Commit 8aa8def

authored

Restore eraseCredentials() for Symfony 7.3 compatibility and manually clear plainPassword after hashing (#2186)

1 parent 51be0a3 commit 8aa8defCopy full SHA for 8aa8def

File tree

+14

-0

lines changed

+14

-0

lines changed

Lines changed: 14 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -139,6 +139,17 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface`
`139`	`139`	`{`
`140`	`140`	`return (string) $this->email;`
`141`	`141`	`}`
	`142`	`+`
	`143`	`+ /**`
	`144`	`+ * @see UserInterface`
	`145`	`+ *`
	`146`	`+ * Required until Symfony 8.0, where eraseCredentials() will be removed from the interface.`
	`147`	`+ * No-op since plainPassword is cleared manually in the password processor.`
	`148`	`+ */`
	`149`	`+ public function eraseCredentials(): void`
	`150`	`+ {`
	`151`	`+ // Intentionally left blank`
	`152`	`+ }`
`142`	`153`	`}`
`143`	`154`	```
`144`	`155`
`@@ -251,6 +262,9 @@ final readonly class UserPasswordHasher implements ProcessorInterface`
`251`	`262`	`);`
`252`	`263`	`$data->setPassword($hashedPassword);`
`253`	`264`
	`265`	`+ // To avoid leaving sensitive data like the plain password in memory or logs, we manually clear it after hashing.`
	`266`	`+ $data->setPlainPassword(null);`
	`267`	`+`
`254`	`268`	`return $this->processor->process($data, $operation, $uriVariables, $context);`
`255`	`269`	`}`
`256`	`270`	`}`

Comments

(0)