Skip to content

Commit b7d3929

Browse files
nicolas-grekasnicolas-grekas
committed
[Security] Improve BC-layer to deprecate eraseCredentials methods
1 parent e556606 commit b7d3929

34 files changed

+153
-206
lines changed

‎UPGRADE-7.3.md

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,37 @@ If you're upgrading from a version below 7.2, follow the [7.2 upgrade guide](UPG
1111
Ldap
1212
----
1313

14-
* Deprecate `LdapUser::eraseCredentials()`, use `LdapUser::setPassword(null)` instead
14+
* Deprecate `LdapUser::eraseCredentials()` in favor of `__serialize()`
1515

1616
Security
1717
--------
1818

1919
* Deprecate `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
20-
use a dedicated DTO or erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
20+
erase credentials e.g. using `__serialize()` instead
2121

22-
SecurityBundle
23-
--------------
22+
*Before*
23+
```php
24+
public function eraseCredentials(): void
25+
{
26+
}
27+
```
2428

25-
* Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
29+
*After*
30+
```php
31+
#[\Deprecated]
32+
public function eraseCredentials(): void
33+
{
34+
}
35+
36+
// If your eraseCredentials() method was used to empty a "password" property:
37+
public function __serialize(): array
38+
{
39+
$data = (array) $this;
40+
unset($data["\0".self::class."\0password"]);
41+
42+
return $data;
43+
}
44+
```
2645

2746
Console
2847
-------
@@ -131,4 +150,3 @@ VarDumper
131150

132151
* Deprecate `ResourceCaster::castCurl()`, `ResourceCaster::castGd()` and `ResourceCaster::castOpensslX509()`
133152
* Mark all casters as `@internal`
134-
* Deprecate the `CompiledClassMetadataFactory` and `CompiledClassMetadataCacheWarmer` classes

‎src/Symfony/Bridge/Doctrine/Tests/Fixtures/User.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ public function getUserIdentifier(): string
4545
return $this->name;
4646
}
4747

48+
#[\Deprecated]
4849
public function eraseCredentials(): void
4950
{
5051
}

‎src/Symfony/Bridge/PhpUnit/Legacy/SymfonyTestsListenerTrait.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -336,7 +336,7 @@ public static function handleError($type, $msg, $file, $line, $context = [])
336336

337337
return $h ? $h($type, $msg, $file, $line, $context) : false;
338338
}
339-
// If the message is serialized we need to extract the message. This occurs when the error is triggered by
339+
// If the message is serialized we need to extract the message. This occurs when the error is triggered
340340
// by the isolated test path in \Symfony\Bridge\PhpUnit\Legacy\SymfonyTestsListenerTrait::endTest().
341341
$parsedMsg = @unserialize($msg);
342342
if (\is_array($parsedMsg)) {

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ CHANGELOG
88
* Add encryption support to `OidcTokenHandler` (JWE)
99
* Add `expose_security_errors` config option to display `AccountStatusException`
1010
* Deprecate the `security.hide_user_not_found` config option in favor of `security.expose_security_errors`
11-
* Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
1211

1312
7.2
1413
---

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/LdapFactoryTrait.php

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
use Symfony\Component\DependencyInjection\Definition;
1717
use Symfony\Component\DependencyInjection\Reference;
1818
use Symfony\Component\Ldap\Security\CheckLdapCredentialsListener;
19-
use Symfony\Component\Ldap\Security\EraseLdapUserCredentialsListener;
2019
use Symfony\Component\Ldap\Security\LdapAuthenticator;
2120

2221
/**
@@ -43,12 +42,6 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal
4342
->addArgument(new Reference('security.ldap_locator'))
4443
;
4544

46-
if (class_exists(EraseLdapUserCredentialsListener::class && !$container->getParameter('security.authentication.manager.erase_credentials'))) {
47-
$container->setDefinition('security.listener.'.$key.'.'.$firewallName.'erase_ldap_credentials', new Definition(EraseLdapUserCredentialsListener::class))
48-
->addTag('kernel.event_subscriber', ['dispatcher' => 'security.event_dispatcher.'.$firewallName])
49-
;
50-
}
51-
5245
$ldapAuthenticatorId = 'security.authenticator.'.$key.'.'.$firewallName;
5346
$definition = $container->setDefinition($ldapAuthenticatorId, new Definition(LdapAuthenticator::class))
5447
->setArguments([

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -136,9 +136,6 @@ public function load(array $configs, ContainerBuilder $container): void
136136

137137
// set some global scalars
138138
$container->setParameter('security.access.denied_url', $config['access_denied_url']);
139-
if (true === $config['erase_credentials']) {
140-
trigger_deprecation('symfony/security-bundle', '7.3', 'Setting the "security.erase_credentials" config option to true is deprecated and won\'t have any effect in 8.0, set it to false instead and use your own erasing logic if needed.');
141-
}
142139
$container->setParameter('security.authentication.manager.erase_credentials', $config['erase_credentials']);
143140
$container->setParameter('security.authentication.session_strategy.strategy', $config['session_fixation_strategy']);
144141

‎src/Symfony/Bundle/SecurityBundle/Tests/Debug/TraceableFirewallListenerTest.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
use Symfony\Component\HttpFoundation\Response;
2020
use Symfony\Component\HttpKernel\Event\RequestEvent;
2121
use Symfony\Component\HttpKernel\HttpKernelInterface;
22+
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
2223
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
2324
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
2425
use Symfony\Component\Security\Http\Authentication\AuthenticatorManager;
@@ -89,7 +90,7 @@ public function testOnKernelRequestRecordsAuthenticatorsInfo()
8990
$supportingAuthenticator
9091
->expects($this->once())
9192
->method('createToken')
92-
->willReturn($this->createMock(TokenInterface::class));
93+
->willReturn(new class extends AbstractToken {});
9394

9495
$notSupportingAuthenticator = $this->createMock(DummyAuthenticator::class);
9596
$notSupportingAuthenticator
@@ -103,9 +104,7 @@ public function testOnKernelRequestRecordsAuthenticatorsInfo()
103104
[new TraceableAuthenticator($notSupportingAuthenticator), new TraceableAuthenticator($supportingAuthenticator)],
104105
$tokenStorage,
105106
$dispatcher,
106-
'main',
107-
null,
108-
false
107+
'main'
109108
);
110109

111110
$listener = new TraceableAuthenticatorManagerListener(new AuthenticatorManagerListener($authenticatorManager));

‎src/Symfony/Bundle/SecurityBundle/composer.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
"symfony/clock": "^6.4|^7.0",
2323
"symfony/config": "^6.4|^7.0",
2424
"symfony/dependency-injection": "^6.4.11|^7.1.4",
25-
"symfony/deprecation-contracts": "^2.5|^3",
2625
"symfony/event-dispatcher": "^6.4|^7.0",
2726
"symfony/http-kernel": "^6.4|^7.0",
2827
"symfony/http-foundation": "^6.4|^7.0",

‎src/Symfony/Component/Ldap/CHANGELOG.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ CHANGELOG
44
7.3
55
---
66

7-
* Deprecate `LdapUser::eraseCredentials()`, use `LdapUser::setPassword(null)` instead
8-
* Add `EraseLdapUserCredentialsListener`
7+
* Deprecate `LdapUser::eraseCredentials()` in favor of `__serialize()`
98

109
7.2
1110
---

‎src/Symfony/Component/Ldap/Security/EraseLdapUserCredentialsListener.php

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy