How to use ACL with Cake PHP 1.2.x?

By Ketan (ketan)

This tutorial will brief you on how to use Acl in CakePHP 1.2.x versions. I had tough time figuring this out. But with help of Gwoo, AD7Six & others, and doing debugging and reading code, here comes the tutorial.

This tutorial assumes you know basic concept of ACL and what it is suppossed to be used for? If not then please read http://manual.cakephp.org/chapter/acl You can setup the databases needed for ACL through console command Download code

Now we would setup some higher level aros and acos for initial setup. You could do it through console. But I prefered to do it through controller, nothing special, just did it that way! Think of Aros (could be Users, service, etc) as the one who is requesting access to Acos (could be controller, actions or services). But in this example, we will limit Aros as the users and Acos as the controllers. We will setup the following Aros (users):

1. Admin 2. |-->User::1 3. User 4. Guest

You could add more depending on your requirements, but we will stick to basic requirements for now. Admin, User & Guest are higher level group and the actual users will belong to one of these groups. 'User::1' is an alias for User with user id 1. We define that user with user id 1 is a child of Admin and will inherit all admin previledges. Doing this is not essential, but you will have to define at least one user to be Admin, so why not do it here. Change the id to the userid representing the admin user on your system. We will setup the following Acos (controllers):

1. User 2. Post

This would add two acos 'User' and 'Post'. But now you think if Acos is controller then why not have 'Posts' instead of 'Post'? Good question. This is because usually a controller's action can be divided into four types of action 'create', 'read', 'update' or 'delete' which are performed on a single or group of records belonging to a model. Hence, in this approach we going at record level Access Control. We want to make sure whether the current Aro (a User) has access to do 'C', 'R', 'U' or 'D' action on the Aco ( a record for eg. A post). If yes, then let him do the action otherwise don't. Now the code, that shows you the manual way to create aros and acos as discussed above. Controller Class:

Download code

TUTORIALS AUG 7, 2007

Details

Version: 1.2.0.5146

Views: 36305

Comments (42)

Rating

 

3.50 by 2 Users

Log in to add rating

Tags

aro

aco

acl

Log in to add tags

cake acl initdb

<?php 

class InitAclController extends AppController

{

  var $name = 'InitAcl';

  var $component = array('Acl');

  var $uses = array();

  function setupAcl()

CakePHP API Docs Bakery Live Forge Trac

News Articles Code Articles

Login Register About CakePHP Donate

http://bakery.cakephp.org/articles/view/how-to-use-acl-in-1-2-x

  {

    $aro = new aro();

    $aro->create();

    $aro->save(array(

      'model'=>'User',

      'foreign_key'=>null,

      'parent_id'=>null,

      'alias'=>'Admin'));

    $aro->create();

    $aro->save(array(

      'model'=>'User',

      'foreign_key'=>null,

      'parent_id'=>null,

      'alias'=>'User'));

    $aro->create();

    $aro->save(array(

      'model'=>'User',

      'foreign_key'=>null,

      'parent_id'=>null,

      'alias'=>'Guest'));

    $parent = $aro->findByAlias('Admin');

    $parentId = $parent['Aro']['id'];    

    $aro->create();

    $aro->save(array(

      'model'=>'User',

      'foreign_key'=>1,

      'parent_id'=>$parentId,

      'alias'=>'User::1'));

    

    

    $aco = new Aco();

    $aco->create();

    $aco->save(array(

       'model'=>'User',

       'foreign_key'=>null,

       'parent_id'=>null,

       'alias'=>'User'));

       

    $aco->create();

    $aco->save(array(

       'model'=>'Post',

       'foreign_key'=>null,

       'parent_id'=>null,

       'alias'=>'Post'));

   }

   // Give admin full control over acos 'User' & 'Post'

   $this->Acl->allow('Admin', 'User', '*');

   $this->Acl->allow('Admin', 'Post', '*');

   // Give the user group only create & read access for 'Post' 

   $this->Acl->allow('User', 'Post', array('create', 'read'));

   // Give the Guests only create access for 'User'

