Skip to content

[Security] User in expression cannot be "anon" #17512

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Dec 8, 2022
Merged

[Security] User in expression cannot be "anon" #17512

merged 1 commit into from
Dec 8, 2022

Conversation

HypeMC
Copy link
Member

@HypeMC HypeMC commented Dec 5, 2022

Since Symfony 6.0, the TokenInterface::getUser() method always returns an instance of UserInterface or null, and since the ExpressionVoter fetches the user from the token, it shouldn't be possible for it to be anon any more.

@carsonbot carsonbot added this to the 6.0 milestone Dec 5, 2022
@javiereguiluz
Copy link
Member

@HypeMC thanks a lot for fixing this and thanks for the concise but perfect explanation too!

@javiereguiluz javiereguiluz merged commit 34f2209 into symfony:6.0 Dec 8, 2022
@HypeMC HypeMC deleted the remove-anon branch December 8, 2022 15:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Security Status: Reviewed

Projects

None yet

Milestone

6.0

Development

Successfully merging this pull request may close these issues.

3 participants

@HypeMC @javiereguiluz @carsonbot