Important

You are browsing documentation for version 6.1 of OroCommerce, supported until 2029. Read the documentation for the latest LTS version to get up-to-date information.

See our Release Process documentation for more information on the currently supported and upcoming releases.

Access Control 

Symfony can filter URL patterns by user roles through an access_control list defined in the security configuration context. See Role Based Access Control In Symfony for details.

The order of this list matters, because Symfony returns the first entry for which the current request URL, method, ip, etc., matches.

Because bundles can extend this list, be aware of its final order.

For this reason, in Oro you must put the access_control rules in the oro_security context (in the same format), not in the security configuration extension.

Example:

# config/config.yaml
oro_security:
    access_control:
        - { path: ^%web_backend_prefix%/contact$, roles: ANY_ROLE }

By default, the final rule list is sorted in the following order:

  1. Application level configuration (config.yml, security.yml, etc.)

# config/config.yaml
oro_security:
    access_control:
        - { path: ^%web_backend_prefix%/contact$, roles: security_yml_ROLE }

  1. The list merged from vendor bundles in the bundle loading order

# AclBundle/Resources/config/app.yml (5th. loaded bundle in kernel)
oro_security:
    access_control:
        - { path: ^%web_backend_prefix%/contact$, roles: acl_bundle_ROLE }

# OroActivityContactBundle/Resources/config/app.yml (61st. loaded bundle in kernel)
oro_security:
    access_control:
        - { path: ^%web_backend_prefix%/contact$, roles: activity_contact_bundle_ROLE }

  1. The list merged from the src folder

# src/Resources/config/app.yml
oro_security:
    access_control:
        - { path: ^%web_backend_prefix%/contact$, roles: src_folder_ROLE, priority: 20 }

To override a rule and move it to the top of the rule list that is checked, use the priority flag.

A rule with no value set defaults to 0, so give a rule a higher value to move it up in the order.

In the example above, the final list will look like the following.

- { path: ^%web_backend_prefix%/contact$, roles: src_folder_ROLE }
- { path: ^%web_backend_prefix%/contact$, roles: security_yml_ROLE }
- { path: ^%web_backend_prefix%/contact$, roles: acl_bundle_ROLE }
- { path: ^%web_backend_prefix%/contact$, roles: activity_contact_bundle_ROLE }

The request coming for URL ^%web_backend_prefix%/contact will be checked for role src_folder_ROLE because it was moved up for its priority of 20.