0

I have been working through How to Dynamically Modify Forms Using Form Events tutorial in the Symfony documentation with the aim of building superuser pages for a sport club website. To give some perspective:

  • The site has two pages that both the user and superuser can edit: "Parent details", "Student details"

  • The site has two pages that the user can view and the superuser can edit: "Payments" and "Competition results"

  • The superuser has access to a few extra fields in the database that are hidden from normal users (eg text comments on payment status and notes on parents/students)

I am trying to put together the superuser pages with a select box in the navbar across each page so that the superuser can select a regular user of whichever page they are and quickly switch between users that they want to simulate and make updates to.

However I wanted to check if this is the correct way to go about it or if I'm going about it the wrong way (eg I'm now wondering if I should some how be managing this this through session management and FOSUserBundle?)

Update: Just for the sake of clarity...

...When the superuser is 'simulating' a regular user, the select boxes/options in the menu should still only return the values related to that user (eg, the names of their child/children in the club and their schedule for each sport they attend)

6
  • Add the php tag as well
    – Venkat.R
    Dec 31, 2015 at 17:14
  • Are you talking about impersonating an user? symfony.com/doc/current/cookbook/security/…
    – Cerad
    Dec 31, 2015 at 17:50
  • Thanks @Cerad - that looks perfect...I'm glad I asked now :) I just tried adding switch_user: true to my main firewall in security.yml but when I try to load a route (such as http://localhost:8000/students?_switch_user=parentusername1) I just get returned Access denied, the user is neither anonymous, nor remember-me.`. Do you know what the problem could be still?
    – Bendy
    Dec 31, 2015 at 18:11
  • Not really. Of course you need the switch user role added and to logout and then back in again. Otherwise, all I can suggest is to follow the example carefully.
    – Cerad
    Dec 31, 2015 at 19:22
  • 1
    I use it in production all the time. Often to help troubleshoot problems that an individual user might have. I am not a security expert but I do know that the security component has been formally audited.
    – Cerad
    Jan 1, 2016 at 21:54

1 Answer 1

0

Better approach to create ACL in Symfony 3 Doc. http://symfony.com/doc/current/cookbook/security/acl.html

Refer this for Symfony 2 Answer:
Symfony2: Storing users, roles, role hierarchy, and access controls in database

ACL Sample GitHub Repos:
https://github.com/GoDisco/AclTreeBundle
https://github.com/wemakecustom/symfony-acl-bundle

2
  • Thanks @Venkatraman - that looks very interesting...I'll definitely take time to read through it properly but as it says in the page itself "...it may be overkill..." for the small use case I have
    – Bendy
    Dec 31, 2015 at 18:14
  • @Bendy, Added Repos for you to jump quickly to ACL
    – Venkat.R
    Dec 31, 2015 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.