8000 No more support for custom anon/remember tokens based on FQCN · symfony/symfony@860d454 · GitHub
[go: up one dir, main page]
Skip to content

Commit 860d454

Browse files
Iltar van der Bergfabpot
Iltar van der Berg
authored and
fabpot
committed
No more support for custom anon/remember tokens based on FQCN
1 parent 57a1dd1 commit 860d454

File tree

9 files changed

+214
-19
lines changed

9 files changed

+214
-19
lines changed

‎UPGRADE-4.2.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,16 @@ Security
55
--------
66

77
* Using the `has_role()` function in security expressions is deprecated, use the `is_granted()` function instead.
8+
* Passing custom class names to the
9+
`Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver` to define
10+
custom anonymous and remember me token classes is deprecated. To
11+
use custom tokens, extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
12+
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
13+
14+
SecurityBundle
15+
--------------
16+
17+
* Using the `security.authentication.trust_resolver.anonymous_class` and
18+
`security.authentication.trust_resolver.rememberme_class` parameters to define
19+
the token classes is deprecated. To use
20+
custom tokens extend the existing AnonymousToken and RememberMeToken.

‎UPGRADE-5.0.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,16 @@ Security
7878
* The `ContextListener::setLogoutOnUserChange()` method has been removed.
7979
* The `Symfony\Component\Security\Core\User\AdvancedUserInterface` has been removed.
8080
* The `ExpressionVoter::addExpressionLanguageProvider()` method has been removed.
81+
* The `AuthenticationTrustResolver` constructor arguments have been removed.
8182

8283
SecurityBundle
8384
--------------
8485

8586
* The `logout_on_user_change` firewall option has been removed.
8687
* The `switch_user.stateless` firewall option has been removed.
8788
* The `SecurityUserValueResolver` class has been removed.
89+
* The `security.authentication.trust_resolver.anonymous_class` parameter has been removed.
90+
* The `security.authentication.trust_resolver.rememberme_class` parameter has been removed.
8891

8992
Translation
9093
-----------

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
CHANGELOG
22
=========
33

4+
4.2.0
5+
-----
6+
7+
* Using the `security.authentication.trust_resolver.anonymous_class` and
8+
`security.authentication.trust_resolver.rememberme_class` parameters to define
9+
the token classes is deprecated. To use
10+
custom tokens extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
11+
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
12+
413
4.1.0
514
-----
615

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
66

77
<parameters>
8-
<parameter key="security.authentication.trust_resolver.anonymous_class">Symfony\Component\Security\Core\Authentication\Token\AnonymousToken</parameter>
9-
<parameter key="security.authentication.trust_resolver.rememberme_class">Symfony\Component\Security\Core\Authentication\Token\RememberMeToken</parameter>
8+
<parameter key="security.authentication.trust_resolver.anonymous_class">null</parameter>
9+
<parameter key="security.authentication.trust_resolver.rememberme_class">null</parameter>
1010
<parameter key="security.role_hierarchy.roles" type="collection" />
1111
</parameters>
1212

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ CHANGELOG
66

77
* added the `is_granted()` function in security expressions
88
* deprecated the `has_role()` function in security expressions, use `is_granted()` instead
9+
* Passing custom class names to the
10+
`Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver` to define
11+
custom anonymous and remember me token classes is deprecated. To
12+
use custom tokens, extend the existing `Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`
13+
or `Symfony\Component\Security\Core\Authentication\Token\RememberMeToken`.
914

1015
4.1.0
1116
-----

‎src/Symfony/Component/Security/Core/Authentication/AuthenticationTrustResolver.php

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
namespace Symfony\Component\Security\Core\Authentication;
1313

14+
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
15+
use Symfony\Component\Security\Core\Authentication\Token\RememberMeToken;
1416
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1517

1618
/**
@@ -23,10 +25,18 @@ class AuthenticationTrustResolver implements AuthenticationTrustResolverInterfac
2325
private $anonymousClass;
2426
private $rememberMeClass;
2527

