[RTM] Match security firewall based on request scope #677

aschempp · 2017-01-22T21:08:45Z

There is one fundamental problem in the current implementation:

There is a frontend and a backend firewall context based on the route (= path / pattern).
Each route can have a _scope that defines TL_MODE.
These two are independet, so theroretically a route with a path that matches the frontend firewall scope can have a _scope attribute backend.

With this PR the firewall is no longer matching the path but only the request scope. This also means a route without request scope will no longer have a Contao firewall.

This also replaces #619 as a request matcher is the right way to detect Contao frontend or backend.

TODOs

Update unit tests
Update DEPRECATED.md

bytehead · 2017-01-22T21:29:35Z

👍

aschempp · 2017-01-23T09:04:49Z

PR is updated to use the new request matchers instead of the ScopeAwareTrait. One thing to discuss is the class name RequestContext. It's not that wrong because context is what it's called in the firewall, but there already is a RequestContext class in Symfony which could be confusing.

xchs · 2017-01-23T13:41:58Z

src/Routing/ScopeMatcher.php

+    }
+
+    /**
+     * Checks whether the request is a Contao the master request.


… is a Contao master request.

* Make Symfony 3.2 the minimum requirement (see contao#630). * Set the encryption key from the kernel secret by default (see contao#660). * Stop using the deprecated QuestionHelper::setInputStream() method. * Update Dropzone to version 4. * Prefer the caret operator over the tilde operator in the composer.json file. * Add the contao.root_dir parameter (see contao#662). * Update the change log. * Stop using the contao-components/all meta package. * Update the README.md file. * Deprecate the contao:version command (see contao#668). * Update the installation path. * Auto-select the active page in the quick navigation/link module (see contao/core#8587). * Look up the form class and allow to choose the type (see contao/core#8527). * Add PHP Toolbox support (see contao#565). * Remove the arrow brackets in the book navigation template (see contao/core#8607). * Add a bottom padding to the buttons layer. * Add the contao.web_dir parameter (see contao/installation-bundle#40). * Fix the tests. * Match security firewall based on request scope (see contao#677). * Fix an issue found by Scrutinizer. * Use the contao.web_dir parameter in the Combiner (see contao#679). * Fix the tests. * Add stripRootDir() method to System class (see contao#683). * Add the contao.image.target_dir parameter (see contao#684). * The ContaoCoreExtension::overwriteImageTargetDir() is not deprecated. * Support custom backend routes (see contao#512). * Use the scope matcher instead of checking the request attribute (see contao#688). * Replace every occurrence of $contaoFramework with $framework. * Fix an issue found by Scrutinizer. * Fix deprecations in unit tests (see contao#687). * Added a DBAL field type for UUIDs (see contao#415). * Support importing form field options from a CSV field (see contao#444). * Fix the coding style and the unit tests. * Add the Doctrine field type in the config.yml file. doctrine: dbal: types: binary_string: class: "Contao\\CoreBundle\\Doctrine\\DBAL\\Types\\BinaryStringType" commented: true * Add a basic unit test for the BackendCsvImportController class. * Update the change log. * Fix rebuilding the search index (see contao#689). * Also handle „no origin“ and „empty origin“ in the CORS provider. * Remove an unused use statement. * Remove the security.yml file and update the README.md file. * Improve the e-mail extraction in the text element (thanks to Martin Auswöger). * Rename the Test namespace to Tests. * Update the composer.json file. * Update the .php_cs file. * Raise the minimum PHP version to 5.6 (see contao#701). * Support using objects in callback arrays (see contao#699). * Use try-finally blocks to close all output buffers when downloading a file (see contao#714). * Fix the coding style. * Only prefix an all numeric alias when standardizing (see contao#707). * Adjust the test namespaces. * Allow to manually pass a value to any widget (see contao#674). * Add a change log entry and fix the tests. * Disable the picker buttons if the main window does not show a picker. * Use the file manager instead of the file picker. * Use the site structure instead of the page picker. * Always show the selected nodes. * Add the menu builder.

