[Security] Fixed roles serialization on token from user object

eko · eko · commit dfa7f5020e12 · 2016-09-21T16:33:32.000+02:00
diff --git a/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php b/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php
@@ -150,7 +150,7 @@ public function serialize()
             array(
                 is_object($this->user) ? clone $this->user : $this->user,
                 $this->authenticated,
-                $this->roles,
+                array_map(function ($role) { return clone $role; }, $this->roles),
                 $this->attributes,
             )
         );
diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/UserAuthenticationProviderTest.php b/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/UserAuthenticationProviderTest.php
@@ -220,7 +220,7 @@ public function testAuthenticateWithPreservingRoleSwitchUserRole()
         $this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken', $authToken);
         $this->assertSame($user, $authToken->getUser());
         $this->assertContains(new Role('ROLE_FOO'), $authToken->getRoles(), '', false, false);
-        $this->assertContains($switchUserRole, $authToken->getRoles());
+        $this->assertContains($switchUserRole, $authToken->getRoles(), '', false, false);
         $this->assertEquals('foo', $authToken->getCredentials());
         $this->assertEquals(array('foo' => 'bar'), $authToken->getAttributes(), '->authenticate() copies token attributes');
     }
diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php b/src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php
@@ -14,6 +14,7 @@
 use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
 use Symfony\Component\Security\Core\Role\Role;
 use Symfony\Component\Security\Core\Role\SwitchUserRole;
+use Symfony\Component\Security\Core\User\User;
 
 class TestUser
 {
@@ -87,7 +88,7 @@ public function testEraseCredentials()
 
     public function testSerialize()
     {
-        $token = $this->getToken(array('ROLE_FOO'));
+        $token = $this->getToken(array('ROLE_FOO', new Role('ROLE_BAR')));
         $token->setAttributes(array('foo' => 'bar'));
 
         $uToken = unserialize(serialize($token));
@@ -96,6 +97,19 @@ public function testSerialize()
         $this->assertEquals($token->getAttributes(), $uToken->getAttributes());
     }
 
+    public function testSerializeWithRoleObjects()
+    {
+        $user = new User('name', 'password', array(new Role('ROLE_FOO'), new Role('ROLE_BAR')));
+        $token = new ConcreteToken($user, $user->getRoles());
+
+        $serialized = serialize($token);
+        $unserialized = unserialize($serialized);
+
+        $roles = $unserialized->getRoles();
+
+        $this->assertEquals($roles, $user->getRoles());
+    }
+
     public function testSerializeParent()
     {
         $user = new TestUser('fabien');

Original file line number	Diff line number	Diff line change
`@@ -150,7 +150,7 @@ public function serialize()`
`150`	`150`	`array(`
`151`	`151`	`is_object($this->user) ? clone $this->user : $this->user,`
`152`	`152`	`$this->authenticated,`
`153`		`- $this->roles,`
	`153`	`+ array_map(function ($role) { return clone $role; }, $this->roles),`
`154`	`154`	`$this->attributes,`
`155`	`155`	`)`
`156`	`156`	`);`
Original file line number	Diff line number	Diff line change
`@@ -220,7 +220,7 @@ public function testAuthenticateWithPreservingRoleSwitchUserRole()`
`220`	`220`	`$this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken', $authToken);`
`221`	`221`	`$this->assertSame($user, $authToken->getUser());`
`222`	`222`	`$this->assertContains(new Role('ROLE_FOO'), $authToken->getRoles(), '', false, false);`
`223`		`- $this->assertContains($switchUserRole, $authToken->getRoles());`
	`223`	`+ $this->assertContains($switchUserRole, $authToken->getRoles(), '', false, false);`
`224`	`224`	`$this->assertEquals('foo', $authToken->getCredentials());`
`225`	`225`	`$this->assertEquals(array('foo' => 'bar'), $authToken->getAttributes(), '->authenticate() copies token attributes');`
`226`	`226`	`}`