   $this->Acl->allow('Guest', 'User', 'create');

}

?>

Above you saw that using Acl, we granted the Admin full rights over 'User' and 'Post' Acos. ie. Admin can do CRUD for all user and post, which in turn means that for any controller action which involves creating, reading, updating or deleting a 'User' or 'Post' record, Admin group is allowed to do it. So does any user that belongs to group Admin. 'User' aro is allowed to do only create & read action for 'Post' acos, which means that a 'User' group in general has access to a controller action that can create and read 'post' records, which is what we want. We want that any user that belongs to 'User' group can create new posts and read posts. But we do not want all users (aros) to 'update' or 'delete' any 'Post' (acos) they want. Which means, that belonging to a 'User' group does not give you any previledges to 'U', 'D' actions of 'Post' (acos). But you want to have 'U', 'D' action for the user who created that Post!! I will get to giving user who created post the full CRUD rights later on, but this explanation was just to clear your concepts. Note that, above we did not do any 'allow' statement for 'User' aco, so this means that by default 'User' group and its children, don't have access to 'CRUD' on 'User' records (acos). A user himself only has the CRUD right for his record and not other users. That's why we did it that way :) 'Guest' aro is allowed to only 'create' action for 'User' acos. ie. Guest can only register a new user account, and is denied all other access to everything else. Now that we have the basic setup done, we would want to get the aros and acos populated as and when user is added to system. Below is shown the code on how to create aros and acos manually and also how to setup the permissions. Controller Class:

Download code

<?php 

class UsersController extends AppController

{

  var $name = 'Users';

  var $components = array('Acl');

  function register()

  {

     if(!empty($this->data))

     {

        $this->User->data = $this->data;

        if ($this->User->validates())

        {

           if ($this->User->save())

           {

               $aro = new Aro();

               $parent = $aro->findByAlias('User');

               $parentId = $parent['aro']['id'];

               $aro->create();

               $alias = $this->User->name.'::'.$this->User->id;

               $aro->save(

                 'model'       => $this->User->name,

                 'foreign_key' => $this->User->id,

                 'parent_id'   => $parentId,

                 'alias'   => $alias

                       );

               $aco = new Aco();

               $parent = $aco->findByAlias('User');

               $parentId = $parent['aco']['id'];

               $aco->create();

               $aco->save(

                 'model'       => $this->User->name,

                 'foreign_key' => $this->User->id,

                 'parent_id'   => $parentId,

                 'alias'       => $alias

Above you saw, how to create aro and aco each time a new user is registered on the system. Also you saw how to allow a user himself the full CRUD previledges on his own record. Say User 'a' with user id '5' just registered on the site. Above code, will create an aro with alias 'User::5' and an aco with alias 'User::5' and will create an entry in aros_acos table that would let aro with alias 'User::5' CRUD rights over aco with alias 'User::5'. Now no other user has access User 'a' except User 'a' and anyone who belongs to 'Admin' aro group. To verify, give following code a try Controller Class:

Download code

When you visit the above page (http://localhost/test/view), you will get 'access denied'. Now change the $curLoggedInUserId = 5, and try visiting the same page again, you will get 'allowed access'. This is because the logged in user id now is the same as user 'a'. And we had defined that user 'a' has full rights on user 'a' record. Note what happens when you have $curLoggedInUserId = 1!! You still get 'allowed access', now why did this happen? Just because User with userid 1 belongs to Admin group and he has full CRUD rights over any 'User' aco. Above code is a very crude code and is meant just to demonstrate the purpose of Acl check & is not meant to be used in production use. Above was a manual & tedious way to create aros and acos. Now I will now show you the magical way to create aros and acos without much effort on your end. All you have to do is implement the Acl Behavior which comes with cake 1.2 distribution. Below is the code that you would have to add to 'Post' Model. Model Class:

Download code

                       );

               $this->Acl->allow(

                    $alias, 

                    $alias, 

                    array('read','update'));

           }

        }

 