Description ----------- This is a follow-up on #657, #677 and #682. It implements the new template loading by looking up the keys in `TL_CTE`, `TL_FFL` and `FE_MOD` as discussed in Mumble on August 29th. Commits ------- de3089b7 Hide mod_article_list when searching for custom mod_article templates 7b6ce852 Replace "root template" with "bundle template" 1ee232da Support passing an additional mapper array as second argument

Match security firewall based on request scope

6ec9452

Toflar approved these changes Jan 22, 2017

View reviewed changes

leofeyer assigned leofeyer and aschempp and unassigned leofeyer Jan 23, 2017

leofeyer added the feature label Jan 23, 2017

leofeyer added this to the 4.4.0 milestone Jan 23, 2017

Use the request matchers instead of ScopeAwareTrait

577247c

aschempp changed the title ~~Match security firewall based on request scope~~ [RFC] Match security firewall based on request scope Jan 23, 2017

aschempp added 2 commits January 23, 2017 11:04

Renamed RequestContext to ScopeMatcher

0130ea4

Fixed unit tests

67370fb

xchs reviewed Jan 23, 2017

View reviewed changes

src/Routing/ScopeMatcher.php

}

/**

* Checks whether the request is a Contao the master request.

Copy link

Contributor

xchs Jan 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

… is a Contao master request.

Updated deprecated information to use the ScopeMatcher service

96a9a50

aschempp changed the title ~~[RFC] Match security firewall based on request scope~~ [RTM] Match security firewall based on request scope Jan 23, 2017

leofeyer and others added 2 commits January 23, 2017 14:59

Fix the coding style.

ed50928

CS

cf7c49c

aschempp force-pushed the security-matcher branch from 59d218f to cf7c49c Compare January 23, 2017 14:04

leofeyer and others added 2 commits January 23, 2017 15:17

Fix a typo.

a06e925

Make the backend and frontend matcher private services

09b548b

aschempp force-pushed the security-matcher branch from efe439c to 09b548b Compare January 23, 2017 14:30

leofeyer self-assigned this Jan 23, 2017

leofeyer and others added 7 commits January 23, 2017 15:51

Fix the deprecation message.

8f6b4fc

Fixed service arguments for ContaoAuthenticator

ba8abb9

Fixed order of backend and frontend request matchers

beb68ee

Added unit tests for ScopeMatcher

b708dab

Add the missing phpDoc comments.

544e33d

Match security firewall based on request scope (see contao#677)

652fece

Merge branch 'develop' into security-matcher

55a9f6d

leofeyer force-pushed the develop branch from 652fece to 855665c Compare January 23, 2017 15:58

leofeyer merged commit d4c2efc into contao:develop Jan 23, 2017

aschempp deleted the security-matcher branch January 23, 2017 16:51

discordier mentioned this pull request Feb 25, 2017

[RTM] Hotfix/scope aware trait #619

Closed

agoat mentioned this pull request Apr 10, 2017

Feature/dca picker (#46) agoat/contao-core-bundle#47

Merged

leofeyer added a commit that referenced this pull request Aug 28, 2019

Correctly show the templates in the section wizard (see #677)

dc91d86

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RTM] Match security firewall based on request scope #677

[RTM] Match security firewall based on request scope #677

aschempp commented Jan 22, 2017 •

edited

Loading

bytehead commented Jan 22, 2017

aschempp commented Jan 23, 2017

xchs Jan 23, 2017

[RTM] Match security firewall based on request scope #677

[RTM] Match security firewall based on request scope #677

Conversation

aschempp commented Jan 22, 2017 • edited Loading

bytehead commented Jan 22, 2017

aschempp commented Jan 23, 2017

xchs Jan 23, 2017

Choose a reason for hiding this comment

aschempp commented Jan 22, 2017 •

edited

Loading