A Great Place to Hide Things! The data- Attributes

Hey Alessandro,

This sounds like you have a different problem not related to the function you're going to create. Please, double check your syntax, usually PhpStorm gives you hints about syntax errors and show the affected line. If you still need help - please, share the exact error, otherwise it's difficult to guess what's the problem exactly :)

Cheers!

Hey Yurniel L.

How did you generate the delete URL? You are hitting /deleteUrl instead of /reps/{ID-of-the-rep}

Cheers!

Hey Greg!

Sure thing :). So, denyAccessUnlessGranted - and really, any way that you check security, including is_granted in Twig and even the roles you list for each access_control in security.yml - they all, ultimately call the isGranted() method on the security.authorization_checker service (this service was called security.context before 2.8). In other words, whatever you can pass to denyAccessUnlessGranted is the same thing you can pass in any of these other situations.

Now, at first, the security system really only supports passing one type of thing to these functions: roles (e.g. anything starting with ROLE_). I'm guessing that makes good sense to you :). But, the security system also supports passing three other special things: IS_AUTHENTICATED_ANONYMOUSLY, IS_AUTHENTICATED_REMEMBERED and IS_AUTHENTICATED_FULLY. These strings correspond to the level of authentication of the user - e.g. "are they logged in?" or "are they logged in via a remember me cookie only?". We actually explain this best in an older Symfony 2 tutorial: https://knpuniversity.com/screencast/symfony2-ep2/twig-security-is-authenticated.

So, that's the basic answer: all security functions ultimately call the same core function, and that function supports ROLE_ stuff and these 3 ISAUTHENTICATED items as well. But, to go deeper, the real answer is voters :). https://knpuniversity.com/screencast/new-in-symfony3/voter. Symfony's core comes with 2 (this is not 100% true, but just pretend it is) voters: one that handles ROLE_ items and one that handles ISAUTHENTICATED. So actually, you can pass ANYTHING you want to denyAccessUnlessGranted (or the other functions), as long as you create a new voter that can handle that string.

That was probably more info than you wanted - I hope some of it was what you were looking for :).

Cheers!

Hello Ryan,

so I assume that in this case I have to write a special Voter so that nobody else than the creator himself can delete his own RepRow post?

Otherwhise, even with IS_AUTHENTICATED_REMEMBERED everybody else, who is logged in can delete his post?Am I right?
Thank you :)

Hey Chris!

That's correct, you need to write your own Voter that checks if the user is the owner of that post. Checking for "IS_AUTHENTICATED_***" only tells you if the user is logged in via a form, cookie or anonymous

Have a nice day :)

Yo Ivan!

Hahaha - actually, this is our fault! When I originally wrote the code for this line, I was using this. And so, putting it before the AJAX callback was important - since this is replaced. But, with the final code, we're not using this, so it is actually not important where this code lives. My mistake for not catching that! Thanks for bringing it up!

Cheers!