[Security] Fix parent serialization of user object #9806
Conversation
| return serialize(array($this->user, $this->authenticated, $this->roles, $this->attributes)); | ||
| return serialize( | ||
| array( | ||
| \is_object($this->user) ? clone $this->user : $this->user, |
There was a problem hiding this comment.
hmm why not just is_object()?
|
@cordoval Agreed, I got rid of the leading backslashes. |
This PR was squashed before being merged into the 2.2 branch (closes #9806). Discussion ---------- [Security] Fix parent serialization of user object | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | `parent::serialize()` and `parent::unserialize()`, which are used in the `AbstractToken` are [problematic](https://bugs.php.net/bug.php?id=62836) in PHP >= 5.4. [Cloning the object](https://gist.github.com/aurelijus/4713758) before serialization seems to fix this. Commits ------- 2e4670d [Security] Fix parent serialization of user object
This PR was submitted for the 2.2 branch but it was merged into the 2.3 branch instead (closes #9806). Discussion ---------- [Security] Fix parent serialization of user object | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | `parent::serialize()` and `parent::unserialize()`, which are used in the `AbstractToken` are [problematic](https://bugs.php.net/bug.php?id=62836) in PHP >= 5.4. [Cloning the object](https://gist.github.com/aurelijus/4713758) before serialization seems to fix this. Commits ------- e0bb891 [Security] Fix parent serialization of user object
|
Guys, this breaks my code :-( |
|
This breaks my code as well. We have special and necessary behavior built in to our Entity's clone behavior so when this went live in 2.3.9 it broke our code. Cloning an entire object seems like a very expensive and unexpected behavior in this situation. I'm seeing if there is perhaps another way around the PHP bug. |
|
Is it possible to solve this using a __clone() method providing some special operation? |
|
This is a weird problem. While doing some tests on my systems Ubuntu 13.10, PHP 5.5.3 i got strange results (with a rather complicated token, as it contains another token in itself): |
|
@MacinJosh Please let us know if you find a better workaround. @sstok What do you mean exactly? @g-g Do your nested tokens also contain full user objects? My fix was necessary for correct serialization of the |
|
Yes, the nested tokens may have user objects. But all user objects implement Serializable, and this works well for me. |
parent::serialize()andparent::unserialize(), which are used in theAbstractTokenare problematic in PHP >= 5.4. Cloning the object before serialization seems to fix this.