Symfony Security - 循环删除按钮

Question

I am wondering about the security of my application. I'm simply using twig loop to display all of my records in database. And everything is all right when I make separate site to display the details and there are buttons to e.g. delete this thing. It usually happens DELETE method and somebody can display only own details. But I want to have button to delete specific record in basic view where every records displayed e.g. next to title of item.

1. I cant do this by CreateFormBuilder because I cannot send the current id of the item from the form (or I just don't know how to do it). But is it secure? Everyone can change the id parameter of button and delete other record.

2. I can use AJAX and simply button in twig but this is the same case. Everyone can change e.g. data-id parameter in button and delete other record.

What I should to do in this situation? How you usually solve this problem?

Summarising I want to make a secure button to delete item next to each displayed record.

Have a nice day!

Answer 1

It really boils down to what kind of app you want to build:

• more traditional app - with full page refresh/navigation cycle
• AJAX based - with all sorts of async calls to your server

In any case you choose, it is your responsibility to check whether the current user is authorized to make any change (deletion included) to an object. This comes as especially important in case of id being integer, which is predictable.

So, first, make sure your routes are protected from anonymous users, and second, make sure that you put in place permission strategy which allows/denies user's specific action.

Most of the permission-related stuff can be achived via Voters, but if you are really in need of heavy-lifting you can turn to ACL.

Hope this helps...