Skip to content

Commit fb908e4

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '4.2'
* 4.2: (26 commits) Apply php-cs-fixer rule for array_key_exists() [Cache] fix warming up cache.system and apcu [Security] Change FormAuthenticator if condition handles multi-byte characters in autocomplete speed up tests running them without debug flag [Translations] added missing Croatian validators Fix getItems() performance issue with RedisCluster (php-redis) [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning IntegerType: reject submitted non-integer numbers be keen to newcomers [HttpKernel] Fix possible infinite loop of exceptions fixed CS [Validator] Added missing translations for Afrikaans do not validate non-submitted form fields in PATCH requests Update usage example in ArrayInput doc block. [Console] Prevent ArgvInput::getFirstArgument() from returning an option value [Validator] Fixed duplicate UUID fixed CS [EventDispatcher] Fix unknown priority Avoid mutating the Finder when building the iterator ...
2 parents 0db0f63 + 7af0b23 commit fb908e4

File tree

3 files changed

+84
-3
lines changed

3 files changed

+84
-3
lines changed

‎Firewall/SimpleFormAuthenticationListener.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ protected function attemptAuthentication(Request $request)
9797
$password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
9898
}
9999

100-
if (!\is_string($username) || (\is_object($username) && !\method_exists($username, '__toString'))) {
100+
if (!\is_string($username) && (!\is_object($username) || !\method_exists($username, '__toString'))) {
101101
throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));
102102
}
103103

‎Firewall/UsernamePasswordFormAuthenticationListener.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ protected function attemptAuthentication(Request $request)
8585
$password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
8686
}
8787

88-
if (!\is_string($username) || (\is_object($username) && !\method_exists($username, '__toString'))) {
88+
if (!\is_string($username) && (!\is_object($username) || !\method_exists($username, '__toString'))) {
8989
throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));
9090
}
9191

‎Tests/Firewall/UsernamePasswordFormAuthenticationListenerTest.php‎

Lines changed: 82 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ public function testHandleWhenUsernameLength($username, $ok)
8181
* @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
8282
* @expectedExceptionMessage The key "_username" must be a string, "array" given.
8383
*/
84-
public function testHandleNonStringUsername($postOnly)
84+
public function testHandleNonStringUsernameWithArray($postOnly)
8585
{
8686
$request = Request::create('/login_check', 'POST', ['_username' => []]);
8787
$request->setSession($this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
@@ -99,6 +99,79 @@ public function testHandleNonStringUsername($postOnly)
9999
$listener->handle($event);
100100
}
101101

102+
/**
103+
* @dataProvider postOnlyDataProvider
104+
* @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
105+
* @expectedExceptionMessage The key "_username" must be a string, "integer" given.
106+
*/
107+
public function testHandleNonStringUsernameWithInt($postOnly)
108+
{
109+
$request = Request::create('/login_check', 'POST', ['_username' => 42]);
110+
$request->setSession($this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
111+
$listener = new UsernamePasswordFormAuthenticationListener(
112+
new TokenStorage(),
113+
$this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface')->getMock(),
114+
new SessionAuthenticationStrategy(SessionAuthenticationStrategy::NONE),
115+
$httpUtils = new HttpUtils(),
116+
'foo',
117+
new DefaultAuthenticationSuccessHandler($httpUtils),
118+
new DefaultAuthenticationFailureHandler($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $httpUtils),
119+
['require_previous_session' => false, 'post_only' => $postOnly]
120+
);
121+
$event = new GetResponseEvent($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $request, HttpKernelInterface::MASTER_REQUEST);
122+
$listener->handle($event);
123+
}
124+
125+
/**
126+
* @dataProvider postOnlyDataProvider
127+
* @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
128+
* @expectedExceptionMessage The key "_username" must be a string, "object" given.
129+
*/
130+
public function testHandleNonStringUsernameWithObject($postOnly)
131+
{
132+
$request = Request::create('/login_check', 'POST', ['_username' => new \stdClass()]);
133+
$request->setSession($this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
134+
$listener = new UsernamePasswordFormAuthenticationListener(
135+
new TokenStorage(),
136+
$this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface')->getMock(),
137+
new SessionAuthenticationStrategy(SessionAuthenticationStrategy::NONE),
138+
$httpUtils = new HttpUtils(),
139+
'foo',
140+
new DefaultAuthenticationSuccessHandler($httpUtils),
141+
new DefaultAuthenticationFailureHandler($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $httpUtils),
142+
['require_previous_session' => false, 'post_only' => $postOnly]
143+
);
144+
$event = new GetResponseEvent($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $request, HttpKernelInterface::MASTER_REQUEST);
145+
$listener->handle($event);
146+
}
147+
148+
/**
149+
* @dataProvider postOnlyDataProvider
150+
*/
151+
public function testHandleNonStringUsernameWith__toString($postOnly)
152+
{
153+
$usernameClass = $this->getMockBuilder(DummyUserClass::class)->getMock();
154+
$usernameClass
155+
->expects($this->atLeastOnce())
156+
->method('__toString')
157+
->will($this->returnValue('someUsername'));
158+
159+
$request = Request::create('/login_check', 'POST', ['_username' => $usernameClass]);
160+
$request->setSession($this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
161+
$listener = new UsernamePasswordFormAuthenticationListener(
162+
new TokenStorage(),
163+
$this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface')->getMock(),
164+
new SessionAuthenticationStrategy(SessionAuthenticationStrategy::NONE),
165+
$httpUtils = new HttpUtils(),
166+
'foo',
167+
new DefaultAuthenticationSuccessHandler($httpUtils),
168+
new DefaultAuthenticationFailureHandler($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $httpUtils),
169+
['require_previous_session' => false, 'post_only' => $postOnly]
170+
);
171+
$event = new GetResponseEvent($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $request, HttpKernelInterface::MASTER_REQUEST);
172+
$listener->handle($event);
173+
}
174+
102175
public function postOnlyDataProvider()
103176
{
104177
return [
@@ -115,3 +188,11 @@ public function getUsernameForLength()
115188
];
116189
}
117190
}
191+
192+
class DummyUserClass
193+
{
194+
public function __toString()
195+
{
196+
return '';
197+
}
198+
}

0 commit comments

Comments
 (0)