     }

  }

}

?>

<?php 

class TestController extends AppController

{

  var $name = 'Test';

  var $components = array('Acl');

  var $uses = array('User');

  var $curLoggedInUserId = 3;

  function view()

  { 

    $aroAlias = 'User::'.$curLoggedInUserId;

    $acoAlias = 'User::5';

    if ($this->Acl->check($aroAlias, $acoAlias, 'read'))

    {

       echo 'Read access allowed for User Id'.$curLoggedInUserId;

    }

    else

    {

       echo 'Read access denied for User Id'.$curLoggedInUserId;

    }

  }

}

?>

Above code, will now automatically create a new aco for every new post that is posted. The Acl behavior takes care of all details. Just so you know, in Acl behavior, there is 'afterSave' callback, which would be called once the save callback is completed in current model. Acl behavior would even delete the aco whenever the post is deleted, without any extra effort on your end. Isn't this cool? Hell yaaa! it is... Now you would want to setup the permissions on the newly create 'aco'? How do you do that, check out the code below: Controller Class:

Download code

So if a save is successful from Post then we know that the Aco is created and then all we have to do is setup proper aro and aco nodes and then give the required permissions and we are done!!

<?php 

class Post extends AppModel{

var $name = 'Post';

var $actsAs = array('Acl'=>'controlled');

// 'controlled' means you want to create a 'aco'

// 'requester' means you want to create an 'aro'

/**

 * Returns the parent Alias for current

 */

function parentNode()

{

    return $this->name;

}

}

?>

<?php 

class PostsController extends AppController {

   var $name = 'Posts';

   var $helpers = array('Html', 'Form' );

   var $uses = array('Post');

   var $components = array('Acl');

   function add() {

       if(!empty($this->data)) {

       $this->Post->data = $this->data;

            

           if ($this->Post->validates())

       {

         $this->Post->create();

                

        if($this->Post->save($this->data)) 

                { 

                    $acoNode = array('model'=>$this->Post->name,

                                     'foreign_key' =>$this->Post->id);

                    $aroNode = array('model'=>'User',

                                   'foreign_key'=>$this->getUserId());

            // User has full control of the post he created

            $this->Acl->allow($aroNode, $acoNode, '*');

        }

    }

    }

}

?>

I would welcome feedback via comments and suggestions. Let me know if you have any troubles implementing this. Till then enjoy baking. Cheers, Ketan Patel

 

Comments

CakePHP Team Comments Author Comments

 

Hi, I'm having troubles trying to setup the initial ACL config. I tried using the provided code (InitAclController) but I always run into problems (no Class defined or else). I tried going to the console but I'm having difficulties translating your setup into acl commands for the console. For example: $aro->save(array( 'model'=>'User', 'foreign_key'=>null, 'parent_id'=>null, 'alias'=>'Admin')); Reading the console help, I can see the format is: create aro|aco would that translate into something like: cake acl create aro / User/Admin ? Any help would be very welcome. Thanks

Posted Jul 25, 2007 by camille moussette

 

Hi, I'm having troubles trying to setup the initial ACL config. I tried using the provided code (InitAclController) but I always run into problems (no Class defined or else).

Where do you create this init_acl_controller.php file?

$aro->save(array( 'model'=>'User', 'foreign_key'=>null, 'parent_id'=>null, 'alias'=>'Admin')); Reading the console help, I can see the format is: create aro|aco

The above command would translate to

Question1 Problem doing initial setup

Comment2 Re Problem during initial setup

create aro root Admin

create aro root User

create aro User User::1

--> Alias for parent Node --> Alias for the node you are creating. It would ideal if you could use the init_acl_controller as it gives you clear idea of what you are getting started with.

Posted Jul 25, 2007 by Ketan

 

Assuming 'Guests' users are unidentified web visitors, how do you handler their access rights? They don't login, so they can't be assigned an ARO and thus ACL will reject their access to any actions. Sorry if the answer is too obvious, but after spending many hours on it I can't work this out.

