web/app/config/security.yml at f8a1bcab718dd6c0757b4696e24e27faed7f7d24 · afup/web · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# To get started with security, check out the documentation:
# http://symfony.com/doc/current/book/security.html
security:
    password_hashers:
        legacy:
            id: 'AppBundle\Security\LegacyHasher'

        AppBundle\Association\Model\User:
            algorithm: sodium
            migrate_from:
                - legacy

    # http://symfony.com/doc/current/book/security.html#where-do-users-come-from-user-providers
    providers:
        github_users:
            id: 'AppBundle\Event\Model\Repository\GithubUserRepository'
        database_users:
            id: 'AppBundle\Association\Model\Repository\UserRepository'

    firewalls:
        # disables authentication for assets and the profiler, adapt it according to your needs
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        legacy_secured_area:
            pattern: ^(/admin/|/event/\w+/tickets|/association/techletter|/member)
            provider: database_users
            logout:
                path:   /admin/logout
                target: /
            form_login:
                username_parameter: utilisateur
                password_parameter: mot_de_passe
                login_path: admin_login
                check_path: admin_login
                default_target_path: /member/
                enable_csrf: true
            context: share_context

        github_secured_area:
            pattern: ^(/event/.*/(vote|cfp|speaker-infos)|/connect/github/check|/event/speaker-infos)
            provider: github_users
            custom_authenticators:
                - "%github_authenticator%"

        main:
            context: share_context

    access_control:
        - { path: ^/event/vote/, roles: ROLE_GITHUB }
        - { path: ^(/event/.*/(vote|cfp|speaker-infos)|/connect/github/check|/event/speaker-infos), roles: ROLE_GITHUB }
        - { path: ^/admin/(login|register|password), roles: PUBLIC_ACCESS }
        - { path: ^/admin/techletter/members, roles: ROLE_ADMIN }
        - { path: ^/admin/techletter, roles: ROLE_VEILLE }
        - { path: ^/admin/company, roles: ROLE_COMPANY_MANAGER }
        - { path: ^/admin/members/badges, roles: ROLE_ADMIN }
        - { path: ^/admin/members/users, roles: ROLE_ADMIN }
        - { path: ^/admin/members/companies, roles: ROLE_ADMIN }
        - { path: ^/admin/event/speakers-management, roles: ROLE_FORUM }
        - { path: ^/admin/event, roles: ROLE_ADMIN }
        - { path: ^/admin/members/general_meeting, roles: ROLE_ADMIN }
        - { path: ^/admin/members/general_meeting_vote, roles: ROLE_ADMIN }
        - { path: ^/admin/site, roles: ROLE_ADMIN }
        - { path: ^/admin/planete, roles: ROLE_ADMIN }
        - { path: ^/admin/(members/reporting|association/relances|talk|slackmembers/check|healthcheck), roles: ROLE_ADMIN}
        - { path: ^/member, roles: [ROLE_USER, ROLE_MEMBER_EXPIRED]}
        - { path: ^/admin/, roles: ROLE_MEMBER_EXPIRED }
        - { path: ^/blog, allow_if: "request.getClientIp() in ['217.70.189.71', '127.0.0.1', '192.168.42.1'] or request.server.get('ALLOW_BLOG_FROM_ALL') == 1 or request.headers.get('x-afup-blog-api-key') == '%env(BLOG_API_KEY)%'" }
        - { path: ^/blog, roles: ROLE_NO_ACCESS }
        - { path: ^/(event/\w+/tickets|association)paybox-callback, roles: PUBLIC_ACCESS, ips: "%paybox_ips%" }
        - { path: ^/(event/\w+/tickets|association)paybox-callback, roles: ROLE_SUPER_ADMIN }
        - { path: ^/(event/\w+/tickets|association)paybox-callback, roles: ROLE_NO_ACCESS }

    role_hierarchy:
        ROLE_USER: [ROLE_MEMBER_EXPIRED]
        ROLE_COMPANY_MANAGER: [ROLE_USER]
        ROLE_ADMIN:       [ROLE_USER, ROLE_DEPLOY, ROLE_APERO, ROLE_ANNUAIRE, ROLE_FORUM, ROLE_SITE, ROLE_VEILLE]
        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]