bug #30122 [Security] fix switch user without having current token (Antoine Lamirault)

fabpot · fabpot · commit d3d880a1e779 · 2019-02-12T08:21:07.000+01:00
This PR was merged into the 3.4 branch. Discussion ---------- [Security] fix switch user without having current token | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #22729 | License | MIT Attempting to switch a user cause an error when not having any token in the storage Commits ------- 15db914 [Security] fix switch user without having current token
diff --git a/src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php b/src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php
@@ -83,6 +83,10 @@ public function handle(GetResponseEvent $event)
             return;
         }
 
+        if (null === $this->tokenStorage->getToken()) {
+            throw new AuthenticationCredentialsNotFoundException('Could not find original Token object.');
+        }
+
         if (self::EXIT_VALUE === $username) {
             $this->tokenStorage->setToken($this->attemptExitUser($request));
         } else {
@@ -164,7 +168,7 @@ private function attemptSwitchUser(Request $request, $username)
      */
     private function attemptExitUser(Request $request)
     {
-        if (null === ($currentToken = $this->tokenStorage->getToken()) || false === $original = $this->getOriginalToken($currentToken)) {
+        if (false === $original = $this->getOriginalToken($this->tokenStorage->getToken())) {
             throw new AuthenticationCredentialsNotFoundException('Could not find original Token object.');
         }
 
diff --git a/src/Symfony/Component/Security/Http/Tests/Firewall/SwitchUserListenerTest.php b/src/Symfony/Component/Security/Http/Tests/Firewall/SwitchUserListenerTest.php
@@ -267,6 +267,17 @@ public function testSwitchUserWithReplacedToken()
         $this->assertSame($replacedToken, $this->tokenStorage->getToken());
     }
 
+    /**
+     * @expectedException \Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException
+     */
+    public function testSwitchtUserThrowsAuthenticationExceptionIfNoCurrentToken()
+    {
+        $this->tokenStorage->setToken(null);
+        $this->request->query->set('_switch_user', 'username');
+        $listener = new SwitchUserListener($this->tokenStorage, $this->userProvider, $this->userChecker, 'provider123', $this->accessDecisionManager);
+        $listener->handle($this->event);
+    }
+
     public function testSwitchUserStateless()
     {
         $token = new UsernamePasswordToken('username', '', 'key', ['ROLE_FOO']);

Original file line number	Diff line number	Diff line change
`@@ -83,6 +83,10 @@ public function handle(GetResponseEvent $event)`
`83`	`83`	`return;`
`84`	`84`	`}`
`85`	`85`
	`86`	`+ if (null === $this->tokenStorage->getToken()) {`
	`87`	`+ throw new AuthenticationCredentialsNotFoundException('Could not find original Token object.');`
	`88`	`+ }`
	`89`	`+`
`86`	`90`	`if (self::EXIT_VALUE === $username) {`
`87`	`91`	`$this->tokenStorage->setToken($this->attemptExitUser($request));`
`88`	`92`	`} else {`
`@@ -164,7 +168,7 @@ private function attemptSwitchUser(Request $request, $username)`
`164`	`168`	`*/`
`165`	`169`	`private function attemptExitUser(Request $request)`
`166`	`170`	`{`
`167`		`- if (null === ($currentToken = $this->tokenStorage->getToken()) \|\| false === $original = $this->getOriginalToken($currentToken)) {`
	`171`	`+ if (false === $original = $this->getOriginalToken($this->tokenStorage->getToken())) {`
`168`	`172`	`throw new AuthenticationCredentialsNotFoundException('Could not find original Token object.');`
`169`	`173`	`}`
`170`	`174`