8000 [Security] Fixed roles serialization on token from user object · symfony/symfony@dfa7f50 · GitHub
[go: up one dir, main page]
Skip to content
Sign in

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit dfa7f50

Browse files
ekoeko
committed
[Security] Fixed roles serialization on token from user object
1 parent 79e25a9 commit dfa7f50

File tree

3 files changed

+17
-3
lines changed

3 files changed

+17
-3
lines changed

‎src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ public function serialize()
150150
array(
151151
is_object($this->user) ? clone $this->user : $this->user,
152152
$this->authenticated,
153-
$this->roles,
153+
array_map(function ($role) { return clone $role; }, $this->roles),
154154
$this->attributes,
155155
)
156156
);

‎src/Symfony/Component/Security/Core/Tests/Authentication/Provider/UserAuthenticationProviderTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ public function testAuthenticateWithPreservingRoleSwitchUserRole()
220220
$this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken', $authToken);
221221
$this->assertSame($user, $authToken->getUser());
222222
$this->assertContains(new Role('ROLE_FOO'), $authToken->getRoles(), '', false, false);
223-
$this->assertContains($switchUserRole, $authToken->getRoles());
223+
$this->assertContains($switchUserRole, $authToken->getRoles(), '', false, false);
224224
$this->assertEquals('foo', $authToken->getCredentials());
225225
$this->assertEquals(array('foo' => 'bar'), $authToken->getAttributes(), '->authenticate() copies token attributes');
226226
}

‎src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
1515
use Symfony\Component\Security\Core\Role\Role;
1616
use Symfony\Component\Security\Core\Role\SwitchUserRole;
17+
use Symfony\Component\Security\Core\User\User;
1718

1819
class TestUser
1920
{
@@ -87,7 +88,7 @@ public function testEraseCredentials()
8788

8889
public function testSerialize()
8990
{
90-
$token = $this->getToken(array('ROLE_FOO'));
91+
$token = $this->getToken(array('ROLE_FOO', new Role('ROLE_BAR')));
9192
$token->setAttributes(array('foo' => 'bar'));
9293

9394
$uToken = unserialize(serialize($token));
@@ -96,6 +97,19 @@ public function testSerialize()
9697
$this->assertEquals($token->getAttributes(), $uToken->getAttributes());
9798
}
9899

100+
public function testSerializeWithRoleObjects()
101+
{
102+
$user = new User('name', 'password', array(new Role('ROLE_FOO'), new Role('ROLE_BAR')));
103+
$token = new ConcreteToken($user, $user->getRoles());
104+
105+
$serialized = serialize($token);
106+
$unserialized = unserialize($serialized);
107+
108+
$roles = $unserialized->getRoles();
109+
110+
$this->assertEquals($roles, $user->getRoles());
111+
}
112+
99113
public function testSerializeParent()
100114
{
101115
$user = new TestUser('fabien');

0 commit comments

Comments
 (0)
0