Posted Jul 29, 2007 by Gorka Lopez de Torre

 

I treat any user who does not have a user id to be a guest. By this what I mean is that whenever a user logs-in, I create a session variable with the userId and check it in the beforeFilter method of the controller. So if I do not find the userId in the session, it means that the user is a guest! Hope this helps, Ketan Free Classifieds - eClassifieds4U

Posted Aug 1, 2007 by Ketan

 

Nice tutorial, really useful, thanks Ketan. I've a question about Access Control for groups of records. Say your app is multilingual and you have a model for articles that you use across all territories. You also have several administrator users all belonging to the same user group, each of which also belong to a territory or are "global". You only want to allow update & delete (and ideally read in the Admin part of the app) access to the articles belonging to a particular territory, to the users that also belong to that territory (or are global), but deny access to those administrators belonging to a different territory? Would you handle that scenario using ACL, if so, how, or would you do it another way? I do it using my own access control methods, which I'll bung on the bakery soon, but I wonder how easy it would be to do it using ACL. I know this question might be more suited to the google group, but I think its a common problem that no tutorials on ACL that I've seen yet, actually discuss, so thought add it here.

Posted Aug 2, 2007 by Neil Crookes

 

What I'm doing wrong? I tried to run InitAclController and always get error "Class 'Aro' not found". I paste directly code of InitAclController and put file init_acl_controller.php into app/controllers directory. First time I saw model missing and I added: var $uses = array();

Posted Aug 2, 2007 by Patryk

 

What I'm doing wrong? I tried to run InitAclController and always get error "Class 'Aro' not found".

What version of cake are you using? This code uses the Acl Component that is available with cake 1.2.x.x and will work with 1.2.x.x.

Posted Aug 5, 2007 by Ketan

 

Question3 Guest users

Comment4 Guest Users

Question5 Access Control for groups of records

Question6 InitAclController is not working

Comment7 What version are you using

You only want to allow update & delete (and ideally read in the Admin part of the app) access to the articles belonging to a particular territory, to the users that also belong to that territory (or are global), but deny access to those administrators belonging to a different territory?

You would add another group of users. Admin -> Full Control on all records Territory1, Territory2 & so on -> This group has update and read access to the respective territory based records. Whenever you create a record using your controller, depending on which territory the record belongs to, allow the territory group the update/read access to that record/action. Say you have 3 territory. US, Canada & Mexico. You would have 6 groups. ADMIN, GUEST, USER, US_MODERATORS, CANADA_MODERATORS, MEXICO_MODERATORS. If a user registers to the US territory then in the controller, allow the US_MODERATORS group (ARO) the read/write access to that user(ACO). This is the first thought that came to my mind and I am sure could be implemented in much better way. But definitely ACL could be used for this situation very efficiently. Ketan Free Classifieds - eClassifieds4U

Posted Aug 5, 2007 by Ketan

 

What I'm doing wrong? I tried to run InitAclController and always get error "Class 'Aro' not found".

What version of cake are you using? This code uses the Acl Component that is available with cake 1.2.x.x and will work with 1.2.x.x.

I just did a fresh install of 1.2.0.5427alpha and I get the same "Fatal error: Class 'aro' not found in ..." error.

Posted Sep 21, 2007 by Kagor

 

Use 'Aro' instead of 'aro'. It is case-sensitive. There is a typo in the tutorial, I will fix it sometime soon. Ketan Free Classifieds - eClassifieds 4U

Posted Sep 23, 2007 by Ketan

 

Fatal error: Class 'Aro' not found in E:\wamp\www\acl\app\controllers\init_acl_controller.php on line 10 The case sensetivity seems to be irrelevant, it cannot even find the 'Aro' (or aro). What are the pre-requisites for this tutorial to work correctly? Is it possible for you to show us your views? Also, in users_controller, shouldnt the lines that say: $aro->save(

Comment8 Territory based ACL

Comment9 Cant get it working with 1.2.0.5427alpha

Comment10 Use Aro instead of aro

Comment11 Class Aro not found....

