Symfony 2。 编辑个人资料时，会话无法正常工作

Question

When i logined in my site as role_user, and when i try to edit my profile i try to change my login as a something login in my DB, i see error - 'This login is already used', ok, but when i refresh my page i see that i authorization as new login, its not good

I have this form builder:

namespace User\WalletBundle\Form;

use Doctrine\ORM\EntityRepository;
use Symfony\Component\Form\AbstractType;
use Symfony\Component\Form\FormBuilderInterface;

class EditForm extends AbstractType {

    public function buildForm(FormBuilderInterface $builder, array $options) {
        $builder->add('username', null, array('attr' => array('placeholder' => 'Login')));
        $builder->add('email', 'email', array('attr' => array('placeholder' => 'E-mail')));
        $builder->add('mobile', 'number', array('attr' => array('placeholder' => 'Mobile','maxlength' => 10)));
        $builder->add('password', 'repeated', array(
            'type' => 'password',
            'invalid_message' => 'Пароли не совпадают',
            'options' => array('label'=>'','required' => false, 'always_empty' => false)));


        $builder->add('old_pass','password',array('attr' => array('placeholder' => 'Old pass')));

    }

    public function getName() {
        return 'edit_form';
    }

    public function getDefaultOptions(array $options) {
        return array(
            'data_class' => 'User\WalletBundle\Entity\User',
        );
    }

}

I think i don't know good how this system working (security), maybe i can read about my problem, please take a link. Very thanks

Very-very sorry about my english

In my controller, for test, i write this code

/**
     * @Secure(roles="ROLE_USER")
     * @Template("UserWalletBundle:Wallet:settings.html.twig")
     */
    public function settingsAction(Request $request) {
        $user_edit = $this->getDoctrine()->getRepository('UserWalletBundle:User')->findOneById($this->get('security.context')->getToken()->getUser()->getId());
        $form = $this->createForm(new EditForm(), $user_edit);
        if ($request->getMethod() == 'POST') {
            $form->bindRequest($request);
            // Now i have login Alice, and i want change my profile, set login Test, but Test is created some user in DB, ofcours i see error This login is already used
            if ($form->isValid()) {
            //Do anything
            } else {
            // There i see error This login is already used
                return array('form' => $form->createView());
            }
        } else
            return array('form' => $form->createView());
    }

And now i refresh my page and i see that i authorization as username (login) "Test", why and how i can solve this problem?

Answer 1

When you are retrive User entity at line

$user_edit = $this->getDoctrine()->getRepository('UserWalletBundle:User')->findOneById($this->get('security.context')->getToken()->getUser()->getId());

you will get your current authorized User entity.

So to edit you profile, you should use another User class. It should contains fields which you are edit. It should be used to work form with. And after success form validation and entityManager flush, you should change fields of current authorized user.

I'll try to explain, why is your problem happen. But my English is also not good.

I hope you know, that in php passes and returns objects by reference.

Doctrine implements IdentityMap pattern. Shortly, when you try get some data from DB, Doctrine put retrieved data in special array. Ie if you retrieve User from DB it will be added to this special array. So, when you will try to get it again, there will be no request to the DB, but data from array will be returned.

So, when you logged in, doctrine retrieved User from DB(for authorization) ant put it in array. Also Symfony's @security.context service use this instance of User. Now, at settingsAction, you try to get User again and doctrine returns it from array. After bind request, User model changed(in your case login field changed), and Symfony's @security.context also "knows" about these changes. Even form is invalid, post data was mapped to your User. That's why you see new login after page was refreshed. If you logout and login again, you will see your "old" login, because there was no flush to DB after bind.

I hope this will helps you.

ps I can explain it better in Russian :)