Skip to content

potential bug in Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity #5026

Closed
@binabik

Description

@binabik

hi,

the constructor of Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity\RoleSecurityIdentity takes $role as a parameter and checks if it is an instance of Symfony\Component\Security\Core\Role\Role. Following the guidelines in http://symfony.com/doc/master/cookbook/security/entity_provider.html, our Role class implements RoleInterface. This results in RoleSecurityIdentity::role being populated with an object during the PermissionsEvaluation phase.

the fix, for me was easy, and should not break any other parts of the implementation, as Core\Role\Role also implements Core\Role\RoleInterface.

[[WARNING: HANDWRITTEN DIFF]]
<<<
[Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity\RoleSecurityIdentity.php]
-- use Symfony\Component\Security\Core\Role\Role;
++ use Symfony\Component\Security\Core\Role\RoleInterface;
[...]
public function __construct($role)
{
-- if ($role instanceof Role) {
++ if ($role instanceof RoleInterface) {

i can submit a proper patch if required.

regards,
sb

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions