8000 bug #30122 [Security] fix switch user without having current token (A… · symfony/symfony@d3d880a · GitHub
[go: up one dir, main page]
Skip to content

Commit d3d880a

Browse files
fabpotfabpot
committed
bug #30122 [Security] fix switch user without having current token (Antoine Lamirault)
This PR was merged into the 3.4 branch. Discussion ---------- [Security] fix switch user without having current token | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #22729 | License | MIT Attempting to switch a user cause an error when not having any token in the storage Commits ------- 15db914 [Security] fix switch user without having current token
2 parents a205211 + 15db914 commit d3d880a

File tree

2 files changed

+16
-1
lines changed

2 files changed

+16
-1
lines changed

‎src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,10 @@ public function handle(GetResponseEvent $event)
8383
return;
8484
}
8585

86+
if (null === $this->tokenStorage->getToken()) {
87+
throw new AuthenticationCredentialsNotFoundException('Could not find original Token object.');
88+
}
89+
8690
if (self::EXIT_VALUE === $username) {
8791
$this->tokenStorage->setToken($this->attemptExitUser($request));
8892
} else {
@@ -164,7 +168,7 @@ private function attemptSwitchUser(Request $request, $username)
164168
*/
165169
private function attemptExitUser(Request $request)
166170
{
167-
if (null === ($currentToken = $this->tokenStorage->getToken()) || false === $original = $this->getOriginalToken($currentToken)) {
171+
if (false === $original = $this->getOriginalToken($this->tokenStorage->getToken())) {
168172
throw new AuthenticationCredentialsNotFoundException('Could not find original Token object.');
169173
}
170174

‎src/Symfony/Component/Security/Http/Tests/Firewall/SwitchUserListenerTest.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,17 @@ public function testSwitchUserWithReplacedToken()
267267
$this->assertSame($replacedToken, $this->tokenStorage->getToken());
268268
}
269269

270+
/**
271+
* @expectedException \Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException
272+
*/
273+
public function testSwitchtUserThrowsAuthenticationExceptionIfNoCurrentToken()
274+
{
275+
$this->tokenStorage->setToken(null);
276+
$this->request->query->set('_switch_user', 'username');
277+
$listener = new SwitchUserListener($this->tokenStorage, $this->userProvider, $this->userChecker, 'provider123', $this->accessDecisionManager);
278+
$listener->handle($this->event);
279+
}
280+
270281
public function testSwitchUserStateless()
271282
{
272283
$token = new UsernamePasswordToken('username', '', 'key', ['ROLE_FOO']);

0 commit comments

Comments
 (0)
0