8000 [Security] Check for request's session before attempting writes. · symfony/symfony@ab9caa0 · GitHub
[go: up one dir, main page]
Skip to content

Commit ab9caa0

Browse files
dpb587dpb587
committed
[Security] Check for request's session before attempting writes.
1 parent dabff0e commit ab9caa0

File tree

2 files changed

+36
-8
lines changed

2 files changed

+36
-8
lines changed

‎src/Symfony/Component/Security/Http/Firewall/ContextListener.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,9 @@ public function onKernelResponse(FilterResponseEvent $event)
9797
$this->logger->debug('Write SecurityContext in the session');
9898
}
9999

100-
$session = $event->getRequest()->getSession();
100+
if (null === $session = $event->getRequest()->getSession()) {
101+
return;
102+
}
101103

102104
if ((null === $token = $this->context->getToken()) || ($token instanceof AnonymousToken)) {
103105
$session->remove('_security_'.$this->contextKey);

‎tests/Symfony/Tests/Component/Security/Http/Firewall/ContextListenerTest.php

Lines changed: 33 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,19 @@
1414

1515
class ContextListenerTest extends \PHPUnit_Framework_TestCase
1616
{
17+
protected function setUp()
18+
{
19+
$this->securityContext = new SecurityContext(
20+
$this->getMock('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface'),
21+
$this->getMock('Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface')
22+
);
23+
}
24+
25+
protected function tearDown()
26+
{
27+
unset($this->securityContext);
28+
}
29+
1730
public function testOnKernelResponseWillAddSession()
1831
{
1932
$session = $this->runSessionOnKernelResponse(
@@ -56,12 +69,7 @@ protected function runSessionOnKernelResponse($newToken, $original = null)
5669
$session->set('_security_session', $original);
5770
}
5871

59-
60-
$securityContext = new SecurityContext(
61-
$this->getMock('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface'),
62-
$this->getMock('Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface')
63-
);
64-
$securityContext->setToken($newToken);
72+
$this->securityContext->setToken($newToken);
6573

6674
$request = new Request();
6775
$request->setSession($session);
@@ -73,9 +81,27 @@ protected function runSessionOnKernelResponse($newToken, $original = null)
7381
new Response()
7482
);
7583

76-
$listener = new ContextListener($securityContext, array(), 'session');
84+
$listener = new ContextListener($this->securityContext, array(), 'session');
7785
$listener->onKernelResponse($event);
7886

7987
return $session;
8088
}
89+
90+
public function testOnKernelResponseWithoutSession()
91+
{
92+
$this->securityContext->setToken(new UsernamePasswordToken('test1', 'pass1', 'phpunit'));
93+
$request = new Request();
94+
95+
$event = new FilterResponseEvent(
96+
$this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface'),
97+
$request,
98+
HttpKernelInterface::MASTER_REQUEST,
99+
new Response()
100+
);
101+
102+
$listener = new ContextListener($this->securityContext, array(), 'session');
103+
$listener->onKernelResponse($event);
104+
105+
$this->assertFalse($request->hasSession());
106+
}
81107
}

0 commit comments

Comments
 (0)
0