Skip to content

Commit a2ae9a4

Browse files
fabpotfabpot
committed
feature #24378 [SecurityBundle] Deprecate auto picking the first provider (ogizanagi)
This PR was merged into the 3.4 branch. Discussion ---------- [SecurityBundle] Deprecate auto picking the first provider when no provider is explicitly configured on a firewall | Q | A | ------------- | --- | Branch? | 3.4 <!-- see comment below --> | Bug fix? | no | New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files --> | BC breaks? | no | Deprecations? | yes <!-- don't forget updating UPGRADE-*.md files --> | Tests pass? | yes | Fixed tickets | https://symfony-devs.slack.com/archives/C3A2XAQ20/p1506626210000345 <!-- #-prefixed issue number(s), if any --> | License | MIT | Doc PR | N/A From @Pierstoval on Slack: > Hey, guys, I learnt a few days ago that if you don't specify a user provider in a firewall configuration, the security will use the first one in the list. Don't anyone think specifying the user provider should be mandatory ? Or at least mandatory if we have more than one provider registered? - [x] UPGRADE files - [x] CHANGELOG - [x] Fix other tests - [x] Removal PR #24380 Commits ------- 2d1e334 [SecurityBundle] Deprecate auto picking the first provider
2 parents b1e2d21 + 2d1e334 commit a2ae9a4

File tree

14 files changed

+71
-15
lines changed

14 files changed

+71
-15
lines changed

‎UPGRADE-3.4.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,10 @@ SecurityBundle
320320
* Deprecated setting the `switch_user.stateless` option to false when the firewall is `stateless`.
321321
Setting it to false will have no effect in 4.0.
322322

323+
* Not configuring explicitly the provider on a firewall is ambiguous when there is more than one registered provider.
324+
Using the first configured provider is deprecated since 3.4 and will throw an exception on 4.0.
325+
Explicitly configure the provider to use on your firewalls.
326+
323327
Translation
324328
-----------
325329

‎UPGRADE-4.0.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -696,6 +696,10 @@ SecurityBundle
696696

697697
* The `switch_user.stateless` option is now always true if the firewall is stateless.
698698

699+
* Not configuring explicitly the provider on a firewall is ambiguous when there is more than one registered provider.
700+
The first configured provider is not used anymore and an exception is thrown instead.
701+
Explicitly configure the provider to use on your firewalls.
702+
699703
Serializer
700704
----------
701705

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ CHANGELOG
1818
* deprecated command `init:acl` along with `InitAclCommand` class
1919
* Added support for the new Argon2i password encoder
2020
* added `stateless` option to the `switch_user` listener
21+
* deprecated auto picking the first registered provider when no configured provider on a firewall and ambiguous
2122

2223
3.3.0
2324
-----

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,10 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
359359
$defaultProvider = $providerIds[$normalizedName];
360360
} else {
361361
$defaultProvider = reset($providerIds);
362+
363+
if (count($providerIds) > 1) {
364+
@trigger_error(sprintf('Firewall "%s" has no "provider" set but multiple providers exist. Using the first configured provider (%s) is deprecated since 3.4 and will throw an exception in 4.0, set the "provider" key on the firewall instead.', $id, key($providerIds)), E_USER_DEPRECATED);
365+
}
362366
}
363367

364368
$config->replaceArgument(5, $defaultProvider);

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,9 @@
6060
),
6161

6262
'firewalls' => array(
63-
'simple' => array('pattern' => '/login', 'security' => false),
63+
'simple' => array('provider' => 'default', 'pattern' => '/login', 'security' => false),
6464
'secure' => array('stateless' => true,
65+
'provider' => 'default',
6566
'http_basic' => true,
6667
'form_login' => true,
6768
'anonymous' => true,
@@ -74,6 +75,7 @@
7475
'logout_on_user_change' => true,
7576
),
7677
'host' => array(
78+
'provider' => 'default',
7779
'pattern' => '/test',
7880
'host' => 'foo\\.example\\.org',
7981
'methods' => array('GET', 'POST'),
@@ -82,6 +84,7 @@
8284
'logout_on_user_change' => true,
8385
),
8486
'with_user_checker' => array(
87+
'provider' => 'default',
8588
'user_checker' => 'app.user_checker',
8689
'anonymous' => true,
8790
'http_basic' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1_with_acl.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,9 @@
6161
),
6262

6363
'firewalls' => array(
64-
'simple' => array('pattern' => '/login', 'security' => false),
64+
'simple' => array('provider' => 'default', 'pattern' => '/login', 'security' => false),
6565
'secure' => array('stateless' => true,
66+
'provider' => 'default',
6667
'http_basic' => true,
6768
'http_digest' => array('secret' => 'TheSecret'),
6869
'form_login' => true,
@@ -75,13 +76,15 @@
7576
'user_checker' => null,
7677
),
7778
'host' => array(
79+
'provider' => 'default',
7880
'pattern' => '/test',
7981
'host' => 'foo\\.example\\.org',
8082
'methods' => array('GET', 'POST'),
8183
'anonymous' => true,
8284
'http_basic' => true,
8385
),
8486
'with_user_checker' => array(
87+
'provider' => 'default',
8588
'user_checker' => 'app.user_checker',
8689
'anonymous' => true,
8790
'http_basic' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1_with_digest.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,9 @@
6161
),
6262

6363
'firewalls' => array(
64-
'simple' => array('pattern' => '/login', 'security' => false),
64+
'simple' => array('provider' => 'default', 'pattern' => '/login', 'security' => false),
6565
'secure' => array('stateless' => true,
66+
'provider' => 'default',
6667
'http_basic' => true,
6768
'http_digest' => array('secret' => 'TheSecret'),
6869
'form_login' => true,
@@ -76,6 +77,7 @@
7677
'logout_on_user_change' => true,
7778
),
7879
'host' => array(
80+
'provider' => 'default',
7981
'pattern' => '/test',
8082
'host' => 'foo\\.example\\.org',
8183
'methods' => array('GET', 'POST'),
@@ -84,6 +86,7 @@
8486
'logout_on_user_change' => true,
8587
),
8688
'with_user_checker' => array(
89+
'provider' => 'default',
8790
'user_checker' => 'app.user_checker',
8891
'anonymous' => true,
8992
'http_basic' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@
4343
<chain providers="service, basic" />
4444
</provider>
4545

46-
<firewall name="simple" pattern="/login" security="false" />
46+
<firewall name="simple" pattern="/login" security="false" provider="default" />
4747

48-
<firewall name="secure" stateless="true">
48+
<firewall name="secure" stateless="true" provider="default">
4949
<http-basic />
5050
<form-login />
5151
<anonymous />
@@ -57,12 +57,12 @@
5757
<remember-me secret="TheSecret"/>
5858
</firewall>
5959

60-
<firewall name="host" pattern="/test" host="foo\.example\.org" methods="GET,POST" logout-on-user-change="true">
60+
<firewall name="host" pattern="/test" host="foo\.example\.org" methods="GET,POST" logout-on-user-change="true" provider="default">
6161
<anonymous />
6262
<http-basic />
6363
</firewall>
6464

65-
<firewall name="with_user_checker" logout-on-user-change="true">
65+
<firewall name="with_user_checker" logout-on-user-change="true" provider="default">
6666
<anonymous />
6767
<http-basic />
6868
<user-checker>app.user_checker</user-checker>

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1_with_acl.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@
4444
<chain providers="service, basic" />
4545
</provider>
4646

47-
<firewall name="simple" pattern="/login" security="false" />
47+
<firewall name="simple" pattern="/login" security="false" provider="default" />
4848

49-
<firewall name="secure" stateless="true">
49+
<firewall name="secure" stateless="true" provider="default">
5050
<http-basic />
5151
<http-digest secret="TheSecret" />
5252
<form-login />
@@ -59,12 +59,12 @@
5959
<remember-me secret="TheSecret"/>
6060
</firewall>
6161

62-
<firewall name="host" pattern="/test" host="foo\.example\.org" methods="GET,POST">
62+
<firewall name="host" pattern="/test" host="foo\.example\.org" methods="GET,POST" provider="default">
6363
<anonymous />
6464
<http-basic />
6565
</firewall>
6666

67-
<firewall name="with_user_checker">
67+
<firewall name="with_user_checker" provider="default">
6868
<anonymous />
6969
<http-basic />
7070
<user-checker>app.user_checker</user-checker>

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1_with_digest.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@
4545
<chain providers="service, basic" />
4646
</provider>
4747

48-
<firewall name="simple" pattern="/login" security="false" />
48+
<firewall name="simple" pattern="/login" security="false" provider="default" />
4949

50-
<firewall name="secure" stateless="true">
50+
<firewall name="secure" stateless="true" provider="default">
5151
<http-basic />
5252
<http-digest secret="TheSecret" />
5353
<form-login />
@@ -60,12 +60,12 @@
6060
<remember-me secret="TheSecret"/>
6161
</firewall>
6262

63-
<firewall name="host" pattern="/test" host="foo\.example\.org" methods="GET,POST" logout-on-user-change="true">
63+
<firewall name="host" pattern="/test" host="foo\.example\.org" methods="GET,POST" logout-on-user-change="true" provider="default">
6464
<anonymous />
6565
<http-basic />
6666
</firewall>
6767

68-
<firewall name="with_user_checker" logout-on-user-change="true">
68+
<firewall name="with_user_checker" logout-on-user-change="true" provider="default">
6969
<anonymous />
7070
<http-basic />
7171
<user-checker>app.user_checker</user-checker>

0 commit comments

Comments
 (0)