[SecurityBundle] Passwords are not encoded when algorithm set to "true" #34738
+7
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Can we catch this earlier? imho, |
|
Sounds reasonable. I will take a look at the config validation. |
nieuwenhuisen
force-pushed
the
fix_algorithm_true_converts_to_plain_password_encoder
branch
from
c2926d9
to
cdb0b49
Compare
|
I have reset my previous updates and change the configuration validation. |
nieuwenhuisen
changed the title
src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
Outdated
Show resolved
Hide resolved
derrabus
approved these changes
Dec 3, 2019
xabbuh
reviewed
Dec 3, 2019
src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
Outdated
Show resolved
Hide resolved
xabbuh
approved these changes
Dec 3, 2019
chalasr
approved these changes
Dec 3, 2019
chalasr
force-pushed
the
fix_algorithm_true_converts_to_plain_password_encoder
branch
from
851ffb9
to
d00464f
Compare
chalasr
force-pushed
the
fix_algorithm_true_converts_to_plain_password_encoder
branch
from
d00464f
to
cb429cd
Compare
chalasr
force-pushed
the
fix_algorithm_true_converts_to_plain_password_encoder
branch
from
5d593d5
to
83a5517
Compare
|
Rebased on 3.4 since it applies there. Congratz for your first contrib! |
|
Thank you @nieuwenhuisen. |
chalasr
pushed a commit
that referenced
this pull request
Dec 3, 2019
…set to "true" (nieuwenhuisen) This PR was merged into the 3.4 branch. Discussion ---------- [SecurityBundle] Passwords are not encoded when algorithm set to "true" | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #34725 | License | MIT | Doc PR | - If the algorithm is set to `true`, password will be encode as plain password. ``` security: encoders: App\User\User: algorithm: true ``` The reason for this is the not strict comparison of php switches. ``` switch ($config['algorithm']) { case 'plaintext': } ``` `true == 'plaintext'` is `true`, so the first case is hit. My first solution was to cast the algorithm to a string, to prevent this. After some feedback I have catch this problem earlier and does not allow true as valid value to the algorithm option. Ps. This is my first PR for Symfony, any feedback is welcome :-)! Commits ------- 83a5517 [SecurityBundle] Passwords are not encoded when algorithm set to \"true\"
|
@nieuwenhuisen Thanks for fixing it! 👍 |
nieuwenhuisen
deleted the
fix_algorithm_true_converts_to_plain_password_encoder
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the algorithm is set to
true, password will be encode as plain password.The reason for this is the not strict comparison of php switches.
true == 'plaintext'istrue, so the first case is hit. My first solution was to cast the algorithm to a string, to prevent this. After some feedback I have catch this problem earlier and does not allow true as valid value to the algorithm option.Ps. This is my first PR for Symfony, any feedback is welcome :-)!