Now the issue is that if the expression voter does not return true it will end up at with the BackendAccessVoter which will fail with a fatal error as there is no string provided in supports and voteOnAttribute but a Symfony\Component\ExpressionLanguage\Expression
The easiest solution is probably to just cast the attribute to string before using it in strncmp or check if it iis a string beforehand.
Affected version(s) 4.8.5 and probably others
Description
The backend access voter uses
strncmp
in\Contao\CoreBundle\Security\Voter\BackendAccessVoter::supports
How to reproduce
Create a security rule like:
Now the issue is that if the expression voter does not return true it will end up at with the
BackendAccessVoter
which will fail with a fatal error as there is no string provided in supports and voteOnAttribute but aSymfony\Component\ExpressionLanguage\Expression
The easiest solution is probably to just cast the attribute to string before using it in strncmp or check if it iis a string beforehand.