contao / core-bundle

[READ-ONLY] Contao Core Bundle
GNU Lesser General Public License v3.0
123 stars 58 forks source link

[BUG] BackendAccessVoter fails with fatal error when using `allow_if` security access rules - Might not happen in prod enviornment #1710

Closed AndreasA closed 4 years ago

AndreasA commented 4 years ago

Affected version(s) 4.8.5 and probably others

Description
The backend access voter uses strncmp in \Contao\CoreBundle\Security\Voter\BackendAccessVoter::supports

How to reproduce
Create a security rule like:

- { path: "^/my/route", allow_if: '!is_granted("ROLE_NO_ROUTE_ACCESS")' }

Now the issue is that if the expression voter does not return true it will end up at with the BackendAccessVoter which will fail with a fatal error as there is no string provided in supports and voteOnAttribute but a Symfony\Component\ExpressionLanguage\Expression

The easiest solution is probably to just cast the attribute to string before using it in strncmp or check if it iis a string beforehand.

leofeyer commented 4 years ago

I am closing this in favor of contao/contao#1013.