How-to make sure in a Voter that a user has the right role in the Symfony role hierarchy.

first, two links. One to the Symfony 2 Voter’s documentation, and the second to the Access Decision Manager’s documentation.

We will see here, how to check if the current user has the right role in the roles’s hierarchy.

In a first time we have to add a service to the Voter declaration DI. We need to use the “security.access.role_hierarchy_voter” service.

Your declaration, must look like that.

<service id="security.voter.categorie" class="MyBundle\Security\Authorization\Voter\CategorieVoter" public="false">
   <argument type="service" id="security.access.role_hierarchy_voter" />
   <tag name="security.voter" />
</service>

In your Voter class you have to retrieve the service. We just need to add a new attribute, like the code below.

namespace MyBundle\Security\Authorization\Voter;

use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\User\UserInterface;

class CategorieVoter implements VoterInterface
{
    /**
     * @var \Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter
     */
    private $roleVoter;

    public function __construct($roleVoter)
    {
            $this->roleVoter = $roleVoter;
    }
//...
}

The use of this service is pretty easy.

if($this->roleVoter->vote($token, $token->getUser(), array('ROLE_USER')) === VoterInterface::ACCESS_GRANTED) {
      // The user has the right role
}

So, now, if the current user has the role ROLE_ADMIN, according to the hierarchy of roles, he has ROLE_USER to, so the voter method return a VoterInterface::ACCESS_GRANTED

Note : In this post, a proxy is a software running on a server. This software filter incoming and outgoing flow of the netwok to internet. And if a desktop want to go on the internet it must be configured for use this proxy server.

PHP behind a proxy server is just a pain in the ass to configure. It’s not possible to configure in one place the informations of proxy connection.

Some examples:
SoapClient, SoapServer, CURL take configuration information in its parameters.
Functions from the file_get_contents family can take configuration information in its parameters or have a global configuration through the application.
And the other, who take any configuration like exif_imagetype.

The question is, how to configure PHP for use a proxy server in a easy manner ?

Take a deep breath, and Allons-Y !

If you use Symfony2, you can use a really wonderful BehindAProxyBundle (yes I made it), and read the documentation.
In the other case you can use the code from the ProxyService.php.

What does the ProxyService Class?
This class centralizes the connection configuration options for some functions.
It is what it takes for SOAP connections, CURL, or stream context.

What for the function who can’t take configuration options ?

The palliative solution for this problem is to download the distant file in a temporary file on the server. Let me show you an example.

In the case below, we don’t use any external library.

function loadFileTemporarily($url) {

// Our stream Context
$context = array(
               'http' => array(
                   'proxy' => 'tcp://172.0.0.1:8080',
                   'request_fulluri' => true,
               )
           );
$cxContext = stream_context_create($context);

$tmpfile = file_get_contents($file, false , $cxContext);

              // Writing the retrieved content to a temporary file
           $tempStreamFile = tmpfile();
           fwrite($tempStreamFile, $tmpfile);
           fseek($tempStreamFile, 0);

    // Retrieving information in relation to this temporary file
    $streamMetadData = stream_get_meta_data($tempStreamFile);

    // We return the uri
           return $streamMetadData['uri'];
}

echo “<pre>”;
print_r(
exif_imagetype(
loadFileTemporarily( “http://lost.com//a-picture.jpg” )
)
);
echo “</pre>”;

I’ve used this type of code in a fork of ImageBundle made by Grewar.

How to configure the stream context in a global manner?

For the PHP’s functions who use stream context, it’s possible to define the proxy server connection options in a global manner.
For that we use the function stream_context_set_default. This function must be place in a configuration file. The same file where you write the database connection.

Below, an implementation example :

$context = array(
               'http' => array(
                   'proxy' => 'tcp://127.0.0.1:8080',
                   'request_fulluri' => true,
               )
           );
stream_context_set_default($context);