php - Sonata Admin : isGranted() always returns true in Admin class, 但模板中的 bool 值正确

Question

我在 Symfony 2 项目中使用 SonataAdminBundle 和 SonataUserBundle。安装的包是:

$ composer show | grep symfony
friendsofsymfony/rest-bundle             1.7.7              This Bundle provides various tools to rapidly develop RESTful API's with Symfony
friendsofsymfony/user-bundle             v1.3.6             Symfony FOSUserBundle
symfony/assetic-bundle                   v2.8.0             Integrates Assetic into Symfony2
symfony/css-selector                     v2.8.6             Symfony CssSelector Component
symfony/dom-crawler                      v2.8.6             Symfony DomCrawler Component
symfony/monolog-bundle                   2.11.1             Symfony MonologBundle
symfony/polyfill-apcu                    v1.1.1             Symfony polyfill backporting apcu_* functions to lower PHP versions
symfony/polyfill-mbstring                v1.1.1             Symfony polyfill for the Mbstring extension
symfony/swiftmailer-bundle               v2.3.11            Symfony SwiftmailerBundle
symfony/symfony                          v2.7.13            The Symfony PHP framework

$ composer show | grep sonata
sonata-project/admin-bundle              2.3.10             Symfony SonataAdminBundle
sonata-project/block-bundle              2.2.15             Symfony SonataBlockBundle
sonata-project/cache                     1.0.7              Cache library
sonata-project/core-bundle               2.3.11             Symfony SonataCoreBundle
sonata-project/doctrine-extensions       1.0.2              Doctrine2 behavioral extensions
sonata-project/doctrine-orm-admin-bundle 2.3.4              Symfony Sonata / Integrate Doctrine ORM into the SonataAdminBundle
sonata-project/easy-extends-bundle       2.1.10             Symfony SonataEasyExtendsBundle
sonata-project/exporter                  1.4.1              Lightweight Exporter library
sonata-project/google-authenticator      1.0.2              Library to integrate Google Authenticator into a PHP project
sonata-project/user-bundle               2.2.5              Symfony SonataUserBundle

security.yml配置文件中的角色:

role_hierarchy:
    ROLE_ADMIN:       [ROLE_USER, ROLE_SONATA_ADMIN]
    ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

使用仅具有 ROLE_ADMIN 的用户登录，以下是我的 UserAdmin 类的转储:

dump($this->isGranted('ROLE_ALLOWED_TO_SWITCH'));
dump($this->isGranted('ROLE_BLA_BLA_BLA'));
dump($this->isGranted('ROLE_USER'));

在 Symfony 工具栏中打印(在 dev 环境中)

true
true
true

如果我将转储放在一个覆盖的 Sonata 模板中，例如 app/Resources/SonataAdminBundle/views/CRUD/[anytemplate].html.twig，

{{ dump(is_granted('ROLE_ALLOWED_TO_SWITCH')) }}
{{ dump(is_granted('ROLE_BLA_BLA_BLA')) }}
{{ dump(is_granted('ROLE_USER')) }}

返回正确的值。

false
false
true

我进入这个是因为 SonataUserBundle 中的这一行没有效果:https://github.com/sonata-project/SonataUserBundle/blob/3.x/Admin/Model/UserAdmin.php#L95

此处描述了 isGranted() 用法:http://symfony.com/doc/current/bundles/SonataAdminBundle/reference/security.html#usage

我做错了什么还是这是一个错误？

编辑:

感谢@mickadoo 的评论，我注意到我有默认处理程序 sonata.admin.security.handler.noop，据说它总是返回 true，无论方法。我用 sonata.admin.security.handler.role 设置它并创建了一些角色(ROLE_SONATA_USER_ADMIN_USER_LIST 和 ROLE_SONATA_USER_ADMIN_USER_VIEW)，现在它返回正确的$this->isGranted('LIST') 或 $this->isGranted('VIEW') 的值，但始终返回 false $this->isGranted('ROLE_USER') 或 $this->isGranted('ROLE_ALLOWED_TO_SWITCH')。

我如何检查这个角色？

Answer 1

通用的非实体角色，例如ROLE_USER、ROLE_ADMIN、ROLE_SUPER_ADMIN、ROLE_{应使用默认的 Symfony 安全上下文检查 CUSTOM_STRING}。

在 Admin 类中:

$securityContext = $this->getConfigurationPool()->getContainer()->get('security.context');

if ($securityContext->isGranted('ROLE_USER')) {
    // Your PHP code here
}

在 Twig 模板中:

{% if is_granted('ROLE_USER') %}
    Your HTML/Twig content here.
{% endif %}

实体操作角色，如ROLE_SONATA_USER_ADMIN_USER_LIST、ROLE_SONATA_USER_ADMIN_USER_VIEW、ROLE_{CUSTOM_SONATA_ADMIN_SERVICE_NAME}_{ACTION}可以检查使用 Sonata Admin 助手或 Symfony 安全上下文。

在 Admin 类中:

// Using Symfony security context
$securityContext = $this->getConfigurationPool()->getContainer()->get('security.context');

if ($securityContext->isGranted('ROLE_SONATA_USER_ADMIN_USER_LIST')) {
    // your code here
}

// Using Sonata helper for shorter syntax
if ($this->isGranted('LIST')) {
    // your code here
}

在 Twig 模板中:

<!-- Using Symfony security context -->
{% if is_granted('ROLE_SONATA_USER_ADMIN_USER_LIST') %}
    Your HTML/Twig content here.
{% endif %}

<!-- Using Sonata helper -->
{% if admin.isGranted('LIST') %}
    Your HTML/Twig content here.
{% endif %}