From 9ad9dafbd373c8d1214345242298e86c79244462 Mon Sep 17 00:00:00 2001 From: Ryan Weaver Date: Mon, 25 May 2015 19:11:29 -0400 Subject: [PATCH] Additional little check to show how we're assumign the User object is the User entity --- cookbook/security/voters.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/cookbook/security/voters.rst b/cookbook/security/voters.rst index e0d5c3868c2..8b1ab715e11 100644 --- a/cookbook/security/voters.rst +++ b/cookbook/security/voters.rst @@ -77,6 +77,7 @@ edit a particular object. Here's an example implementation:: // src/AppBundle/Security/Authorization/Voter/PostVoter.php namespace AppBundle\Security\Authorization\Voter; + use AppBundle\Entity\User; use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\User\UserInterface; @@ -133,6 +134,13 @@ edit a particular object. Here's an example implementation:: return VoterInterface::ACCESS_DENIED; } + // double-check that the User object is the expected entity. + // It always will be, unless there is some misconfiguration of the + // security system. + if (!$user instanceof User) { + throw new \LogicException('The user is somehow not our User class!'); + } + switch($attribute) { case self::VIEW: // the data object could have for example a method isPrivate()