'model' => $this->User->name, 'foreign_key' => $this->User->id, 'parent_id' => $parentId, 'alias' => $alias ); actually be $aro->save(array( 'model' => $this->User->name, 'foreign_key' => $this->User->id, 'parent_id' => $parentId, 'alias' => $alias) ); I assume your "posts" table is from the blog tutorial, speaking of the posts controller, there is an extra closing brace on line 27.

Posted Sep 24, 2007 by Mike Green

 

on line 5 of init_acl_component.php, it should read: var $components = array('Acl'); Hopefully this will help others too :) Mike

Posted Sep 24, 2007 by Mike Green

 

in this file, $curLoggedInUserId isnt set, since it should be: $this->curLoggedInUserId; in all occurences within the view() method.

Posted Sep 24, 2007 by Mike Green

 

When running the setupAcl method from the InitAclController, CakePHP issues a warning about wrong usage of the $Acl->allow() method. In my database no record is made for the User group. I figured out that when coding the "create & read" access as follows, there is no warning and everything works fine:

Can anybody tell me why the array notation doesn't work?

Posted Sep 30, 2007 by Jan Boonen

 

I tried hard to investigate the differences between acl of cakephp 1.1 and cakephp 1.2 but not got any explanation for it . Kindly any one explain differences b/w the two db structure and purpose .For example model field in aro /aco table has added in acl 1.2 and for what purpose is not define in this article (or i may have not noticed). All Your Kindness .

Posted Oct 24, 2007 by s a khan

 

Comment12 and also..

Bug13 testacl controller problem

Question14 Warning when running setupAcl

$this->Acl->allow('User', 'Post', 'create');

$this->Acl->allow('User', 'Post', 'read');

Question15 What is difference bw cakephp 1.1 and cakephp 1.2 s ACL schema

Okay, so, apparently $aro->create() is different in CakePHP 1.2. Yes? For example, a key difference in the code here versus the code in, say, this article: http://bakery.cakephp.org/articles/view/real-world-access-control Is that $aro->create() is used differently. Cake 1.1

Cake 1.2

Is that right? Can anyone confirm this stuff? Thanks!

Posted Oct 24, 2007 by Jeffrey Silverman

 

here are some tidbits which I think are mostly correct: (1) The ACL page in the Cake Manual for Cake 1.1 is not applicable to Cake 1.2 ACLs (2) The multiple $aro->create() calls in this article's examples are to instantiate a new ARO each time, and then the $aro->save(array(...)) bit saves the new ARO to the database. (3) The $aro = new Aro(); could have been skipped and the Aro Model that is in the Acl component been used instead, directly, like so:

(4) The location of the data Array() in the create() and save() operations could have been transposed. That is to say, one create() operation and one save() operation is needed to save each new ARO, but the data array() could be placed in either the create() or the save() method. Possibly more, but that's all for now. later...

Posted Oct 24, 2007 by Jeffrey Silverman

 

How to set acl behavior to create both aco and aro? I have created a new behavior Acl2 that extends AclBehavior

It's right so?

Comment16 regarding differences in 11 vs 12

$aro->create( 1, null, 'This is the Alias' );

$aro->create();

$aro->save( array('foreign_key'=>1, 'parent_id'=>null, 'alias'=>'This is the Alias') );

Comment17 regarding differences in 11 vs 12

$this->Acl->Aro->create();

$this->Acl->Aro->save(array(...data...));

Question18 AclBehavior and overwrite on Allow and Deny method

Model Class: <?php 

var $actsAs = array('Acl'=>'controlled','Acl2'=>'requester');

?>

--------------------------------------------------------- Using allow and deny method as the following code, I notice that the last call (deny) overwrite the first (allow).

the result in db is: CRUD: 0 -1 0 0 but the result attended for me is: CRUD: 1 -1 1 1 An other example:

the result in db is: CRUD: 0 1 0 0 but the result attended for me is: CRUD: 1 1 0 0 There is a way to call method allow and deny on single action CRUD without overwrite other action CRUD? Sorry for my english, I hope I have been clear. Thanks to all

Posted Dec 20, 2007 by Gallax

 

I have just learn ACL but i don't so understand. Help me

Posted Dec 21, 2007 by one cart

 

Sorry, but for some reason I cannot find that console command. Therefore, I cannot create the database. It would have been really helpful if you'd provided the SQL create scripts.

