Search code examples
phpsecuritysymfonyobjectsymfony-security

Warning: get_class() expects parameter 1 to be object, string given


I am using a vote with symfony to deal with user access on my site. When the user is not authenticated I get the error :

Warning: get_class() expects parameter 1 to be object, string given

when the user is accessing a page where a voter is called. The code in the voter trigerring the issue is :

public function vote(TokenInterface $token, $object, array $attributes)
{
if (!$object || !$this->supportsClass(get_class($object))) {
    return self::ACCESS_ABSTAIN;
}
...}

when the object = 'anon.' and this is the regular code taken from symfony website. I can of course modify this code to check for wether the object is an object or not but I was wondering if this was normal? I would have hopped that a voter would not be called on a non object.

EDIT: SuportsClass and SupportsAttribute are also the default ones:

protected function getSupportedClasses()
{
    return array(
        'AppBundle\Entity\User\Associate',
    );
}

protected function getSupportedAttributes()
{
    return array(self::SELECT_ASSOCIATES, self::GRANT_RIGHTS, self::REMOVE_RIGHT, self::DISPLAY_RIGHTS);
}

Solution

  • When a user isn't logged in, but the access control allows anonymous users, the user is a string "anon." instead of a UserInterface instance.

    You should put a check into supportsClass (e.g. return is_object($objec);).