Symfony 4 Form handling

Question

I am not quite sure how symfony is providing the possibility of different forms for different users/views.

For my understanding you have the action:

public function new(Request $request): Response
{
    $order = new Orders();
    $form = $this->createForm(OrdersType::class, $order);
    $form->handleRequest($request);

    if ($form->isSubmitted() && $form->isValid()) {
        $em = $this->getDoctrine()->getManager();
        $em->persist($order);
        $em->flush();

        return $this->redirectToRoute('orders_index');
    }

    return $this->render('orders/new.html.twig', [
        'order' => $order,
        'form' => $form->createView(),
    ]);
}

Which is generating the form with the, in this case OrdersType. And then the view gets loaded in the new.html.twig file. But some users only are allowed on the action "add" which should not show the option of calculated price or what ever.

How do I do that?

Gulvar · Accepted Answer · 2018-11-23 19:38:30Z

The solution depends of the structure of your application.

If the calculation price is in the new.html.twig you can use another file for users with limited access.

In the example below "ROLE_RESTRICTED" is the role of users allowed only to add and not to see the price.

For example :

public function new(Request $request): Response
{
    $logged_user    = $this->get('security.token_storage')->getToken()->getUser();
    $order = new Orders();

    $form = $this->createForm(OrdersType::class, $order);
    $form->handleRequest($request);

    if ($form->isSubmitted() && $form->isValid()) {
        $em = $this->getDoctrine()->getManager();
        $em->persist($order);
        $em->flush();

        return $this->redirectToRoute('orders_index');
    }

   if($logged_user->hasRole('ROLE_RESTRICTED')){
       $view = 'orders/newRestricted.html.twig'
   }else{
       $view = 'orders/new.html.twig';
   }

    return $this->render($view , [
        'order' => $order,
        'form' => $form->createView(),
    ]);
}

If the difference are small between new.html.twig and newRestricter.html.twig you can keep only one twig file and just make some conditional zones :

 {% if not app.user.hasRole('ROLE_RESTRICTED') %}
     <a href="{{path('edit_order')}}">Edit an order</a>
 {% else %}

Do not forget to secure the route corresponding to avoir direct URL access (in controller) :

public function edit($id)
{

     $logged_user   = $this->get('security.token_storage')->getToken()->getUser();
     if($logged_user->has_role('ROLE_RESTRICTED')) {
            throw $this->createAccessDeniedException('Access denied');
     }

     // create form, return render, etc.

}

In fact you have to restrict access to the page or part of the views. You can find more details on the security section on the official doc : https://symfony.com/doc/current/security.html

Another solution would be to make the filter in the form builder :

use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;

class OrdersType extends AbstractType
{
private $tokenStorage;

public function __construct(TokenStorageInterface $tokenStorage)
{
    $this->tokenStorage = $tokenStorage;
}

public function buildForm(FormBuilderInterface $builder, array $options)
{
    $logged_user = $this->tokenStorage->getUser();
   if(!$logged_user->hasRole('ROLE_RESTRICTED')){
        $builder->add('MyField', TextType::class,array(
             'required'             => false
        ));
    }
 }
 ...

Hi Gulvar, but this way I am still using the same builder fields. I need to know how I can create two different builder types, otherwise I would have to create the whole form over and over again in the twig file.
I've added an example on how to user logged user role in form builder.

Collectives™ on Stack Overflow

Symfony 4 Form handling

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related