Actualización

vendor/symfony/security-bundle/Command/InitAclCommand.php

@@ -0,0 +1,85 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bundle\SecurityBundle\Command;
+
+use Symfony\Bundle\FrameworkBundle\Command\ContainerAwareCommand;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Doctrine\DBAL\Schema\SchemaException;
+
+/**
+ * Installs the tables required by the ACL system.
+ *
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+class InitAclCommand extends ContainerAwareCommand
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function isEnabled()
+    {
+        if (!$this->getContainer()->has('security.acl.dbal.connection')) {
+            return false;
+        }
+
+        return parent::isEnabled();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        $this
+            ->setName('init:acl')
+            ->setDescription('Mounts ACL tables in the database')
+            ->setHelp(<<<'EOF'
+The <info>%command.name%</info> command mounts ACL tables in the database.
+
+  <info>php %command.full_name%</info>
+
+The name of the DBAL connection must be configured in your <info>app/config/security.yml</info> configuration file in the <info>security.acl.connection</info> variable.
+
+  <info>security:
+      acl:
+          connection: default</info>
+EOF
+            )
+        ;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $container = $this->getContainer();
+
+        $connection = $container->get('security.acl.dbal.connection');
+        $schema = $container->get('security.acl.dbal.schema');
+
+        try {
+            $schema->addToSchema($connection->getSchemaManager()->createSchema());
+        } catch (SchemaException $e) {
+            $output->writeln('Aborting: '.$e->getMessage());
+
+            return 1;
+        }
+
+        foreach ($schema->toSql($connection->getDatabasePlatform()) as $sql) {
+            $connection->exec($sql);
+        }
+
+        $output->writeln('ACL tables have been initialized successfully.');
+    }
+}

