0

在显示用户操作中，我想检查登录的用户是否有权查看该用户。所以我创建了一个 UserVoter。但是，当我尝试使用注释将 url 中定义的用户传递给 Voter 时，我同时使用$subject和$token->getUser()

如果我在操作中更改我的 var 名称，它可以正常工作（$user -> $foo）。

你知道我该怎么做才能不改变我的 var name 吗？

控制器 ：

/**
 * Finds and displays a user entity.
 *
 * @Method("GET")
 * @Route("/{id}/", name="authenticated_user_show", requirements={"id": "\d+"})
 * @ParamConverter("user", class="AppBundle:User")
 * @Security("is_granted('SHOW', user)")
 */
public function showAction(User $user)
{

和选民：

protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
{
    $user = $token->getUser();

    if (!$user instanceof User) {
        // the user must be logged in; if not, deny access
        return false;
    }

    if ($user->hasRole(User::ROLE_SUPER_ADMIN)) {
        // if super admin, can do everything
        return true;
    }

    // you know $subject is an User object, thanks to supports
    /** @var User $userSubject */
    $userSubject = $subject;

    switch ($attribute) {
        case self::SHOW:
            return $this->canShow($userSubject, $user);
        case self::EDIT:
            return $this->canEdit($userSubject, $user);
    }

    throw new \LogicException('This code should not be reached!');
}


private function canShow(User $userSubject, User $user) : bool
{
    if ($user->getClient() === $userSubject->getClient()) {
        // if they are in the same client
        return true;
    }

    return false;
}

private function canEdit(User $userSubject, User $user, TokenInterface $token) : bool
{
    if (
        $this->decisionManager->decide($token, [User::ROLE_ADMIN]) &&
        $user->getClient() === $userSubject->getClient()
        ) {
        // if the user and the admin belong to the same client
        return true;
    } elseif (
        $this->decisionManager->decide($token, [User::ROLE_MANAGER]) &&
        $this->userManager->hasEstablishmentInCommon($user, $userSubject)
        ) {
        // if the user and the manager are linked to the same establishment
        return true;
    }

    return false;
}
4

1 回答 1

0

假设您没有尝试查看已登录的用户，我会认为您可能与安全注释上下文中的变量发生冲突：

https://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/annotations/security.html Security 注解可以访问以下变量：

  • 令牌：当前的安全令牌
  • user：当前用户对象
  • request：请求实例
  • 角色：用户角色；和所有请求属性。

要解决此问题，请更改用户名以避免冲突。

/**
 * Finds and displays a user entity.
 *
 * @Method("GET")
 * @Route("/{id}/", name="authenticated_user_show", requirements={"id": 
   "\d+"})
 * @ParamConverter("showUser", class="AppBundle:User")
 * @Security("is_granted('SHOW', showUser)")
 */
 public function showAction(User $showUser)
于 2017-07-05T13:13:53.683 回答