From 6f6142819526e2f37ba1e0f0240cfda1aa53b587 Mon Sep 17 00:00:00 2001 From: Wouter de Jong Date: Tue, 26 May 2020 16:53:18 +0200 Subject: [PATCH] Fixed handling of CSRF logout error --- .../Security/Http/Firewall/ExceptionListener.php | 4 +++- .../Http/Tests/Firewall/ExceptionListenerTest.php | 12 ++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php b/src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php index 0232917687670..c9ce47a3a7f13 100644 --- a/src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php +++ b/src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php @@ -174,8 +174,10 @@ private function handleAccessDeniedException(GetResponseForExceptionEvent $event private function handleLogoutException(LogoutException $exception) { + $event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception)); + if (null !== $this->logger) { - $this->logger->info('A LogoutException was thrown.', ['exception' => $exception]); + $this->logger->info('A LogoutException was thrown; wrapping with AccessDeniedHttpException', ['exception' => $exception]); } } diff --git a/src/Symfony/Component/Security/Http/Tests/Firewall/ExceptionListenerTest.php b/src/Symfony/Component/Security/Http/Tests/Firewall/ExceptionListenerTest.php index 29899de11f957..34e4fcff5a2a4 100644 --- a/src/Symfony/Component/Security/Http/Tests/Firewall/ExceptionListenerTest.php +++ b/src/Symfony/Component/Security/Http/Tests/Firewall/ExceptionListenerTest.php @@ -21,6 +21,7 @@ use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface; use Symfony\Component\Security\Core\Exception\AccessDeniedException; use Symfony\Component\Security\Core\Exception\AuthenticationException; +use Symfony\Component\Security\Core\Exception\LogoutException; use Symfony\Component\Security\Http\Authorization\AccessDeniedHandlerInterface; use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface; use Symfony\Component\Security\Http\Firewall\ExceptionListener; @@ -160,6 +161,17 @@ public function testAccessDeniedExceptionNotFullFledged(\Exception $exception, \ $this->assertSame(null === $eventException ? $exception : $eventException, $event->getException()->getPrevious()); } + public function testLogoutException() + { + $event = $this->createEvent(new LogoutException('Invalid CSRF.')); + + $listener = $this->createExceptionListener(); + $listener->onKernelException($event); + + $this->assertEquals('Forbidden', $event->getResponse()->getContent()); + $this->assertEquals(403, $event->getResponse()->getStatusCode()); + } + public function getAccessDeniedExceptionProvider() { return [