src/EventSubscriber/FirewallSubscriber.php line 66

Open in your IDE?
  1. <?php
  2. /**
  3.  * Created by PhpStorm.
  4.  * User: sbrun
  5.  * Date: 2018-03-19
  6.  * Time: 14:03
  7.  */
  8. namespace App\EventSubscriber;
  9. use App\Entity\Log;
  10. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  11. use Symfony\Component\HttpFoundation\Request;
  12. use Symfony\Component\HttpFoundation\RequestStack;
  13. use Symfony\Component\HttpKernel\Event\RequestEvent;
  14. use Symfony\Component\HttpKernel\Exception\HttpException;
  15. use Symfony\Component\HttpKernel\KernelEvents;
  16. use Symfony\Component\Routing\Matcher\RequestMatcherInterface;
  17. use Symfony\Component\Routing\RouterInterface;
  18. use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
  19. /*use Symfony\Component\Translation\TranslatorInterface;*/
  20. use Doctrine\ORM\EntityManagerInterface;
  21. use Symfony\Component\DependencyInjection\ContainerInterface;
  22. use Symfony\Contracts\Translation\TranslatorInterface;
  23. /**
  24.  * Subscribes to the KernelEvents::REQUEST events :
  25.  * So it can check for brute force attacks
  26.  * Class FirewallSubscriber
  27.  * @package App\EventSubscriber
  28.  */
  29. class FirewallSubscriber implements EventSubscriberInterface
  30. {
  31.     private $request;
  32.     private $router;
  33.     private $entityManager;
  34.     private $authenticationUtils;
  35.     private $translator;
  36.     private $timeout;
  37.     private $max_login;
  38.     public function __construct(ContainerInterface $containerTranslatorInterface $translatorEntityManagerInterface $entityManagerAuthenticationUtils $authenticationUtilsRequestStack $requestStackRouterInterface $router)
  39.     {
  40.         $this->request $requestStack->getCurrentRequest();
  41.         $this->router $router;
  42.         $this->entityManager $entityManager;
  43.         $this->authenticationUtils $authenticationUtils;
  44.         $this->translator $translator;
  45.         $this->timeout $container->getParameter('bruteforce_timeout');
  46.         $this->max_login $container->getParameter('bruteforce_max_login');
  47.     }
  48.     public static function getSubscribedEvents()
  49.     {
  50.         return [
  51.             KernelEvents::REQUEST => ['beforeFirewall'10]
  52.         ];
  53.     }
  54.     /**
  55.      * Check if there are too many connexion failures from the same ip within a defined time
  56.      * Only when on fos_user_security_check route and a POST request
  57.      *
  58.      * @param RequestEvent $event
  59.      */
  60.     public function beforeFirewall(RequestEvent $event)
  61.     {
  62.         $request $event->getRequest();
  63.         if ($request->isMethod(Request::METHOD_POST)) {
  64.             $routeInfos $this->router->matchRequest($request);
  65.             if (isset($routeInfos['_route']) && $routeInfos['_route'] === 'fos_user_security_check') {
  66.                 $username $this->authenticationUtils->getLastUsername();
  67.                 if ($this->entityManager->getRepository(Log::class)->checkBruteForce($username$this->max_login$this->timeout)) {
  68.                     $minutes date("i"$this->timeout);
  69.                     throw new HttpException(
  70.                         429,
  71.                         $this->translator->transChoice(
  72.                             'too.many.failed.authentication',
  73.                             $minutes,
  74.                             ['%minutes%'=>$minutes],
  75.                             'security'
  76.                         )
  77.                     );
  78.                 }
  79.             }
  80.         }
  81.     }
  82. }