new public access control method#339
Conversation
This new method allows you to check public access and control all of your permissions from a single file. As opposed to the way it is now where you have to control your permissions from numerous different places when it comes to public and logged in user access. eg. In each controller you would have to specify $this->Auth->allow('someAction'), but now you can just control it from the same place as all of your other permissions.
since this has an effect on the use of the role field, I guess we'll need to keep it optional to turn it on
|
Oh I forgot to mention that I didn't config the controller's Auth->allow, because I just really like the ease of using, $controller->Auth->isAuthorized, and get the feeling that it would add additional overhead unnecessarily to iterate through all the actions when you can just do allow(), based on the idea that we're running this on each request. (Hope I'm speaking clearly, not sure my thought is translating from my head to type :) |
|
I think using allow() is the convention defined in the framework to determine an action does not require Auth at all, so I would say let's keep the conventions in use :) Btw, this PR looks promising to define public actions in the same config files. |
|
Not really sure what your comment means. I would say this PR does follow the convention, for a given action it sets it to allow() if you've made it public from the config file. Not sure what if any specific changes you're looking to get in order to merge this in. |
not sure if getController() adds any additional overhead, but just in case made it so that it is only called once
| //Password Hasher | ||
| 'passwordHasher' => '\Cake\Auth\DefaultPasswordHasher', | ||
| //Manage public permissions | ||
| 'publicControl' => false, |
|
The failing unit tests were already fixed in develop. Please provide unit tests covering the new feature. |
|
As a new feature, PR should be sent to develop instead of master |
|
i have done this in the following code you can review if it fit your need sample config looks like return [ ` _registry->getController()->loadComponent('Auth', Configure::read('Auth')); } ``` $this->_initAuthAllow(); } /** * this function will allow default controller actions * * @auther zamaliphe@gmail.com * * @return void */ protected function _initAuthAllow() { $permission = Configure::read('Users.AuthDefault'); if (!$this->_checkRequest() || empty($permission)) { return false; } $term = $this->_getConfig($permission); $this->_setAllow($term); } protected function _setAllow($term = []) { $possibleValues = (array)Hash::get($term, 'action'); return $this->_registry->getController() ->Auth->allow($possibleValues); } protected function _getConfig($permission = []) { if (empty($permission) || !is_array($permission)) { return []; } $plugin = $this->_getRequest('plugin'); $controller = $this->_getRequest('controller'); $action = $this->_getRequest('action'); $prefix = $this->_getRequest('prefix'); foreach ($permission as $term) { if ( $this->_matchOrAsterisk($term, 'prefix', $prefix, true) && $this->_matchOrAsterisk($term, 'plugin', $plugin, true) && $this->_matchOrAsterisk($term, 'controller', $controller) ) { return $term; } } return []; } protected function _getRequest($key = null) { if (empty($key)) { return null; } $request = $this->_registry->getController()->request; $prefix = null; if (!empty($request->params['prefix'])) { $prefix = $request->params['prefix']; $prefix = ($prefix == 'front') ? null : $prefix; } $requestData = [ 'plugin' => $request->plugin, 'controller' => $request->controller, 'action' => $request->action, 'prefix' => $prefix, ]; return (array_key_exists($key, $requestData)) ? $requestData["{$key}"] : null; } protected function _checkRequest() { $plugin = $this->_getRequest('plugin'); $controller = $this->_getRequest('controller'); $action = $this->_getRequest('action'); if (!empty($plugin) || !empty($controller) || !empty($action)) { return true; } return false; } ``` ` |
|
How about |
|
I agree |
|
Related to #427 |
|
Closed as obsolete, please reopen if needed |
4 participants
This is an update to this pull request : #332 (comment). Please note, that I opted not to add the new config var "public => true", as was suggested, because by keeping it within the role variable this is usable beyond just the SimpleRbac config. Instead I added a new config var to users.php to turn public access control on or off, that way it won't effect current users. Please review.