Error or bug with Symfony User updating roles

0
votes

This time I got a curious bug in my project managing the roles from a user.

I got installed the EasyAdmin bundle where I can manage the roles from the users. So I log with a user that have access to the EasyAdmin (ROLE_ADMIN in this case). Beside of this role I have also a few roles more, one of them, called ROLE_SUPERSUSER, where a user can edit 2 fields that the rest of users don't have the permission to edit them.

So throw the EasyAdmin, I remove the ROLE_SUPERSUSER from myself and here comes the gest of the matter. If I try to access to the edit zone from the profile if you have this ROLE_SUPERSUSER you will be able to edit this field, but because I removed it this role from myself, I expect to don't watch this fields over there. Instead of this, an error appears in the screen.

If I just logout and log in again the problem it's solved. But obviously I can't force the users to logout and login when I change their roles.

enter image description here

I guess the problem comes throw the cache but I don't find a solution.

2
symfonycaching

2 Answers

0
votes

Symfony roles are added on authentication by default, so you would have to re-login for this change to take effect.

You can change this in security.yml.

security:
    always_authenticate_before_granting: true
0
votes

I could find a solution thanks to KNPUniversity.

The solution pass throw the creation of a listener who updates the user before each controller.

I got the ideas from these links:

https://github.com/symfony/symfony/pull/24331

With special attention to this link:

https://github.com/symfony/symfony/issues/12025#issuecomment-219723819