安全

# app/config/security.yml
security:
    encoders:
        AppBundle\Entity\User: bcrypt

    providers:
        database_users:
            entity: { class: AppBundle:User, property: username }

    firewalls:
        secured_area:
            pattern: ^/
            anonymous: true
            form_login:
                check_path: login
                login_path: login

            logout:
                path: security_logout
                target: homepage
 
# ... access_control exists, but is not shown here

use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
// ...
 
/**
 * Displays a form to create a new Post entity.
 * 显示用于创建Post entity的表单
 * 
 * @Route("/new", name="admin_post_new")
 * @Security("has_role('ROLE_ADMIN')")
 */
public function newAction()
{
    // ...
}

use AppBundle\Entity\Post;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 
/**
 * @Route("/{id}/edit", name="admin_post_edit")
 * @Security("user.getEmail() == post.getAuthorEmail()")
 */
public function editAction(Post $post)
{
    // ...
}

{% if app.user and app.user.email == post.authorEmail %}
    <a href=""> ... </a>
{% endif %}

// src/AppBundle/Entity/Post.php
// ...
 
class Post
{
    // ...
 
    /**
     * Is the given User the author of this Post?
     * 当前用户是否是贴子作者？
     *
     * @return bool
     */
    public function isAuthor(User $user = null)
    {
        return $user && $user->getEmail() == $this->getAuthorEmail();
    }
}

use AppBundle\Entity\Post;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 
/**
 * @Route("/{id}/edit", name="admin_post_edit")
 * @Security("post.isAuthor(user)")
 */
public function editAction(Post $post)
{
    // ...
}

{% if post.isAuthor(app.user) %}
    <a href=""> ... </a>
{% endif %}

/**
 * @Route("/{id}/edit", name="admin_post_edit")
 */
public function editAction($id)
{
    $post = $this->getDoctrine()->getRepository('AppBundle:Post')
        ->find($id);
 
    if (!$post) {
        throw $this->createNotFoundException();
    }
 
    if (!$post->isAuthor($this->getUser())) {
        $this->denyAccessUnlessGranted('edit', $post);
 
        // or without the shortcut（或者不使用快捷写法）:
        //
        // use Symfony\Component\Security\Core\Exception\AccessDeniedException;
        // ...
        //
        // if (!$this->get('security.authorization_checker')->isGranted('edit', $post)) {
        //    throw $this->createAccessDeniedException();
        // }
    }
 
    // ...
}

namespace AppBundle\Security;
 
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\User\UserInterface;
use AppBundle\Entity\Post;
 
class PostVoter extends Voter
{
    const CREATE = 'create';
    const EDIT   = 'edit';
 
    /**
     * @var AccessDecisionManagerInterface
     */
    private $decisionManager;
 
    public function __construct(AccessDecisionManagerInterface $decisionManager)
    {
        $this->decisionManager = $decisionManager;
    }
 
    protected function supports($attribute, $subject)
    {
        if (!in_array($attribute, array(self::CREATE, self::EDIT))) {
            return false;
        }
 
        if (!$subject instanceof Post) {
            return false;
        }
 
        return true;
    }
 
    protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
    {
        $user = $token->getUser();
        /** @var Post */
        $post = $subject; // $subject must be a Post instance, thanks to the supports method
 
        if (!$user instanceof UserInterface) {
            return false;
        }
 
        switch ($attribute) {
            case self::CREATE:
                // if the user is an admin, allow them to create new posts
                // 如果用户是admin，允许创建新贴
                if ($this->decisionManager->decide($token, array('ROLE_ADMIN'))) {
                    return true;
                }
 
                break;
            case self::EDIT:
                // if the user is the author of the post, allow them to edit the posts
                // 如果用户是贴子作者，允许编辑贴子
                if ($user->getEmail() === $post->getAuthorEmail()) {
                    return true;
                }
 
                break;
        }
 
        return false;
    }
}

# app/config/services.yml
services:
    # ...
    post_voter:
        class:      AppBundle\Security\PostVoter
        arguments: ['@security.access.decision_manager']
        public:     false
        tags:
           - { name: security.voter }

/**
 * @Route("/{id}/edit", name="admin_post_edit")
 * @Security("is_granted('edit', post)")
 */
public function editAction(Post $post)
{
    // ...
}

/**
 * @Route("/{id}/edit", name="admin_post_edit")
 */
public function editAction($id)
{
    $post = ...; // query for the post
 
    $this->denyAccessUnlessGranted('edit', $post);
 
    // or without the shortcut（不使用快捷方法时的代码如下）:
    //
    // use Symfony\Component\Security\Core\Exception\AccessDeniedException;
    // ...
    //
    // if (!$this->get('security.authorization_checker')->isGranted('edit', $post)) {
    //    throw $this->createAccessDeniedException();
    // }
}