BadCredentialsException` when empty username / password | Q | A | ------------- | --- | Branch? | 7.1 | Bug fix? |no | New feature? |no | Deprecations? |no | Issues | Fix #53851 (comment) | License | MIT ~Tests will likely fail since they are running flipped.~ Commits ------- 2ab91bb [Security] Change to `BadCredentialsException` when empty username / password
2 parents 954dfa7 + 2ab91bb commit 302938c

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

‎src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1919
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
2020
use Symfony\Component\Security\Core\Exception\AuthenticationException;
21+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
2122
use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
2223
use Symfony\Component\Security\Core\User\UserProviderInterface;
2324
use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
@@ -130,7 +131,7 @@ private function getCredentials(Request $request): array
130131
$credentials['username'] = trim($credentials['username']);
131132

132133
if ('' === $credentials['username']) {
133-
throw new BadRequestHttpException(sprintf('The key "%s" must be a non-empty string.', $this->options['username_parameter']));
134+
throw new BadCredentialsException(sprintf('The key "%s" must be a non-empty string.', $this->options['username_parameter']));
134135
}
135136

136137
$request->getSession()->set(SecurityRequestAttributes::LAST_USERNAME, $credentials['username']);
@@ -140,7 +141,7 @@ private function getCredentials(Request $request): array
140141
}
141142

142143
if ('' === (string) $credentials['password']) {
143-
throw new BadRequestHttpException(sprintf('The key "%s" must be a non-empty string.', $this->options['password_parameter']));
144+
throw new BadCredentialsException(sprintf('The key "%s" must be a non-empty string.', $this->options['password_parameter']));
144145
}
145146

146147
if (!\is_string($credentials['csrf_token'] ?? '') && (!\is_object($credentials['csrf_token']) || !method_exists($credentials['csrf_token'], '__toString'))) {

‎src/Symfony/Component/Security/Http/Tests/Authenticator/FormLoginAuthenticatorTest.php

Lines changed: 2 additions & 2 deletions

Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ protected function setUp(): void
4444

4545
public function testHandleWhenUsernameEmpty()
4646
{
47-
$this->expectException(BadRequestHttpException::class);
47+
$this->expectException(BadCredentialsException::class);
4848
$this->expectExceptionMessage('The key "_username" must be a non-empty string.');
4949

5050
$request = Request::create('/login_check', 'POST', ['_username' => '', '_password' => 's$cr$t']);
@@ -56,7 +56,7 @@ public function testHandleWhenUsernameEmpty()
5656
5757
public function testHandleWhenPasswordEmpty()
5858
{
59-
$this->expectException(BadRequestHttpException::class);
59+
$this->expectException(BadCredentialsException::class);
6060
$this->expectExceptionMessage('The key "_password" must be a non-empty string.');
6161

6262
$request = Request::create('/login_check', 'POST', ['_username' => 'foo', '_password' => '']);

0 commit comments

Comments
 (0)
0