26-
public function __construct(string $anonymousClass, string $rememberMeClass)
28+
public function __construct(?string $anonymousClass = null, ?string $rememberMeClass = null)
2729
{
2830
$this->anonymousClass = $anonymousClass;
2931
$this->rememberMeClass = $rememberMeClass;
32+
33+
if (null !== $anonymousClass && !is_a($anonymousClass, AnonymousToken::class, true)) {
34+
@trigger_error(sprintf('Configuring a custom anonymous token class is deprecated since Symfony 4.2; have the "%s" class extend the "%s" class instead, and remove the "%s" constructor argument.', $anonymousClass, AnonymousToken::class, self::class), E_USER_DEPRECATED);
35+
}
36+
37+
if (null !== $rememberMeClass && !is_a($rememberMeClass, RememberMeToken::class, true)) {
38+
@trigger_error(sprintf('Configuring a custom remember me token class is deprecated since Symfony 4.2; have the "%s" class extend the "%s" class instead, and remove the "%s" constructor argument.', $rememberMeClass, RememberMeToken::class, self::class), E_USER_DEPRECATED);
39+
}
3040
}
3141

3242
/**
@@ -38,7 +48,11 @@ public function isAnonymous(TokenInterface $token = null)
3848
return false;
3949
}
4050

41-
return $token instanceof $this->anonymousClass;
51+
if (null !== $this->anonymousClass) {
52+
return $token instanceof $this->anonymousClass;
53+
}
54+
55+
return $token instanceof AnonymousToken;
4256
}
4357

4458
/**
@@ -50,7 +64,11 @@ public function isRememberMe(TokenInterface $token = null)
5064
return false;
5165
}
5266

53-
return $token instanceof $this->rememberMeClass;
67+
if (null !== $this->rememberMeClass) {
68+
return $token instanceof $this->rememberMeClass;
69+
}
70+
71+
return $token instanceof RememberMeToken;
5472
}
5573

5674
/**

‎src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationTrustResolverTest.php

Lines changed: 159 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,36 +13,112 @@
1313

1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver;
16+
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
17+
use Symfony\Component\Security\Core\Authentication\Token\RememberMeToken;
18+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1619

