{"action":"opened","issue":{"url":"https://api.github.com/repos/stwe/DatatablesBundle/issues/268","repository_url":"https://api.github.com/repos/stwe/DatatablesBundle","labels_url":"https://api.github.com/repos/stwe/DatatablesBundle/issues/268/labels{/name}","comments_url":"https://api.github.com/repos/stwe/DatatablesBundle/issues/268/comments","events_url":"https://api.github.com/repos/stwe/DatatablesBundle/issues/268/events","html_url":"https://github.com/stwe/DatatablesBundle/issues/268","id":132133902,"number":268,"title":"[Insight] Symfony applications should not throw AccessDeniedHttpException - in Controller/EditableController.php, line 54","user":{"login":"stwe","id":2964748,"avatar_url":"https://avatars.githubusercontent.com/u/2964748?v=3","gravatar_id":"","url":"https://api.github.com/users/stwe","html_url":"https://github.com/stwe","followers_url":"https://api.github.com/users/stwe/followers","following_url":"https://api.github.com/users/stwe/following{/other_user}","gists_url":"https://api.github.com/users/stwe/gists{/gist_id}","starred_url":"https://api.github.com/users/stwe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stwe/subscriptions","organizations_url":"https://api.github.com/users/stwe/orgs","repos_url":"https://api.github.com/users/stwe/repos","events_url":"https://api.github.com/users/stwe/events{/privacy}","received_events_url":"https://api.github.com/users/stwe/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/stwe/DatatablesBundle/labels/insight","name":"insight","color":"ff1493"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-08T12:51:38Z","updated_at":"2016-02-08T12:51:38Z","closed_at":null,"body":"**[in Controller/EditableController.php, line 54](https://github.com/stwe/DatatablesBundle/blob/54303848faee7ef24bf1476790a69fc8d410a7ec/Controller/EditableController.php#L54)**\r\n\r\n> The `AccessDeniedHttpException` bypasses the Symfony Security component and always results in a 403 response. You should throw `AccessDeniedException` (without `Http`) instead, so that the Security Component displays a login form.\r\n\r\n```php\r\n            $fieldType = null;\r\n            $getter = null;\r\n            $setter = null;\r\n\r\n            if (!$this->isCsrfTokenValid('editable', $token)) {\r\n                throw new AccessDeniedHttpException('The CSRF token is invalid.');\r\n            }\r\n\r\n            $em = $this->getDoctrine()->getManager();\r\n            $metadata = $em->getClassMetadata($entityName);\r\n\r\n```\r\n\r\n---------------------\r\n\r\n_Posted from [SensioLabsInsight](https://insight.sensiolabs.com/projects/61803d08-17ab-4a69-ad13-6ec448762332/analyses/53)_"}}