[Security] Fix best encoder not wired using migrate_from

symfony · Nov 17, 2019 · 4132a60 · 4132a60
1 parent 7ed6d35
commit 4132a60
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/src/Symfony/Component/Security/Core/Encoder/EncoderFactory.php b/src/Symfony/Component/Security/Core/Encoder/EncoderFactory.php
@@ -114,7 +114,9 @@ private function getEncoderConfigFromAlgorithm(array $config): array
         }
 
         if ($fromEncoders = ($config['migrate_from'] ?? false)) {
-            $encoderChain = [];
+            unset($config['migrate_from']);
+            $encoderChain = [$this->createEncoder($config, true)];
+
             foreach ($fromEncoders as $name) {
                 if ($encoder = $this->encoders[$name] ?? false) {
                     $encoder = $encoder instanceof PasswordEncoderInterface ? $encoder : $this->createEncoder($encoder, true);

diff --git a/src/Symfony/Component/Security/Core/Tests/Encoder/EncoderFactoryTest.php b/src/Symfony/Component/Security/Core/Tests/Encoder/EncoderFactoryTest.php
@@ -143,9 +143,7 @@ public function testMigrateFrom()
 
         $factory = new EncoderFactory([
             'digest_encoder' => $digest = new MessageDigestPasswordEncoder('sha256'),
-            'pbdkf2' => $digest = new MessageDigestPasswordEncoder('sha256'),
-            'bcrypt_encoder' => ['algorithm' => 'bcrypt'],
-            SomeUser::class => ['algorithm' => 'sodium', 'migrate_from' => ['bcrypt_encoder', 'digest_encoder']],
+            SomeUser::class => ['algorithm' => 'sodium', 'migrate_from' => ['bcrypt', 'digest_encoder']],
         ]);
 
         $encoder = $factory->getEncoder(SomeUser::class);
@@ -154,6 +152,7 @@ public function testMigrateFrom()
         $this->assertTrue($encoder->isPasswordValid((new SodiumPasswordEncoder())->encodePassword('foo', null), 'foo', null));
         $this->assertTrue($encoder->isPasswordValid((new NativePasswordEncoder(null, null, null, \PASSWORD_BCRYPT))->encodePassword('foo', null), 'foo', null));
         $this->assertTrue($encoder->isPasswordValid($digest->encodePassword('foo', null), 'foo', null));
+        $this->assertStringStartsWith(SODIUM_CRYPTO_PWHASH_STRPREFIX, $encoder->encodePassword('foo', null));
     }
 
     public function testDefaultMigratingEncoders()