From 796a87d1c4cd5f9cad880d6d499d2a64f21af44a Mon Sep 17 00:00:00 2001 From: Mike Agbelou Date: Thu, 16 Jul 2026 22:49:59 +0200 Subject: [PATCH 1/3] security(user): restrict user management access to administrators only - Restrict all user management paths (^/users) in app/config/security.yml access_control. - Add denyAccessUnlessGranted('ROLE_ADMIN') checks in all UserController actions for defense in depth. - Ensure only users holding administrative privileges can access user list, creation, and edition. --- app/config/security.yml | 3 +- src/AppBundle/Controller/UserController.php | 40 ++++++++++++++++++--- 2 files changed, 38 insertions(+), 5 deletions(-) diff --git a/app/config/security.yml b/app/config/security.yml index acac108..31cacab 100644 --- a/app/config/security.yml +++ b/app/config/security.yml @@ -27,6 +27,7 @@ security: access_control: - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY } - - { path: ^/users, roles: IS_AUTHENTICATED_ANONYMOUSLY } + # Protect all user management paths (list, create, edit) + - { path: ^/users, roles: ROLE_ADMIN } - { path: ^/, roles: ROLE_ADMIN } - { path: ^/, roles: ROLE_USER } diff --git a/src/AppBundle/Controller/UserController.php b/src/AppBundle/Controller/UserController.php index 6698c13..6bfaac7 100644 --- a/src/AppBundle/Controller/UserController.php +++ b/src/AppBundle/Controller/UserController.php @@ -4,34 +4,57 @@ use AppBundle\Entity\User; use AppBundle\Form\UserType; -use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Component\HttpFoundation\Request; +use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; +/** + * Class UserController + * + * Manages administrative user operations including list viewing, creation, and updating. + * Access to this entire controller is restricted strictly to users with ROLE_ADMIN. + * + * @package AppBundle\Controller + */ class UserController extends Controller { /** + * Display the list of all registered users. + * * @Route("/users", name="user_list") + * + * @return \Symfony\Component\HttpFoundation\Response */ public function listAction() { + // Restrict access to administrative users only + $this->denyAccessUnlessGranted('ROLE_ADMIN'); + return $this->render('user/list.html.twig', [ 'users' => $this->getDoctrine()->getRepository('AppBundle:User')->findAll() ]); } /** + * Create and store a new user. + * * @Route("/users/create", name="user_create") + * + * @param Request $request + * @return \Symfony\Component\HttpFoundation\Response */ public function createAction(Request $request) { + // Restrict access to administrative users only + $this->denyAccessUnlessGranted('ROLE_ADMIN'); + $user = new User(); $form = $this->createForm(UserType::class, $user); $form->handleRequest($request); // Check if the form is submitted and valid before processing - if ($form->isSubmitted() && $form->isValid()) { + if ($form->isSubmitted() === true && $form->isValid() === true) { $em = $this->getDoctrine()->getManager(); // Encode the plain text password provided in the form @@ -50,10 +73,19 @@ public function createAction(Request $request) } /** + * Edit an existing user's profile and roles. + * * @Route("/users/{id}/edit", name="user_edit") + * + * @param User $user + * @param Request $request + * @return \Symfony\Component\HttpFoundation\Response */ public function editAction(User $user, Request $request) { + // Restrict access to administrative users only + $this->denyAccessUnlessGranted('ROLE_ADMIN'); + // Store the existing hashed password in case the password field is left blank $oldPassword = $user->getPassword(); @@ -61,10 +93,10 @@ public function editAction(User $user, Request $request) $form->handleRequest($request); // Check if the form is submitted and valid before processing - if ($form->isSubmitted() && $form->isValid()) { + if ($form->isSubmitted() === true && $form->isValid() === true) { // Check if a new password has been filled in the form - if (!empty($user->getPassword())) { + if (empty($user->getPassword()) === false) { // Encode and set the new password $password = $this->get('security.password_encoder')->encodePassword($user, $user->getPassword()); $user->setPassword($password); From 20ee5d7f08b67d573ad95f3e3f4fa8eb2ab1339c Mon Sep 17 00:00:00 2001 From: Mike Agbelou Date: Thu, 16 Jul 2026 22:54:28 +0200 Subject: [PATCH 2/3] style(nav): conditionally hide user management link in navigation template - Wrap the Gestion des utilisateurs button with a Twig is_granted('ROLE_ADMIN') is same as(true) condition. - Prevent non-admin users from seeing or clicking the administration entry point. --- app/Resources/views/base.html.twig | 78 ++++++++++++++++-------------- 1 file changed, 42 insertions(+), 36 deletions(-) diff --git a/app/Resources/views/base.html.twig b/app/Resources/views/base.html.twig index d4c20e6..78e0698 100644 --- a/app/Resources/views/base.html.twig +++ b/app/Resources/views/base.html.twig @@ -1,75 +1,83 @@ - - - To Do List app - + + To Do List app + - - - - - + + + - - -