Skip to content

do not implement __serialize() for users without passwords #1743

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 19, 2025
Merged

do not implement __serialize() for users without passwords #1743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4ba90e1
do not implement __serialize() for users without passwords
xabbuh Nov 16, 2025
fafd951
run tests with Symfony 7.3
xabbuh Nov 16, 2025
d67cf83
fix the Maker test environment
xabbuh Nov 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci-linux.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
- '8.3'
symfony-version:
- '6.4.*'
- '7.2.*'
- '7.3.*'
dependency-versions: ['highest']
include:
# testing lowest PHP+dependencies with lowest Symfony
Expand Down
2 changes: 1 addition & 1 deletion src/Security/UserClassBuilder.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ public function addUserInterfaceImplementation(ClassSourceManipulator $manipulat

$this->addPasswordImplementation($manipulator, $userClassConfig);

if (class_exists(IsGrantedContext::class)) {
if (class_exists(IsGrantedContext::class) && $userClassConfig->hasPassword()) {
$this->addSerialize($manipulator);
}

Expand Down
4 changes: 2 additions & 2 deletions src/Test/MakerTestEnvironment.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,7 @@ private function buildFlexSkeleton(): void
$flexProjectDir = \sprintf('flex_project%s', $targetVersion);

MakerTestProcess::create(
\sprintf('composer create-project symfony/skeleton%s %s --prefer-dist --no-progress', $versionString, $flexProjectDir),
\sprintf('composer create-project symfony/skeleton%s %s --prefer-dist --no-progress --keep-vcs', $versionString, $flexProjectDir),
Copy link
Member Author

@xabbuh xabbuh Nov 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure when this broke but we need the .git directory as the created project serves as the base repository for the following tests

Copy link
Member

@stof stof Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC, it relied on Flex running git init to create a new git repository (free from the history of the skeleton)

Copy link
Member Author

@xabbuh xabbuh Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, that might indeed explain it

Copy link

@nxtpge nxtpge Nov 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @xabbuh, this change solved the problem I faced while trying to run the repository tests.

Now, I can complete my feature.

$this->cachePath
)->run();

Expand All @@ -260,7 +260,7 @@ private function buildFlexSkeleton(): void
}

// fetch a few packages needed for testing
MakerTestProcess::create('composer require phpunit browser-kit symfony/css-selector --prefer-dist --no-progress --no-suggest', $this->flexPath)
MakerTestProcess::create('composer require phpunit:1.1.* browser-kit symfony/css-selector --prefer-dist --no-progress --no-suggest', $this->flexPath)
Copy link
Member Author

@xabbuh xabbuh Nov 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

symfony/test-pack 1.2 brings us PHPUnit 12 which the tests don't run with

Copy link
Member

@stof stof Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1.1.* is weird. Don't you mean 11.* instead ?

Copy link
Member Author

@xabbuh xabbuh Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no, phpunit is an alias for symfony/test-pack (see https://github.com/symfony/recipes/blob/main/symfony/test-pack/1.0/manifest.json#L2 and https://packagist.org/packages/symfony/test-pack#v1.1.0)

->run();

if ('\\' !== \DIRECTORY_SEPARATOR) {
Expand Down
11 changes: 0 additions & 11 deletions tests/Security/fixtures/expected/UserEntityWithoutPassword.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,17 +67,6 @@ public function setRoles(array $roles): static
return $this;
}

/**
* Ensure the session doesn't contain actual password hashes by CRC32C-hashing them, as supported since Symfony 7.3.
*/
public function __serialize(): array
{
$data = (array) $this;
$data["\0" . self::class . "\0password"] = hash('crc32c', $this->password);

return $data;
}

#[\Deprecated]
public function eraseCredentials(): void
{
Expand Down
11 changes: 0 additions & 11 deletions tests/Security/fixtures/expected/UserModelWithoutPassword.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,17 +52,6 @@ public function setRoles(array $roles): static
return $this;
}

/**
* Ensure the session doesn't contain actual password hashes by CRC32C-hashing them, as supported since Symfony 7.3.
*/
public function __serialize(): array
{
$data = (array) $this;
$data["\0" . self::class . "\0password"] = hash('crc32c', $this->password);

return $data;
}

#[\Deprecated]
public function eraseCredentials(): void
{
Expand Down