Throws an UnauthorizedSiteAccessException if current user doesn't have permission to current SiteAccess.

@param BaseInteractiveLoginEvent $event

@throws \eZ\Publish\Core\MVC\Symfony\Security\Exception\UnauthorizedSiteAccessException
429150
public function checkSiteAccessPermission(BaseInteractiveLoginEvent $event)
    {
        $token = $event->getAuthenticationToken();
        $originalUser = $token->getUser();
        $request = $event->getRequest();
        $siteAccess = $request->attributes->get('siteaccess');
        if (!($originalUser instanceof eZUser && $siteAccess instanceof SiteAccess)) {
            return;
        }

        if (!$this->hasAccess($siteAccess, $originalUser->getUsername())) {
            throw new UnauthorizedSiteAccessException($siteAccess, $originalUser->getUsername());
        }
    }
202563
protected void handleLoginEvent(LoginEvent event)
    {
        ApplicationSessionInitializer asi = getApplicationSessionInitializer();
        if (asi != null)
        {
            asi.initializeUser();
            Map<String, Object> userAttributes = asi.getUserAttributes();
            if (userAttributes != null)
            {
                setUserAttributes(userAttributes);
            }
        }
        Authentication auth = (Authentication) event.getSource();
        propertyChangeSupport.firePropertyChange(USER, null, auth);
    }
1348944
public function onSitePreCreate(SiteEvent $event)
    {
        $site = $event->getSite();

        if (!empty($site->group_id)) {
            return; // Someone took care of this for us
        }

        $site->group_id = $this->findMostRelevantGroupId();
    }
1122788
public function onKernelException(GetResponseForExceptionEvent $event)
    {
        if ($event->getException() instanceof NotFoundHttpException && $this->cmsManagerSelector->isEditor()) {
            $pathInfo = $event->getRequest()->getPathInfo();

            // can only create a CMS page, so the '_route' must be null
            $creatable = !$event->getRequest()->get('_route') && $this->decoratorStrategy->isRouteUriDecorable($pathInfo);

            if ($creatable) {
                $response = new Response($this->templating->render('@SonataPage/Page/create.html.twig', [
                    'pathInfo' => $pathInfo,
                    'site' => $this->siteSelector->retrieve(),
                    'creatable' => $creatable,
                ]), 404);

                $event->setResponse($response);
                $event->stopPropagation();

                return;
            }
        }

        if ($event->getException() instanceof InternalErrorException) {
            $this->handleInternalError($event);
        } else {
            $this->handleNativeError($event);
        }
    }
594826
public function onKernelException(GetResponseForExceptionEvent $event)
    {
        $exception = $event->getException();
        do {
            if ($exception instanceof AuthenticationException) {
                return $this->handleAuthenticationException($event, $exception);
            } elseif ($exception instanceof AccessDeniedException) {
                return $this->handleAccessDeniedException($event, $exception);
            } elseif ($exception instanceof LogoutException) {
                return $this->handleLogoutException($exception);
            }
        } while (null !== $exception = $exception->getPrevious());
    }
937843
public function setKey(EventInterface $event) {
        $acl = $event->getAccessControl();

        if (!($acl instanceof MutableAdapterInterface)) {
            throw new ResourceException('Access control adapter is immutable', 405);
        }

        $request = $event->getRequest();
        $data = json_decode($request->getContent(), true);

        if (!isset($data['privateKey'])) {
            throw new InvalidArgumentException('No privateKey provided', 400);
        }

        $publicKey = $request->getRoute()->get('publickey');
        $privateKey = $data['privateKey'];

        $keyExists = $acl->publicKeyExists($publicKey);

        if ($keyExists) {
            $acl->updatePrivateKey($publicKey, $privateKey);
        } else {
            $acl->addKeyPair($publicKey, $privateKey);
        }

