Symfony And Security


Table of Contents

secure.yaml 
secure.yaml 
access myUser.class.php from a template/layout 
access myUser.class.php from a template/layout 
only allow user to change their own record 
only allow user to change their own record 
only allow user to change their own record 
Hiding info from url 
query string on redirects and forwards 
redirect strips data out 
redirect strips data out 
redirect strips data out 

secure.yaml 

http://www.symfony-project.org/forum/index.php?t=msg&th=6989

i now wanted to set some security settings via. security.yml, but unluckily it didnt worked the way i though it should…

i just created a 'security.yml' in the 'apps/myapp/modules/mymodule/config/' Folder with (and nothing else) :

executeTest:
  is_secure:   on
  credentials: admin
Test:
  is_secure:   on
  credentials: admin
test:
  is_secure:   on
  credentials: admin

I added that 3 Things couze test didn't worked… so here is my First question, if i have something like this:

Example 1. File actions.class.php:

class mymoduleActions extends sfActions
{
  public function executeTest()
  {
    $this->temp = "if you can read me, it didnt worked out.";
  }
}

so should the entry in the 'security.yml' be Test, or test? Well at least one of that 3 Ways should work, but if i try to open it myserver.de/mymodule/test

i can read the Text everytime … and dind't get something like "permission denied" , by the way, i didnt added any Credentials and setAuthenticated(true) to the user, so what did i did wrong? :(

And there are 2 Paths where i can add my security.yml , if i have entred in both, wich one will be used for an action?

'apps/myapp/modules/mymodule/config/' 'apps/myapp/config/'

secure.yaml 

> so should the entry in the 'security.yml' be Test, or test?

apps/myapp/modules/mymodule/config/security.yml

test:
  is_secure: on
  credentials: admin

as per http://www.symfony-project.org/book/trunk/06-Inside-the-Cont roller-Layer#Action%20Security

  1. Did you clear the cache after applying the security?
  2. To perform more 'generic' test you could do:

    all:
      is_secure: on
      credentials: admin

documented on: 13 June 2007, pezetgee