1720
class AuthenticationTrustResolverTest extends TestCase
1821
{
1922
public function testIsAnonymous()
23+
{
24+
$resolver = new AuthenticationTrustResolver();
25+
$this->assertFalse($resolver->isAnonymous(null));
26+
$this->assertFalse($resolver->isAnonymous($this->getToken()));
27+
$this->assertFalse($resolver->isAnonymous($this->getRememberMeToken()));
28+
$this->assertFalse($resolver->isAnonymous(new FakeCustomToken()));
29+
$this->assertTrue($resolver->isAnonymous(new RealCustomAnonymousToken()));
30+
$this->assertTrue($resolver->isAnonymous($this->getAnonymousToken()));
31+
}
32+
33+
public function testIsRememberMe()
34+
{
35+
$resolver = new AuthenticationTrustResolver();
36+
37+
$this->assertFalse($resolver->isRememberMe(null));
38+
$this->assertFalse($resolver->isRememberMe($this->getToken()));
39+
$this->assertFalse($resolver->isRememberMe($this->getAnonymousToken()));
40+
$this->assertFalse($resolver->isRememberMe(new FakeCustomToken()));
41+
$this->assertTrue($resolver->isRememberMe(new RealCustomRememberMeToken()));
42+
$this->assertTrue($resolver->isRememberMe($this->getRememberMeToken()));
43+
}
44+
45+
public function testisFullFledged()
46+
{
47+
$resolver = new AuthenticationTrustResolver();
48+
49+
$this->assertFalse($resolver->isFullFledged(null));
50+
$this->assertFalse($resolver->isFullFledged($this->getAnonymousToken()));
51+
$this->assertFalse($resolver->isFullFledged($this->getRememberMeToken()));
52+
$this->assertFalse($resolver->isFullFledged(new RealCustomAnonymousToken()));
53+
$this->assertFalse($resolver->isFullFledged(new RealCustomRememberMeToken()));
54+
$this->assertTrue($resolver->isFullFledged($this->getToken()));
55+
$this->assertTrue($resolver->isFullFledged(new FakeCustomToken()));
56+
}
57+
58+
/**
59+
* @group legacy
60+
* @expectedDeprecation Configuring a custom anonymous token class is deprecated since Symfony 4.2; have the "Symfony\Component\Security\Core\Tests\Authentication\FakeCustomToken" class extend the "Symfony\Component\Security\Core\Authentication\Token\AnonymousToken" class instead, and remove the "Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver" constructor argument.
61+
*/
62+
public function testsAnonymousDeprecationWithCustomClasses()
63+
{
64+
$resolver = new AuthenticationTrustResolver(FakeCustomToken::class);
65+
66+
$this->assertTrue($resolver->isAnonymous(new FakeCustomToken()));
67+
}
68+
69+
/**
70+
* @group legacy
71+
* @expectedDeprecation Configuring a custom remember me token class is deprecated since Symfony 4.2; have the "Symfony\Component\Security\Core\Tests\Authentication\FakeCustomToken" class extend the "Symfony\Component\Security\Core\Authentication\Token\RememberMeToken" class instead, and remove the "Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver" constructor argument.
72+
*/
73+
public function testIsRememberMeDeprecationWithCustomClasses()
74+
{
75+
$resolver = new AuthenticationTrustResolver(null, FakeCustomToken::class);
76+
77+
$this->assertTrue($resolver->isRememberMe(new FakeCustomToken()));
78+
}
79+
80+
/**
81+
* @group legacy
82+
* @expectedDeprecation Configuring a custom remember me token class is deprecated since Symfony 4.2; have the "Symfony\Component\Security\Core\Tests\Authentication\FakeCustomToken" class extend the "Symfony\Component\Security\Core\Authentication\Token\RememberMeToken" class instead, and remove the "Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolver" constructor argument.
83+
*/
84+
public function testIsFullFledgedDeprecationWithCustomClasses()
85+
{
86+
$resolver = new AuthenticationTrustResolver(FakeCustomToken::class, FakeCustomToken::class);
87+
88+
$this->assertFalse($resolver->isFullFledged(new FakeCustomToken()));
89+
}
90+
91+
public function testIsAnonymousWithClassAsConstructorButStillExtending()
2092
{
2193
$resolver = $this->getResolver();
2294

2395
$this->assertFalse($resolver->isAnonymous(null));
2496
$this->assertFalse($resolver->isAnonymous($this->getToken()));
2597
$this->assertFalse($resolver->isAnonymous($this->getRememberMeToken()));
2698
$this->assertTrue($resolver->isAnonymous($this->getAnonymousToken()));
99+
$this->assertTrue($resolver->isAnonymous(new RealCustomAnonymousToken()));
27100
}
28101

29-
public function testIsRememberMe()
102+
public function testIsRememberMeWithClassAsConstructorButStillExtending()
30103
{
31104
$resolver = $this->getResolver();
32105

33106
$this->assertFalse($resolver->isRememberMe(null));
34107
$this->assertFalse($resolver->isRememberMe($this->getToken()));
35108
$this->assertFalse($resolver->isRememberMe($this->getAnonymousToken()));
36109
$this->assertTrue($resolver->isRememberMe($this->getRememberMeToken()));
110+
$this->assertTrue($resolver->isRememberMe(new RealCustomRememberMeToken()));
37111
}
38112

39-
public function testisFullFledged()
113+
public function testisFullFledgedWithClassAsConstructorButStillExtending()
40114
{
41115
$resolver = $this->getResolver();
42116

43117
$this->assertFalse($resolver->isFullFledged(null));
44118
$this->assertFalse($resolver->isFullFledged($this->getAnonymousToken()));
45119
$this->assertFalse($resolver->isFullFledged($this->getRememberMeToken()));
120+
$this->assertFalse($resolver->isFullFledged(new RealCustomAnonymousToken()));
121+
$this->assertFalse($resolver->isFullFledged(new RealCustomRememberMeToken()));
46122
$this->assertTrue($resolver->isFullFledged($this->getToken()));
47123
}
48124

@@ -69,3 +145,84 @@ protected function getResolver()
69145
);
70146
}
71147
}
148+
149+
class FakeCustomToken implements TokenInterface
150+
{
151+
public function serialize()
152+
{
153+
}
154+
155+
public function unserialize($serialized)
156+
{
157+
}
158+
159+
public function __toString()
160+
{
161+
}
162+
163+
public function getRoles()
164+
{
165+
}
166+
167+
public function getCredentials()
168+
{
169+
}
170+
171+
public function getUser()
172+
{
173+
}
174+
175+
public function setUser($user)
176+
{
177+
}
178+
179+
public function getUsername()
180+
{
181+
}
182+
183+
public function isAuthenticated()
184+
{
185+
}
186+
187+
public function setAuthenticated($isAuthenticated)
188+
{
189+
}
190+
191+
public function eraseCredentials()
192+
{
193+
}
194+
195+
public function getAttributes()
196+
{
197+
}
198+
199+
public function setAttributes(array $attributes)
200+
{
201+
}
202+
203+
public function hasAttribute($name)
204+
{
205+
}
206+
207+
public function getAttribute($name)
208+
{
209+
}
210+
211+
public function setAttribute($name, $value)
212+
{
213+
}
214+
}
215+
216+
class RealCustomAnonymousToken extends AnonymousToken
217+
{
218+
public function __construct()
219+
{
220+
}
221+
}
222+
223+
class RealCustomRememberMeToken extends RememberMeToken
224+
{
225+
public function __construct()
226+
{
227+
}
228+
}

‎src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,8 @@ class ExpressionLanguageTest extends TestCase
3131
*/
3232
public function testIsAuthenticated($token, $expression, $result)
3333
{
34-
$anonymousTokenClass = 'Symfony\\Component\\Security\\Core\\Authentication\\Token\\AnonymousToken';
35-
$rememberMeTokenClass = 'Symfony\\Component\\Security\\Core\\Authentication\\Token\\RememberMeToken';
3634
$expressionLanguage = new ExpressionLanguage();
37-
$trustResolver = new AuthenticationTrustResolver($anonymousTokenClass, $rememberMeTokenClass);
35+
$trustResolver = new AuthenticationTrustResolver();
3836
$tokenStorage = new TokenStorage();
3937
$tokenStorage->setToken($token);
4038
$accessDecisionManager = new AccessDecisionManager(array(new RoleVoter()));

‎src/Symfony/Component/Security/Core/Tests/Authorization/Voter/AuthenticatedVoterTest.php

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class AuthenticatedVoterTest extends TestCase
2323
*/
2424
public function testVote($authenticated, $attributes, $expected)
2525
{
26-
$voter = new AuthenticatedVoter($this->getResolver());
26+
$voter = new AuthenticatedVoter(new AuthenticationTrustResolver());
2727

2828
$this->assertSame($expected, $voter->vote($this->getToken($authenticated), null, $attributes));
2929
}
@@ -52,14 +52,6 @@ public function getVoteTests()
5252
);
5353
}
5454

55-
protected function getResolver()
56-
{
57-
return new AuthenticationTrustResolver(
58-
'Symfony\\Component\\Security\\Core\\Authentication\\Token\\AnonymousToken',
59-
'Symfony\\Component\\Security\\Core\\Authentication\\Token\\RememberMeToken'
60-
);
61-
}
62-
6355
protected function getToken($authenticated)
6456
{
6557
if ('fully' === $authenticated) {

0 commit comments

Comments
 (0)
0