Custom annotation conflict with #secure from jms/SecurityExtraBundle - php

Question

I have writted an annotation who throw an AccesDeniedException when the action is not called by an AJAX request (XMLHttpRequest).
It work but when I want to use the #Secure(roles="A") annotation from JMS/SecurityExtraBundle it don't work like I omitted my custom exception.
Controller
namespace Mendrock\Bundle\SagaBundle\Controller;
use JMS\SecurityExtraBundle\Annotation\Secure;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Template;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method;
use Mendrock\Bundle\SagaBundle\Entity\Saison;
use Mendrock\Bundle\SagaBundle\Form\SaisonType;
use Mendrock\Bundle\ExtraBundle\Annotation\XmlHttpRequest;
/**
* #Route("/episodesAjax")
*/
class EpisodeController extends Controller {
/**
* #XmlHttpRequest()
* #Secure(roles="ROLE_SUPER_ADMIN")
*
* #Route("/saisonAdd", options={"expose"=true})
* #Template()
*/
public function saisonAddAction() {
$entity = new Saison();
$form = $this->createForm(new SaisonType(), $entity);
return array(
'entity' => $entity,
'form' => $form->createView(),
);
}
Annotation
namespace Mendrock\Bundle\ExtraBundle\Annotation;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
/**
* #Annotation
*/
class XmlHttpRequest
{
public $message = 'The action could be an XMLHttpRequest call.';
public function checkRequest($event){
if (!$event->getRequest()->isXmlHttpRequest()) {
throw new AccessDeniedHttpException($this->message);
}
}
public function execute($event){
$this->checkRequest($event);
}
}
Listener
namespace Mendrock\Bundle\ExtraBundle\Listener;
use Doctrine\Common\Annotations\Reader;
use Symfony\Component\HttpKernel\Event\FilterControllerEvent;
use Mendrock\Bundle\ExtraBundle\Annotation\XmlHttpRequest;
class EventListener {
private $reader;
public function __construct(Reader $reader) {
$this->reader = $reader;
}
/**
* This event will fire during any controller call
*/
public function onKernelController(FilterControllerEvent $event) {
if (!is_array($controller = $event->getController())) {
return;
}
$method = new \ReflectionMethod($controller[0], $controller[1]);
foreach ($this->reader->getMethodAnnotations($method) as $configuration) {
if ($configuration instanceof XmlHttpRequest) {
$configuration->execute($event);
}
}
}
}
Any idea why I can't use at the same time #Secure(...) and #XMLHttpRequest?
Edit:
services.yml
services:
annotations.xmlhttprequest:
class: Mendrock\Bundle\ExtraBundle\Listener\EventListener
tags: [{name: kernel.event_listener, event: kernel.controller, method: onKernelController}]
arguments: [#annotation_reader]

Answer 1

I ran into the same problem when I wanted to add my own annotations. The solution using ClassUtils::getUserClass would not work (using Symfony 2.3, if that makes a difference).
Since we only use the #Secure annotation from JMS\SecurityExtraBundle, I made our codebase use LswSecureControllerBundle instead.
This bundle only provides #Secure, and does not do voodoo tricks with your controllers.

Answer 2

I am running into the same issue after upgrading to Symfony 2.1.
The issue, from my investigation, is that the JMS SecurityExtraBundle generates proxy classes whenever you use one of their annotations. The problem with the generated proxy classes is that custom annotations do not get proxied over, which is why the annotations appear to be missing.
The solution according to the author is to rewrite using AOP (facilities provided by JMSAopBundle) or to use ClassUtils::getUserClass.

Answer 3

Thanks to suihock for pointing this out:
$class = \CG\Core\ClassUtils::getUserClass($controller[0]);
$method = new \ReflectionMethod($class, $controller[1]);