leaseweb / lswsecurecontrollerbundle Goto Github PK
View Code? Open in Web Editor NEWSymfony2 bundle that provides '@Secure' annotation to secure actions and controllers.
License: MIT License
Symfony2 bundle that provides '@Secure' annotation to secure actions and controllers.
License: MIT License
I would like to pass an object in the annotation. Like
/**
* @Secure(roles="ROLE_TEST")
* @Secure(roles="EDIT", "company")
* @Route("/company/{id}/edit", name="edit_company")
*/
public function helloAction($company)
{
return array('name' => $company->getName());
}
This will take the parameter $company and run $this->authorizationChecker->isGranted($role, $company)
Im happy to make a PR to achieve this but I would like to hear your thoughts first.
The dependency to doctrine/doctrine-bundle
is very heavy and unfortunately if one doesn't use it (e.g. uses propel or an ODM).
Only the package doctrine/annotations
would be required. Can you change this?
When you specifiy several roles une the @secure annotation an AND is done beetwen the roles.
It is more logical to do an OR as done int the JMS bundle because you can filter it in the controller function.
To do it you must change in the Lsw\SecureControllerBundle\Security\ControllerListener onKernelController function
if (!$this->securityContext->isGranted($role)) {
throw new AccessDeniedException(
'Current user is not granted required role "'.$role.'".'
);
}
}
by
if ($this->securityContext->isGranted($role)) return;
}
throw new AccessDeniedException('Current user is not granted');
The ControllerListener
does not check if the $controller
is a Symfony Controller object.
By design the controller could be any callable.
So before line: list($object, $method) = $controller
The $controller
should be checked if it is an array.
E.g.:
if (!is_array($controller = $event->getController())) {
return;
}
In Lsw/SecureControllerBundle/Resources/config/services.yml
:
services:
secure_controller.controller_listener:
class: %secure_controller.controller_listener.class%
arguments: [@annotation_reader,@security.context]
Both @annotation_reader
and @security.context
must be quoted for avoiding warnings in Symfony 2.8.
This project will support @SecureParam check in controller?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.