symfony · pyrech · Feb 9, 2020 · Feb 9, 2020 · Feb 16, 2020 · Feb 16, 2020
diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/form.xml b/src/Symfony/Bundle/FrameworkBundle/Resources/config/form.xml
@@ -111,5 +111,15 @@
             <argument type="service" id="translator"/>
             <argument type="string">%validator.translation_domain%</argument>
         </service>
+
+        <!-- SecurityExtension -->
+        <service id="form.extension.security" class="Symfony\Component\Form\Extension\Security\SecurityExtension">
+            <argument type="service" id="security.user_password_encoder" on-invalid="ignore"/>
+            <tag name="form.type_extension" />
+        </service>
+        <service id="form.extension.security.type.security_password" class="Symfony\Component\Form\Extension\Security\Type\SecurityPasswordType">
+            <argument type="service" id="security.user_password_encoder" on-invalid="ignore"/>
+            <tag name="form.type" alias="security_password" />
+        </service>
     </services>
 </container>
diff --git a/src/Symfony/Component/Form/CHANGELOG.md b/src/Symfony/Component/Form/CHANGELOG.md
@@ -11,6 +11,7 @@ CHANGELOG
    is deprecated. The method will be added to the interface in 6.0.
  * Implementing the `FormConfigBuilderInterface` without implementing the `setIsEmptyCallback()` method
    is deprecated. The method will be added to the interface in 6.0.
+ * Added `SecurityExtension` and `SecurityPasswordType`
 
 5.0.0
 -----

diff --git a/src/Symfony/Component/Form/Extension/Security/SecurityExtension.php b/src/Symfony/Component/Form/Extension/Security/SecurityExtension.php
@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Form\Extension\Security;
+
+use Symfony\Component\Form\AbstractExtension;
+use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
+
+/**
+ * Integrates the Security (Core) component with the Form library.
+ *
+ * @author Loïck Piera <pyrech@gmail.com>
+ */
+class SecurityExtension extends AbstractExtension
+{
+    private $passwordEncoder;
+
+    public function __construct(UserPasswordEncoderInterface $passwordEncoder = null)
+    {
+        $this->passwordEncoder = $passwordEncoder;
+    }
+
+    protected function loadTypes()
+    {
+        if (!$this->passwordEncoder) {
+            return [];
+        }
+
+        return [
+            new Type\SecurityPasswordType($this->passwordEncoder),
+        ];
+    }
+}
diff --git a/src/Symfony/Component/Form/Extension/Security/Type/SecurityPasswordType.php b/src/Symfony/Component/Form/Extension/Security/Type/SecurityPasswordType.php
@@ -0,0 +1,70 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Form\Extension\Security\Type;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Event\SubmitEvent;
+use Symfony\Component\Form\Exception\InvalidConfigurationException;
+use Symfony\Component\Form\Extension\Core\Type\PasswordType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+/**
+ * @author Loïck Piera <pyrech@gmail.com>
+ */
+class SecurityPasswordType extends AbstractType
+{
+    private $passwordEncoder;
+
+    public function __construct(UserPasswordEncoderInterface $passwordEncoder)
+    {
+        $this->passwordEncoder = $passwordEncoder;
+    }
+
+    public function buildForm(FormBuilderInterface $builder, array $options)
+    {
+        $builder->addEventListener(FormEvents::SUBMIT, function (SubmitEvent $event) {
+            $securityUser = $event->getForm()->getConfig()->getOption('security_user');
+
+            if (!$securityUser) {
+                $parentData = $event->getForm()->getParent()->getData();
+
+                if (!$parentData instanceof UserInterface) {
+                    throw new InvalidConfigurationException(sprintf('You should either use "%s" inside a parent form where data is an instance of "%s" or specify the user in "security_user" option', self::class, UserInterface::class));
+                }
+
+                $securityUser = $parentData;
+            }
+
+            $plainPassword = $event->getData();
+
+            $event->setData($plainPassword ? $this->passwordEncoder->encodePassword($securityUser, $plainPassword) : $securityUser->getPassword());
+        });
+    }
+
+    public function configureOptions(OptionsResolver $resolver)
+    {
+        $resolver->setDefault('security_user', null);
+        $resolver->setAllowedTypes('security_user', [
+            'null',
+            UserInterface::class,
+        ]);
+    }
+
+    public function getParent()
+    {
+        return PasswordType::class;
+    }
+}
diff --git a/src/Symfony/Component/Form/Tests/Extension/Security/SecurityExtensionTest.php b/src/Symfony/Component/Form/Tests/Extension/Security/SecurityExtensionTest.php
@@ -0,0 +1,103 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Form\Tests\Extension\Security;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\Form\Extension\Security\SecurityExtension;
+use Symfony\Component\Form\Extension\Security\Type\SecurityPasswordType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormFactoryBuilder;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Security\Core\User\User;
+
+class SecurityExtensionTest extends TestCase
+{
+    public function testSecurityPasswordTypeWorks()
+    {
+        $user = new User('email@example.com', 'previous_password');
+
+        $this->assertSame('previous_password', $user->getPassword());
+
+        $form = $this->getFormFactory()
+            ->createBuilder(FormType::class, $user)
+            ->add('password', SecurityPasswordType::class, [
+                'security_user' => $user,
+            ])
+            ->getForm()
+        ;
+
+        $form->submit(['password' => 'new_password']);
+
+        $this->assertTrue($form->isSubmitted());
+        $this->assertTrue($form->isValid());
+        $this->assertSame('encoded_password', $user->getPassword());
+    }
+
+    public function testSecurityPasswordTypeDetectsUserObject()
+    {
+        $user = new User('email@example.com', 'previous_password');
+
+        $this->assertSame('previous_password', $user->getPassword());
+
+        $form = $this->getFormFactory()->create(PasswordResetType::class, $user);
+        $form->submit(['password' => 'new_password']);
+
+        $this->assertTrue($form->isSubmitted());
+        $this->assertTrue($form->isValid());
+        $this->assertSame('encoded_password', $user->getPassword());
+    }
+
+    public function testSecurityPasswordTypeDoesNotUpdatePasswordWhenEmpty()
+    {
+        $user = new User('email@example.com', 'previous_password');
+
+        $this->assertSame('previous_password', $user->getPassword());
+
+        $form = $this->getFormFactory()->create(PasswordResetType::class, $user);
+        $form->submit([]);
+
+        $this->assertTrue($form->isSubmitted());
+        $this->assertTrue($form->isValid());
+        $this->assertSame('previous_password', $user->getPassword());
+    }
+
+    private function getFormFactory()
+    {
+        $userPasswordEncoder = $this->getMockBuilder('Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface')->getMock();
+
+        $userPasswordEncoder
+            ->method('encodePassword')
+            ->willReturn('encoded_password');
+
+        $formFactoryBuilder = new FormFactoryBuilder();
+        $formFactoryBuilder->addExtension(new SecurityExtension($userPasswordEncoder));
+
+        return $formFactoryBuilder->getFormFactory();
+    }
+}
+
+class PasswordResetType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options)
+    {
+        $builder
+            ->add('password', SecurityPasswordType::class)
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver)
+    {
+        $resolver->setDefault('data_class', User::class);
+    }
+}