EasyAdminBundle icon indicating copy to clipboard operation
EasyAdminBundle copied to clipboard

EasyAdminBundle\Security\SecurityVoter::voteOnExecuteActionPermission is passing string to AuthorizationChecker

Open Geolim4 opened this issue 8 months ago • 1 comments

Describe the bug For a reason I ignore, when I set a specific permission on a CRUD action I get an exception when creating a new entity: Unable to call method "isPending" of non-object "object".

To Reproduce Set a CRUD permissions in configureActions(): `` ->setPermission(Action::SAVE_AND_RETURN, new Expression('object.isPending()')) ->setPermission(Action::SAVE_AND_CONTINUE, new Expression('object.isPending()')) ->setPermission(Action::EDIT, new Expression('object.isPending()'))

(My Object contain a "isPending()" method which allow modifying only objects with a certain status)

Go to the controller to create a new entity and you get the Exception cause by:

`\EasyCorp\Bundle\EasyAdminBundle\Security\SecurityVoter::voteOnExecuteActionPermission` which is called twice:

1. The first time ` $subject = $entityDto?->getInstance() ?? $entityFqcn;` return the Fqcn as a string (bug).
2. The second time it is an freshly instantiated entity (ok).

Since we cannot make any "type check" in Symfony Security expression, this prevent us of calling object method inside security expression :(


**(OPTIONAL) Additional context**
If they are useful, include logs, code samples, screenshots, etc.

Geolim4 avatar Apr 08 '25 18:04 Geolim4

Please note that this is a bug probably recently introduced as this feature was working well since a year I developed it.

The bug a been probably introduced with all the pretty urls related commits.

Geolim4 avatar Apr 08 '25 18:04 Geolim4