Question

我的网站有3个用户角色。 1.ROLE_ADMIN 2.ROLE_STUDENT 3.ROLE_PARENT

从最近几天开始，我遇到了一个问题。当我以ROLE_STUDENT身份登录时，我可以访问ROLE_PARENT页面。这只发生于ROLE_STUDENT / ROLE_PARENT NOT ROLE_ADMIN

这是我的sucurity.yml

请告诉我哪里出错了。

security:
    encoders:
        Bundle\AdminBundle\Entity\KidsKulaUsers:
            algorithm: sha512

role_hierarchy:
#        ROLE_EMPLOYEE:    [ROLE_ADVOCATES]
#        ROLE_RECRUITERS:  [ROLE_EMPLOYER]
    ROLE_SUPER_ADMIN: [ROLE_ADMIN,ROLE_PARENT,ROLE_STUDENT]

providers:
    fos_userbundle:
        id: fos_user.user_provider.username_email
firewalls:
    main:
        pattern:  ^/
        anonymous: ~
        form_login: 
            login_path: /student/login
            provider: fos_userbundle
            csrf_provider: form.csrf_provider
            check_path:    fos_user_security_check
            use_forward:                    false

        logout:
            path:   /logout
            target: /student/login
            #success_handler: security.logout.success_handler
        remember_me: 
            key:      "%secret%"
            lifetime: 31536000 # 365 days in seconds
            path:     /
            domain:   ~ # Defaults to the current domain from $_SERVER    

access_control:
    - { path: /admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/find-friends, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/search_friends, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/contact, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/forgotpassword, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /reset-password, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/registration, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student/auth_registration/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: /student_activation , roles: IS_AUTHENTICATED_ANONYMOUSLY}
    - { path: /parent, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/admin, roles: ROLE_ADMIN }
    - { path: ^/student, roles: ROLE_STUDENT }
    - { path: ^/parent, roles: ROLE_PARENT }

Answer 1

看看你access_control部分：

....
- { path: /parent, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: ROLE_ADMIN }
- { path: ^/student, roles: ROLE_STUDENT }
- { path: ^/parent, roles: ROLE_PARENT }

当学生导航到/parent Symfony开始审查这些规则时。只要它与模式匹配，就会检查角色并退出。

显然，您/parent路线根本不受保护，因此任何用户（包括学生）都可以访问它。

删除第一条规则，事情应按预期开始工作。

阻止symfony 2中的用户访问

1 个答案: