diff --git a/cookbook/security/voters_data_permission.rst b/cookbook/security/voters_data_permission.rst index 82bea0fe9fe..ee72ff09fee 100644 --- a/cookbook/security/voters_data_permission.rst +++ b/cookbook/security/voters_data_permission.rst @@ -108,21 +108,21 @@ edit a particular object. Here's an example implementation: // set the attribute to check against $attribute = $attributes[0]; - // get current logged in user - $user = $token->getUser(); - // check if the given attribute is covered by this voter if (!$this->supportsAttribute($attribute)) { return VoterInterface::ACCESS_ABSTAIN; } + // get current logged in user + $user = $token->getUser(); + // make sure there is a user object (i.e. that the user is logged in) if (!$user instanceof UserInterface) { return VoterInterface::ACCESS_DENIED; } switch($attribute) { - case 'view': + case self::VIEW: // the data object could have for example a method isPrivate() // which checks the Boolean attribute $private if (!$post->isPrivate()) { @@ -130,7 +130,7 @@ edit a particular object. Here's an example implementation: } break; - case 'edit': + case self::EDIT: // we assume that our data object has a method getOwner() to // get the current owner user entity for this data object if ($user->getId() === $post->getOwner()->getId()) { @@ -138,6 +138,8 @@ edit a particular object. Here's an example implementation: } break; } + + return VoterInterface::ACCESS_DENIED; } }