title: Avoiding using security.context inside a form with Symfony
body: <p>For each article a list of comment is displayed. I want users to be able to Edit theirs own comments (and only THEIR own comments). <strong>I wanted to know if it was OK to use methode 2 or if there was a break of security?</strong></p>
  
  <p><strong>METHODE 1</strong></p>
  
  <p>So far I use the security.context inside my form to check if the current comment author is the current_user. if yes then I can add in my form a textarea with the comment.text so that the user can edit its comment. (But my form must therefore be define as a service so that I can inject security.context)</p>
  
  <p>IN MY FORM (define as a service so that I can inject security.context)</p>
  
  <pre><code> $current_user = $this-&gt;Securitycontext-&gt;getToken()-&gt;getUser();
   // I add the textarea to allow edit of the comment only if the user is the author of the comment.
   if($current_user == $comment-&gt;getAuthor())
   {
        $form-&gt;add('comment.text', 'textarea');
   }
  </code></pre>
  
  <p><strong>METHODE_2</strong></p>
  
  <p>I tried something different and it seems to be working fine (moreover I do not have to define my form as a service because I don't use security.context inside my form.)</p>
  
  <p>I create an EditAutorisation Attribut for my entity Comment. And from <strong>the controller</strong>, I check if the current_user is the author of the comment. if yes I set EditAutorisation to true.</p>
  
  <pre><code> if($this-&gt;getUser() = $comment-&gt;getAuthor()){
       $comment-&gt;setEditAutorisation('true');
   }
  </code></pre>
  
  <p>Then in my form I simply retrieve the value of EditAutorisation</p>
  
  <pre><code> if($comment-&gt;getEditAutorisation() )
   {
        $form-&gt;add('comment.text', 'textarea');
   }
  </code></pre>
  
  <p>PS: in both case I use EventListener PRE_SET_DATA in the form to access the objet $comment</p>
  
  <p><em>I prefere methode2 not much because of the fact I do not have to define it as a service. But because I can do my test in the controller, and use the test result easily in the FORM in PHP (using eventListener to get $comment->getEditAutorisation()) and in TWIG (using {{ comment.EditAutorisation }} )</em></p>