[Security] allowed class names to be passed as an argument to EncoderFactoryInterface::getEncoder()

2 files changed, 8 insertions, 6 deletions

diff --git a/Core/Encoder/EncoderFactory.php b/Core/Encoder/EncoderFactory.php
index 738706a..866c809 100644
--- a/Core/Encoder/EncoderFactory.php
+++ b/Core/Encoder/EncoderFactory.php
@@ -30,10 +30,10 @@ class EncoderFactory implements EncoderFactoryInterface
     /**
      * {@inheritDoc}
      */
-    public function getEncoder(UserInterface $user)
+    public function getEncoder($user)
     {
         foreach ($this->encoders as $class => $encoder) {
-            if (!$user instanceof $class) {
+            if ((is_object($user) && !$user instanceof $class) || (!is_subclass_of($user, $class) && $user != $class)) {
                 continue;
             }
 
@@ -44,7 +44,7 @@ class EncoderFactory implements EncoderFactoryInterface
             return $this->encoders[$class];
         }
 
-        throw new \RuntimeException(sprintf('No encoder has been configured for account "%s".', get_class($user)));
+        throw new \RuntimeException(sprintf('No encoder has been configured for account "%s".', is_object($class) ? get_class($user) : $class));
     }
 
     /**
diff --git a/Core/Encoder/EncoderFactoryInterface.php b/Core/Encoder/EncoderFactoryInterface.php
index 3ae07e6..125e57b 100644
--- a/Core/Encoder/EncoderFactoryInterface.php
+++ b/Core/Encoder/EncoderFactoryInterface.php
@@ -23,9 +23,11 @@ interface EncoderFactoryInterface
     /**
      * Returns the password encoder to use for the given account.
      *
-     * @param UserInterface $user
+     * @param UserInterface|string $user A UserInterface instance of a class name
      *
-     * @return PasswordEncoderInterface never null
+     * @return PasswordEncoderInterface
+     *
+     * @throws \RuntimeException when no password encoder could be found for the user
      */
-    function getEncoder(UserInterface $user);
+    function getEncoder($user);
 }