vendor/symfony/security-bundle/Command/SetAclCommand.php

@@ -0,0 +1,173 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bundle\SecurityBundle\Command;
+
+use Symfony\Bundle\FrameworkBundle\Command\ContainerAwareCommand;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Security\Acl\Domain\ObjectIdentity;
+use Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity;
+use Symfony\Component\Security\Acl\Domain\UserSecurityIdentity;
+use Symfony\Component\Security\Acl\Exception\AclAlreadyExistsException;
+use Symfony\Component\Security\Acl\Permission\MaskBuilder;
+use Symfony\Component\Security\Acl\Model\MutableAclProviderInterface;
+
+/**
+ * Sets ACL for objects.
+ *
+ * @author Kévin Dunglas <kevin@les-tilleuls.coop>
+ */
+class SetAclCommand extends ContainerAwareCommand
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function isEnabled()
+    {
+        if (!$this->getContainer()->has('security.acl.provider')) {
+            return false;
+        }
+
+        $provider = $this->getContainer()->get('security.acl.provider');
+        if (!$provider instanceof MutableAclProviderInterface) {
+            return false;
+        }
+
+        return parent::isEnabled();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        $this
+            ->setName('acl:set')
+            ->setDescription('Sets ACL for objects')
+            ->setHelp(<<<EOF
+The <info>%command.name%</info> command sets ACL.
+The ACL system must have been initialized with the <info>init:acl</info> command.
+
+To set <comment>VIEW</comment> and <comment>EDIT</comment> permissions for the user <comment>kevin</comment> on the instance of
+<comment>Acme\MyClass</comment> having the identifier <comment>42</comment>:
+
+  <info>php %command.full_name% --user=Symfony/Component/Security/Core/User/User:kevin VIEW EDIT Acme/MyClass:42</info>
+
+Note that you can use <comment>/</comment> instead of <comment>\\ </comment>for the namespace delimiter to avoid any
+problem.
+
+To set permissions for a role, use the <info>--role</info> option:
+
+  <info>php %command.full_name% --role=ROLE_USER VIEW Acme/MyClass:1936</info>
+
+To set permissions at the class scope, use the <info>--class-scope</info> option:
+
+  <info>php %command.full_name% --class-scope --user=Symfony/Component/Security/Core/User/User:anne OWNER Acme/MyClass:42</info>
+  
+EOF
+            )
+            ->addArgument('arguments', InputArgument::IS_ARRAY | InputArgument::REQUIRED, 'A list of permissions and object identities (class name and ID separated by a column)')
+            ->addOption('user', null, InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY, 'A list of security identities')
+            ->addOption('role', null, InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY, 'A list of roles')
+            ->addOption('class-scope', null, InputOption::VALUE_NONE, 'Use class-scope entries')
+        ;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        // Parse arguments
+        $objectIdentities = array();
+        $maskBuilder = $this->getMaskBuilder();
+        foreach ($input->getArgument('arguments') as $argument) {
+            $data = explode(':', $argument, 2);
+
+            if (count($data) > 1) {
+                $objectIdentities[] = new ObjectIdentity($data[1], strtr($data[0], '/', '\\'));
+            } else {
+                $maskBuilder->add($data[0]);
+            }
+        }
+
+        // Build permissions mask
+        $mask = $maskBuilder->get();
+
+        $userOption = $input->getOption('user');
+        $roleOption = $input->getOption('role');
+        $classScopeOption = $input->getOption('class-scope');
+
+        if (empty($userOption) && empty($roleOption)) {
+            throw new \InvalidArgumentException('A Role or a User must be specified.');
+        }
+
+        // Create security identities
+        $securityIdentities = array();
+
+        if ($userOption) {
+            foreach ($userOption as $user) {
+                $data = explode(':', $user, 2);
+
+                if (count($data) === 1) {
+                    throw new \InvalidArgumentException('The user must follow the format "Acme/MyUser:username".');
+                }
+
+                $securityIdentities[] = new UserSecurityIdentity($data[1], strtr($data[0], '/', '\\'));
+            }
+        }
+
+        if ($roleOption) {
+            foreach ($roleOption as $role) {
+                $securityIdentities[] = new RoleSecurityIdentity($role);
+            }
+        }
+
+        /** @var $container \Symfony\Component\DependencyInjection\ContainerInterface */
+        $container = $this->getContainer();
+        /** @var $aclProvider MutableAclProviderInterface */
+        $aclProvider = $container->get('security.acl.provider');
+
+        // Sets ACL
+        foreach ($objectIdentities as $objectIdentity) {
+            // Creates a new ACL if it does not already exist
+            try {
+                $aclProvider->createAcl($objectIdentity);
+            } catch (AclAlreadyExistsException $e) {
+            }
+
+            $acl = $aclProvider->findAcl($objectIdentity, $securityIdentities);
+
+            foreach ($securityIdentities as $securityIdentity) {
+                if ($classScopeOption) {
+                    $acl->insertClassAce($securityIdentity, $mask);
+                } else {
+                    $acl->insertObjectAce($securityIdentity, $mask);
+                }
+            }
+
+            $aclProvider->updateAcl($acl);
+        }
+    }
+
+    /**
+     * Gets the mask builder.
+     *
+     * @return MaskBuilder
+     */
+    protected function getMaskBuilder()
+    {
+        return new MaskBuilder();
+    }
+}

