summaryrefslogtreecommitdiffstats
path: root/Http/Firewall
diff options
context:
space:
mode:
Diffstat (limited to 'Http/Firewall')
-rw-r--r--Http/Firewall/AnonymousAuthenticationListener.php8
-rw-r--r--Http/Firewall/DigestAuthenticationListener.php5
-rw-r--r--Http/Firewall/LogoutListener.php17
-rw-r--r--Http/Firewall/SimpleFormAuthenticationListener.php25
-rw-r--r--Http/Firewall/UsernamePasswordFormAuthenticationListener.php25
5 files changed, 56 insertions, 24 deletions
diff --git a/Http/Firewall/AnonymousAuthenticationListener.php b/Http/Firewall/AnonymousAuthenticationListener.php
index f7feee8..0d60673 100644
--- a/Http/Firewall/AnonymousAuthenticationListener.php
+++ b/Http/Firewall/AnonymousAuthenticationListener.php
@@ -27,14 +27,14 @@ use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
class AnonymousAuthenticationListener implements ListenerInterface
{
private $tokenStorage;
- private $key;
+ private $secret;
private $authenticationManager;
private $logger;
- public function __construct(TokenStorageInterface $tokenStorage, $key, LoggerInterface $logger = null, AuthenticationManagerInterface $authenticationManager = null)
+ public function __construct(TokenStorageInterface $tokenStorage, $secret, LoggerInterface $logger = null, AuthenticationManagerInterface $authenticationManager = null)
{
$this->tokenStorage = $tokenStorage;
- $this->key = $key;
+ $this->secret = $secret;
$this->authenticationManager = $authenticationManager;
$this->logger = $logger;
}
@@ -51,7 +51,7 @@ class AnonymousAuthenticationListener implements ListenerInterface
}
try {
- $token = new AnonymousToken($this->key, 'anon.', array());
+ $token = new AnonymousToken($this->secret, 'anon.', array());
if (null !== $this->authenticationManager) {
$token = $this->authenticationManager->authenticate($token);
}
diff --git a/Http/Firewall/DigestAuthenticationListener.php b/Http/Firewall/DigestAuthenticationListener.php
index 702cf33..71bdf6c 100644
--- a/Http/Firewall/DigestAuthenticationListener.php
+++ b/Http/Firewall/DigestAuthenticationListener.php
@@ -12,7 +12,6 @@
namespace Symfony\Component\Security\Http\Firewall;
use Symfony\Component\Security\Core\User\UserProviderInterface;
-use Symfony\Component\Security\Core\Util\StringUtils;
use Symfony\Component\Security\Http\EntryPoint\DigestAuthenticationEntryPoint;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
@@ -79,7 +78,7 @@ class DigestAuthenticationListener implements ListenerInterface
}
try {
- $digestAuth->validateAndDecode($this->authenticationEntryPoint->getKey(), $this->authenticationEntryPoint->getRealmName());
+ $digestAuth->validateAndDecode($this->authenticationEntryPoint->getSecret(), $this->authenticationEntryPoint->getRealmName());
} catch (BadCredentialsException $e) {
$this->fail($event, $request, $e);
@@ -100,7 +99,7 @@ class DigestAuthenticationListener implements ListenerInterface
return;
}
- if (!StringUtils::equals($serverDigestMd5, $digestAuth->getResponse())) {
+ if (!hash_equals($serverDigestMd5, $digestAuth->getResponse())) {
if (null !== $this->logger) {
$this->logger->debug('Unexpected response from the DigestAuth received; is the header returning a clear text passwords?', array('expected' => $serverDigestMd5, 'received' => $digestAuth->getResponse()));
}
diff --git a/Http/Firewall/LogoutListener.php b/Http/Firewall/LogoutListener.php
index 96f5685..e19d39c 100644
--- a/Http/Firewall/LogoutListener.php
+++ b/Http/Firewall/LogoutListener.php
@@ -24,6 +24,7 @@ use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
use Symfony\Component\Security\Http\HttpUtils;
use Symfony\Component\Security\Http\Logout\LogoutHandlerInterface;
use Symfony\Component\Security\Http\Logout\LogoutSuccessHandlerInterface;
+use Symfony\Component\Security\Http\ParameterBagUtils;
/**
* LogoutListener logout users.
