ACL: Inserting multiple ObjectFieldAces throws DB constraint violations (sf 2.3.1 - 2.3.6)

[mogoman]

There seems to be a problem when updating ACL when using object field aces. It is fairy simply to reproduce inside a test controller:

1. create a simple domain object:

   $demoObj         = new Demo();
   $demoObj->setId(2);
   
   $oid  = ObjectIdentity::fromDomainObject($demoObj);
   $fieldName = "name";
   

2. give the object a simple ROLE based ACL:

   $aclProvider    = $this->get('security.acl.provider');
   $acl  = $aclProvider->createAcl($oid);
   
   $roleUser  = new RoleSecurityIdentity('ROLE_USER');
   $mask      = new MaskBuilder(4); // 4 = EDIT
   
   $acl->insertobjectFieldAce($fieldName, $roleUser, $mask->get());
   
   $aclProvider->updateAcl($acl);
   

3. add another ROLE to the ACL:

   $acl  = $aclProvider->findAcl($oid);
   $roleUser  = new RoleSecurityIdentity('ROLE_FOO');
   $mask      = new MaskBuilder(4); // 4 = EDIT
   
   $acl->insertobjectFieldAce($fieldName, $roleUser, $mask->get());
   $aclProvider->updateAcl($acl);
   

4. add one more ROLE to the ACL:

   $acl  = $aclProvider->findAcl($oid);
   $roleUser  = new RoleSecurityIdentity('ROLE_BAR');
   $mask      = new MaskBuilder(4); // 4 = EDIT
   
   $acl->insertobjectFieldAce($fieldName, $roleUser, $mask->get());
   $aclProvider->updateAcl($acl);
   

running step 4 produces the following:

    An exception occurred while executing 'UPDATE acl_entries SET ace_order
    = 1 WHERE id = 40':

    SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry
    '19-22-name-1' for key 
    'UNIQ_46C8B806EA000B103D9AB4A64DEF17BCE4289BF4'

If you remove the offending index from the database, the update works perfectly (the ace_order), so the problem seems to be that Symfony is not updating the ACL items in the correct order.

The above does not affect class field aces.

There is a second issue related to the above where the following throws the same execption:

    $index = 0;
    $acl->deleteObjectFieldAce($index, $fieldName);
    $acl->insertObjectFieldAce($fieldName, $roleUser, $mask->get());
    $aclProvider->updateAcl($acl);

there is a workaround by doing:

    $index = 0;
    $acl->deleteObjectFieldAce($index, $fieldName);
    $aclProvider->updateAcl($acl);
    $acl->insertObjectFieldAce($fieldName, $roleUser, $mask->get());
    $aclProvider->updateAcl($acl);

Once again this does not affect class field aces.

[jillro]

Reproduced on https://github.com/Guilro/SymfonyTests/tree/69303c00b0117f51142f54e9c7e2423ec279ba5e.

[jillro]

Reading MutableAclProvider.php updateFieldAceProperty method, I think classFieldAce and objectFieldAce updates follow the same process.

In every case, there is a moment in the process where to ACE have the same value for the order field. That's a problem because as we can see in Schema.php there is a UNIQUE key on class_id, object_identity_id, field_name, and ace_order.

The bug does not occure when we use ClassField, Object or Class scope because in those case at least one of the field is NULL so the unique constraint does not apply. (Which by the way is not what I would have expected from MySQL but that's another question...). But in any case, the problem is that at some moment of the update process, some entries have the same order value, whatever the scope of the entry.

[jillro]

The problem seems to occur in fact during execution of updateAces() method. We should iterate the ACE in the reverse order to update them. I am working on a patch.

[mogoman]

Thanks for the update and reproducing the problem (and patching of course...)

[jillro]

I wrote a new test, and if we iterate the ACE in reverse order, the same problem appears when we delete ACEs. Need to rework on it.