CODEWITHSUNDEEP
symfony
jspizziri
jspizziri

Reputation: 793

Symfony2 Access Control/Security

Okay, So I'm trying to setup my security in symfony2 via config. I have created a role_hierarchy:

role_hierarchy:
    ROLE_USER_ADMIN:    ROLE_USER
    ROLE_VENDOR:        ROLE_USER
    ROLE_SUPER_ADMIN:   [ROLE_VENDOR, ROLE_USER_ADMIN, ROLE_ALLOWED_TO_SWITCH]

And I've setup my access_control:

access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/administration/, roles: ROLE_VENDOR }
    - { path: ^/administration/vendor/new, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/taxonomy, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/property, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/usagelimit, roles: ROLE_SUPER_ADMIN }
    - { path: ^/account, roles: ROLE_USER }
    - { path: ^/library, roles: ROLE_USER }
    - { path: ^/profile, roles: ROLE_USER }
    - { path: ^/vendors, roles: ROLE_USER }
    - { path: ^/community, roles: ROLE_USER }

And yet, when I login with a user who has only the "ROLE_VENDOR", I can access the routes like /administration/taxonomy, /administration/property, etc...

What am I doing wrong???

Upvotes: 0

Views: 65

Answers (1)

qooplmao
qooplmao

Reputation: 17759

Your routes are in the wrong order.

It's a first come, first served everything after /administration/ with the directory are being caught by that directive and so allowing access by ROLE_VENDOR.

You should change it to...

access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, roles: IS_AUTHENTICATED_ANONYMOUSLY }
#   - { path: ^/administration/, roles: ROLE_VENDOR } // Old home...
    - { path: ^/administration/vendor/new, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/taxonomy, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/property, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/usagelimit, roles: ROLE_SUPER_ADMIN }
    - { path: ^/administration/, roles: ROLE_VENDOR } // New home...
    - { path: ^/account, roles: ROLE_USER }
    - { path: ^/library, roles: ROLE_USER }
    - { path: ^/profile, roles: ROLE_USER }
    - { path: ^/vendors, roles: ROLE_USER }
    - { path: ^/community, roles: ROLE_USER }

Upvotes: 2

Related Questions