vendor/symfony/security-bundle/Command/UserPasswordEncoderCommand.php

@@ -0,0 +1,169 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bundle\SecurityBundle\Command;
+
+use Symfony\Bundle\FrameworkBundle\Command\ContainerAwareCommand;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\Question;
+use Symfony\Component\Console\Style\SymfonyStyle;
+use Symfony\Component\Security\Core\Encoder\BCryptPasswordEncoder;
+
+/**
+ * Encode a user's password.
+ *
+ * @author Sarah Khalil <mkhalil.sarah@gmail.com>
+ */
+class UserPasswordEncoderCommand extends ContainerAwareCommand
+{
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        $this
+            ->setName('security:encode-password')
+            ->setDescription('Encodes a password.')
+            ->addArgument('password', InputArgument::OPTIONAL, 'The plain password to encode.')
+            ->addArgument('user-class', InputArgument::OPTIONAL, 'The User entity class path associated with the encoder used to encode the password.', 'Symfony\Component\Security\Core\User\User')
+            ->addOption('empty-salt', null, InputOption::VALUE_NONE, 'Do not generate a salt or let the encoder generate one.')
+            ->setHelp(<<<EOF
+
+The <info>%command.name%</info> command encodes passwords according to your
+security configuration. This command is mainly used to generate passwords for
+the <comment>in_memory</comment> user provider type and for changing passwords
+in the database while developing the application.
+
+Suppose that you have the following security configuration in your application:
+
+<comment>
+# app/config/security.yml
+security:
+    encoders:
+        Symfony\Component\Security\Core\User\User: plaintext
+        AppBundle\Entity\User: bcrypt
+</comment>
+
+If you execute the command non-interactively, the default Symfony User class
+is used and a random salt is generated to encode the password:
+
+  <info>php %command.full_name% --no-interaction [password]</info>
+
+Pass the full user class path as the second argument to encode passwords for
+your own entities:
+
+  <info>php %command.full_name% --no-interaction [password] AppBundle\Entity\User</info>
+
+Executing the command interactively allows you to generate a random salt for
+encoding the password:
+
+  <info>php %command.full_name% [password] AppBundle\Entity\User</info>
+
+In case your encoder doesn't require a salt, add the <comment>empty-salt</comment> option:
+
+  <info>php %command.full_name% --empty-salt [password] AppBundle\Entity\User</info>
+
+EOF
+            )
+        ;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $input->isInteractive() ? $io->title('Symfony Password Encoder Utility') : $io->newLine();
+
+        $password = $input->getArgument('password');
+        $userClass = $input->getArgument('user-class');
+        $emptySalt = $input->getOption('empty-salt');
+
+        $encoder = $this->getContainer()->get('security.encoder_factory')->getEncoder($userClass);
+        $bcryptWithoutEmptySalt = !$emptySalt && $encoder instanceof BCryptPasswordEncoder;
+
+        if ($bcryptWithoutEmptySalt) {
+            $emptySalt = true;
+        }
+
+        if (!$password) {
+            if (!$input->isInteractive()) {
+                $io->error('The password must not be empty.');
+
+                return 1;
+            }
+            $passwordQuestion = $this->createPasswordQuestion();
+            $password = $io->askQuestion($passwordQuestion);
+        }
+
+        $salt = null;
+
+        if ($input->isInteractive() && !$emptySalt) {
+            $emptySalt = true;
+
+            $io->note('The command will take care of generating a salt for you. Be aware that some encoders advise to let them generate their own salt. If you\'re using one of those encoders, please answer \'no\' to the question below. '.PHP_EOL.'Provide the \'empty-salt\' option in order to let the encoder handle the generation itself.');
+
+            if ($io->confirm('Confirm salt generation ?')) {
+                $salt = $this->generateSalt();
+                $emptySalt = false;
+            }
+        } elseif (!$emptySalt) {
+            $salt = $this->generateSalt();
+        }
+
+        $encodedPassword = $encoder->encodePassword($password, $salt);
+
+        $rows = array(
+            array('Encoder used', get_class($encoder)),
+            array('Encoded password', $encodedPassword),
+        );
+        if (!$emptySalt) {
+            $rows[] = array('Generated salt', $salt);
+        }
+        $io->table(array('Key', 'Value'), $rows);
+
+        if (!$emptySalt) {
+            $io->note(sprintf('Make sure that your salt storage field fits the salt length: %s chars', strlen($salt)));
+        } elseif ($bcryptWithoutEmptySalt) {
+            $io->note('Bcrypt encoder used: the encoder generated its own built-in salt.');
+        }
+
+        $io->success('Password encoding succeeded');
+    }
+
+    /**
+     * Create the password question to ask the user for the password to be encoded.
+     *
+     * @return Question
+     */
+    private function createPasswordQuestion()
+    {
+        $passwordQuestion = new Question('Type in your password to be encoded');
+
+        return $passwordQuestion->setValidator(function ($value) {
+            if ('' === trim($value)) {
+                throw new \Exception('The password must not be empty.');
+            }
+
+            return $value;
+        })->setHidden(true)->setMaxAttempts(20);
+    }
+
+    private function generateSalt()
+    {
+        return base64_encode(random_bytes(30));
+    }
+}