        $event->getResponse()->setStatusCode($keyExists ? 200 : 201);
    }
740125
def _handleAuthorizedEvents(self, component, action, data, user, client):
        """"""

        try:
            if component == "debugger":
                self.log(component, action, data, user, client, lvl=info)

            if not user and component in self.authorized_events.keys():
                self.log("Unknown client tried to do an authenticated "
                         "operation: %s",
                         component, action, data, user)
                return

            event = self.authorized_events[component][action]['event'](user, action, data, client)

            self.log('Authorized event roles:', event.roles, lvl=verbose)
            if not self._checkPermissions(user, event):
                result = {
                    'component': 'hfos.ui.clientmanager',
                    'action': 'Permission',
                    'data': _('You have no role that allows this action.', lang='de')
                }
                self.fireEvent(send(event.client.uuid, result))
                return

            self.log("Firing authorized event: ", component, action,
                     str(data)[:100], lvl=debug)
            # self.log("", (user, action, data, client), lvl=critical)
            self.fireEvent(event)
        except Exception as e:
            self.log("Critical error during authorized event handling:",
                     component, action, e,
                     type(e), lvl=critical, exc=True)
961101
public function auth(AuthEvent $event)
    {
        if (isset($this->logger)) {
            $operation = get_class($event);

            $connection = $event->getConnection();

            $message = "LDAP ({$connection->getHost()})"
                . " - Connection: {$connection->getName()}"
                . " - Operation: {$operation}"
                . " - Username: {$event->getUsername()}";

            $result = null;
            $type = 'info';

            if (is_a($event, Failed::class)) {
                $type = 'warning';
                $result = " - Reason: {$connection->getLastError()}";
            }
            
            $this->logger->$type($message.$result);
        }
    }
804814
public function onSitePostInit(SiteEvent $event)
    {
        // @todo Ugly... The best would be to not use drupal_valid_token()
        require_once DRUPAL_ROOT . '/includes/common.inc';

        $request      = $this->requestStack->getCurrentRequest();
        $pageContext  = $this->contextManager->getPageContext();
        $transContext = $this->contextManager->getSiteContext();
        $site         = $event->getSite();
        $token        = null;
        $matches      = [];

        // Column is nullable, so this is possible
        if ($siteHomeNid = $site->getHomeNodeId()) {
            if (($token = $request->get(ContextManager::PARAM_SITE_TOKEN)) && drupal_valid_token($token)) {
                $transContext->setToken($token);
            }
            $transContext->setCurrentLayoutNodeId($siteHomeNid, $site->getId());
        }

        // @todo $_GET['q']: cannot use Request::get() here since Drupal
        // alters the 'q' variable directly in the $_GET array
        if (preg_match('/^node\/([0-9]+)$/', $_GET['q'], $matches) === 1) {
            if (($token = $request->get(ContextManager::PARAM_PAGE_TOKEN)) && drupal_valid_token($token)) {
                $pageContext->setToken($token);
            }
            $pageContext->setCurrentLayoutNodeId((int)$matches[1], $site->getId());
        }

        if (($token = $request->get(ContextManager::PARAM_AJAX_TOKEN)) && drupal_valid_token($token) && ($region = $request->get('region'))) {
            if ($this->contextManager->isPageContextRegion($region, $site->theme)) {
                $pageContext->setToken($token);
            } else if ($this->contextManager->isTransversalContextRegion($region, $site->theme)) {
                $transContext->setToken($token);
            }
        }
    }
293604
public function authorize(ActionDispatchEvent $event)
    {
        $callable = $event->getCallable();

        if (!$callable->isMethod() && !$callable->isMethodStatic()) {
            // Native function or \Closure
            return;
        }

        $class = $callable->getReflection()->getDeclaringClass()->getName();
        $method = $callable->getReflection()->getName();
        $parameters = $event->getParameters();
        $action = $event->getAction();

        foreach ($action->getSecurityGroups() as $group) {
            $authorized = $this->authorizationChecker
                ->isGrantedMethodCall($class, $method, $parameters, [], $group);

            if (!$authorized) {
                throw new AccessDeniedException();
            }
        }
    }
374188
public function onKernelRequestAuthorize($event)
  {
    // This is basically the master firewall
    $requestRoles = $event->getRequest()->getAttribute('_roles');
    if (!$requestRoles) return;

    // Need a token
    $authToken = $event->getRequest()->getAttribute('authToken');
    if (!$authToken)
    {
      throw new AccessDeniedException();
    }
    $userRoles = $authToken->getRoles();

    if ($this->roleHierarchy->isAuthorized($requestRoles,$userRoles)) return;
    
    throw new AccessDeniedException();
  }
997300
public function handle(GetResponseEvent $event)
    {
        $request = $event->getRequest();
        if ($this->securityContext->getToken() instanceof TokenInterface && $this->securityContext->getToken()->isAuthenticated()) {
            return;
        }

        if (!($accessToken = $request->get('access_token'))) {
            throw new ClientAccessDeniedHttpException();
        }

        $token = $this->authenticationManager->authenticate(OAuth2Token::create($accessToken));
        $this->securityContext->setToken($token);
    }
1307214
public function onSecurityInteractiveLogin(InteractiveLoginEvent $event)
    {
        /*
         * Avoid OAuth Authorization attack as described at
         * http://software-security.sans.org/blog/2011/03/07/oauth-authorization-attacks-secure-implementation.
         */
        if ($this->session->has('_security.target_path')) {
            if (false !== strpos($this->session->get('_security.target_path'), $this->generateUrl('fos_oauth_server_authorize'))) {
                $this->session->set('_fos_oauth_server.ensure_logout', true);
            }
        }

    }
977097
public function onAuthenticationSuccess(AuthenticationEvent $event)
    {
        if (!$this->config['admin_login']) {
            return;
        }

        $token = $event->getAuthenticationToken();
        $userIsAdmin = $this->accessDecisionManager->decide($token, ['ROLE_ADMIN']);

        // Only for Admins and fully authenticated
        if (!($userIsAdmin && $token instanceof UsernamePasswordToken)) {
            return;
        }

        /** @var \Ekyna\Bundle\UserBundle\Model\UserInterface $user */
        $user = $token->getUser();

        $this->mailer->sendSuccessfulLoginEmailMessage($user);
    }
1304844
public function onKernelException(GetResponseForExceptionEvent $event) {

        $ex = $event->getException();

        // Handle the exception.
        if (true === ($ex instanceof BadUserRoleException)) {
            $this->handleBadUserRoleException($event, $ex);
        }
        if (true === ($ex instanceof RedirectResponseException)) {
            $this->handleRedirectResponseException($event, $ex);
        }

        return $event;
    }
212751
public function checkAccess(EventInterface $event) {
        if ($event->hasArgument('skipAccessControl') &&
            $event->getArgument('skipAccessControl') === true) {
            return;
        }

        $request = $event->getRequest();
        $aclAdapter = $event->getAccessControl();
        $resource = $event->getName();
        $publicKey = $request->getPublicKey();
        $user = $request->getUser();

        $hasAccess = $aclAdapter->hasAccess($publicKey, $resource, $user);

        if ($hasAccess) {
            return;
        }

        // If we're asking for info on a public key, and that public key happens to be the one
        // used to sign the request, accept this as a valid request and let the user have access
        // to the resource. Note that this requires the accessToken listener to be in place -
        // if disabled, any user can ask for the access rules for all public keys
        if (in_array($resource, $this->ownPublicKeyAllowedResources)) {
            $routePubKey = $request->getRoute()->get('publickey');
            if ($routePubKey === $publicKey) {
                return;
            }
        }

        // If a public key has access to resources within a resource group, allow the
        // public key to access the group resource to see which resources it contains
        if (in_array($resource, $this->groupLookupResources)) {
            $routeGroup = $request->getRoute()->get('group');
            $aclList = $aclAdapter->getAccessListForPublicKey($publicKey);

            foreach ($aclList as $aclRule) {
                if (isset($aclRule['groups']) && in_array($routeGroup, $aclRule['groups'])) {
                    return;
                }
            }
        }

        throw new RuntimeException('Permission denied (public key)', 400);
    }
244908
public function onPreAuthorizationProcess(OAuthEvent $event)
    {
        /* @var $client Client */
        if(null !== $client = $event->getClient())
        {
            if ($client->isPrivate())
            {
                $event->setAuthorizedClient(true);
            }
        }
    }