浏览代码

fix organization creation request security when no logged in user

Olivier Massot 1 年之前
父节点
当前提交
4ccf9b13a7

+ 0 - 1
src/ApiResources/Organization/OrganizationCreationRequest.php

@@ -19,7 +19,6 @@ use Symfony\Component\Validator\Constraints as Assert;
     operations: [
         new Post(
             uriTemplate: '/internal/organization/create',
-            security: 'user.getSuperAdminAccess()'
         ),
     ],
     processor: OrganizationCreationRequestProcessor::class

+ 5 - 1
src/Service/Security/InternalRequestsService.php

@@ -4,6 +4,7 @@ namespace App\Service\Security;
 
 use App\Entity\Access\Access;
 use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\User\UserInterface;
 
 /**
  * Identify and allow internal requests between api v1 and v2.
@@ -56,7 +57,10 @@ class InternalRequestsService
     {
         /** @var Access $user */
         $user = $this->security->getUser();
-        return $user && $user->getSuperAdminAccess();
+        if (!$user instanceof UserInterface) {
+            return false;
+        }
+        return $user->getSuperAdminAccess();
     }
 
     /**