@@ -56,11 +57,21 @@ class LogoutListener implements ListenerInterface
throw new InvalidArgumentException('The CSRF token manager should be an instance of CsrfProviderInterface or CsrfTokenManagerInterface.');
}
+ if (isset($options['intention'])) {
+ if (isset($options['csrf_token_id'])) {
+ throw new \InvalidArgumentException(sprintf('You should only define an option for one of "intention" or "csrf_token_id" for the "%s". Use the "csrf_token_id" as it replaces "intention".', __CLASS__));
+ }
+
+ @trigger_error('The "intention" option for the '.__CLASS__.' is deprecated since version 2.8 and will be removed in 3.0. Use the "csrf_token_id" option instead.', E_USER_DEPRECATED);
+
+ $options['csrf_token_id'] = $options['intention'];
+ }
+
$this->tokenStorage = $tokenStorage;
$this->httpUtils = $httpUtils;
$this->options = array_merge(array(
'csrf_parameter' => '_csrf_token',
- 'intention' => 'logout',
+ 'csrf_token_id' => 'logout',
'logout_path' => '/logout',
), $options);
$this->successHandler = $successHandler;
@@ -98,9 +109,9 @@ class LogoutListener implements ListenerInterface
}
if (null !== $this->csrfTokenManager) {
- $csrfToken = $request->get($this->options['csrf_parameter'], null, true);
+ $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
- if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['intention'], $csrfToken))) {
+ if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
throw new LogoutException('Invalid CSRF token.');
}
}
diff --git a/Http/Firewall/SimpleFormAuthenticationListener.php b/Http/Firewall/SimpleFormAuthenticationListener.php
index 8123e0e..331d018 100644
--- a/Http/Firewall/SimpleFormAuthenticationListener.php
+++ b/Http/Firewall/SimpleFormAuthenticationListener.php
@@ -27,6 +27,7 @@ use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInt
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Core\Security;
use Symfony\Component\Security\Http\HttpUtils;
+use Symfony\Component\Security\Http\ParameterBagUtils;
use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface;
use Psr\Log\LoggerInterface;
@@ -70,6 +71,16 @@ class SimpleFormAuthenticationListener extends AbstractAuthenticationListener
throw new InvalidArgumentException('The CSRF token manager should be an instance of CsrfProviderInterface or CsrfTokenManagerInterface.');
}
+ if (isset($options['intention'])) {
+ if (isset($options['csrf_token_id'])) {
+ throw new \InvalidArgumentException(sprintf('You should only define an option for one of "intention" or "csrf_token_id" for the "%s". Use the "csrf_token_id" as it replaces "intention".', __CLASS__));
+ }
+
+ @trigger_error('The "intention" option for the '.__CLASS__.' is deprecated since version 2.8 and will be removed in 3.0. Use the "csrf_token_id" option instead.', E_USER_DEPRECATED);
+
+ $options['csrf_token_id'] = $options['intention'];
+ }
+
$this->simpleAuthenticator = $simpleAuthenticator;
$this->csrfTokenManager = $csrfTokenManager;
@@ -77,7 +88,7 @@ class SimpleFormAuthenticationListener extends AbstractAuthenticationListener
'username_parameter' => '_username',
'password_parameter' => '_password',
'csrf_parameter' => '_csrf_token',
- 'intention' => 'authenticate',
+ 'csrf_token_id' => 'authenticate',
'post_only' => true,
), $options);
@@ -102,19 +113,19 @@ class SimpleFormAuthenticationListener extends AbstractAuthenticationListener
protected function attemptAuthentication(Request $request)
{
if (null !== $this->csrfTokenManager) {
- $csrfToken = $request->get($this->options['csrf_parameter'], null, true);
+ $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
- if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['intention'], $csrfToken))) {
+ if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
throw new InvalidCsrfTokenException('Invalid CSRF token.');
}
}
if ($this->options['post_only']) {
- $username = trim($request->request->get($this->options['username_parameter'], null, true));
- $password = $request->request->get($this->options['password_parameter'], null, true);
+ $username = trim(ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']));
+ $password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
} else {
- $username = trim($request->get($this->options['username_parameter'], null, true));
- $password = $request->get($this->options['password_parameter'], null, true);
+ $username = trim(ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']));
+ $password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
}
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
diff --git a/Http/Firewall/UsernamePasswordFormAuthenticationListener.php b/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
index ba4329b..866d0c3 100644
--- a/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
+++ b/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
@@ -19,6 +19,7 @@ use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
+use Symfony\Component\Security\Http\ParameterBagUtils;
use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface;
use Symfony\Component\Security\Http\HttpUtils;
use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
@@ -48,11 +49,21 @@ class UsernamePasswordFormAuthenticationListener extends AbstractAuthenticationL
throw new InvalidArgumentException('The CSRF token manager should be an instance of CsrfProviderInterface or CsrfTokenManagerInterface.');
}
+ if (isset($options['intention'])) {
+ if (isset($options['csrf_token_id'])) {
+ throw new \InvalidArgumentException(sprintf('You should only define an option for one of "intention" or "csrf_token_id" for the "%s". Use the "csrf_token_id" as it replaces "intention".', __CLASS__));
+ }
+
+ @trigger_error('The "intention" option for the '.__CLASS__.' is deprecated since version 2.8 and will be removed in 3.0. Use the "csrf_token_id" option instead.', E_USER_DEPRECATED);
+
+ $options['csrf_token_id'] = $options['intention'];
+ }
+
parent::__construct($tokenStorage, $authenticationManager, $sessionStrategy, $httpUtils, $providerKey, $successHandler, $failureHandler, array_merge(array(
'username_parameter' => '_username',
'password_parameter' => '_password',
'csrf_parameter' => '_csrf_token',
- 'intention' => 'authenticate',
+ 'csrf_token_id' => 'authenticate',
'post_only' => true,
), $options), $logger, $dispatcher);
@@ -77,19 +88,19 @@ class UsernamePasswordFormAuthenticationListener extends AbstractAuthenticationL
protected function attemptAuthentication(Request $request)
{
if (null !== $this->csrfTokenManager) {
- $csrfToken = $request->get($this->options['csrf_parameter'], null, true);
+ $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
- if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['intention'], $csrfToken))) {
+ if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
throw new InvalidCsrfTokenException('Invalid CSRF token.');
}
}
if ($this->options['post_only']) {
- $username = trim($request->request->get($this->options['username_parameter'], null, true));
- $password = $request->request->get($this->options['password_parameter'], null, true);
+ $username = trim(ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']));
+ $password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
} else {
- $username = trim($request->get($this->options['username_parameter'], null, true));
- $password = $request->get($this->options['password_parameter'], null, true);
+ $username = trim(ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']));
+ $password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
}
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
generated by cgit v1.1 at 2025-05-12 07:31:02 +0000