Posted Jan 16, 2008 by Ben

 

Sorry, but for some reason I cannot find that console command.

The command is located in the directory /cake/console. For Windows users it is cake.bat, for *NIX users it is just cake (don't forget to do "chmod a+x" on cake). The SQL is constructed in the file cake/console/libs/acl.php from line 317 onwards (in the latest beta version). Hope that helps you.

Controller Class: <?php 

$this->Acl->allow($aroAlias, $acoAlias, '*');

$this->Acl->deny($aroAlias, $acoAlias, 'read');

?>

Controller Class: <?php 

$this->Acl->allow($aroAlias, $acoAlias, 'create');

$this->Acl->allow($aroAlias, $acoAlias, 'read');

?>

Question19 Can I have a good example for ACL

Comment20 The console command

Comment21 Console command for ACL

Posted Jan 17, 2008 by Jan Boonen

 

I don't see any checks occuring for automatic record level access. I do see that ACO and ARO are created automatically, which is great, even the correct "aros_acos" entries are made (i.e. User:5 has CRUD permission on Post:2), However user::5 is unable to access "/posts/edit/5" My ARO's

My ACO's

Ok ... I just looked at mysql logs, I see that it is checking only for my POSTS and ROOT aco_id (aco_id's: POSTS=5, ROOT=1)

Seems that it should also check for aco_id that matches the record I have chose to edit

Posted Jan 28, 2008 by leftdrive

 

Hi, Can somebody please post the SQL to create the three ACL tables. Some of us do not have Console access because of a shared environment. For sometime in the future, a web based setup in addition to the console would be a nice feature for cake. EDIT: I found it finally. Look in app/config/sql/db_acl/sql Thanks for any help, David

Posted Feb 2, 2008 by David Dear

 

Does anyone else get duplicate entries when running the init_acl setupACL function? For example, if I try to add Admin, User and Guest AROs (using the code above), I get two of each. It is like the function runs twice somehow. Any ideas?

Posted Feb 2, 2008 by David Dear

 

Hi when i want to run the controller InitAclController that i've copied from your tutorial but then i'm getting this error: Parse error: syntax error, unexpected T_VARIABLE, expecting T_FUNCTION in C:\wamp\www\cakephp\test\controllers\init_acl_controller.php on line 62 Can you help me?

Posted Feb 7, 2008 by rory

 

Thanks to TommyO for pointing me in the right direction, if you are using XAMPP and Mac OS X, visit http://www.keitr.com/xampp. You will need to do the steps outlined there for "cake schema run create DbAcl" to work.

Question22 Where are the automatic checks

 |-ADMIN

 |-USER

   |-User::5

 |-GUEST

ROOT

 |-USERS

   |-User::5

 |-POSTS

   |-Post::1

   |-Post::2

   |-Post::3

...

WHERE Permission.aro_id = 2 AND Permission.aco_id IN (5, 1)  

...

WHERE Permission.aro_id = 4 AND Permission.aco_id IN (5, 1)

Comment23 SQL for ACL tables

Comment24 Double Entries

Question25 syntax error

Comment26 Using XAMPP and Mac OS X

Posted Feb 20, 2008 by Jason Vendryes

 

Gallax, I understand exactly the problem you're having. Unless I'm missing something, Cake's rewritten Acl is horribly broken, because you cannot do an Acl->allow followed by an Acl->deny (or vice versa) for the same Aro/Aco combination. Instead Cake will overwrite the previously allowed fields with 0 (i.e. inherited). This has provided a major headache as I was trying to update a project to Cake 1.2 and could not understand why the ACL stuff was totally butchering things.

Posted Feb 20, 2008 by Brad Garrett

 

FYI I filed a bug for the allow/deny overwrite problem that Gallax and I encountered. https://trac.cakephp.org/ticket/4190

Posted Feb 20, 2008 by Brad Garrett

 

and what about the aro and aco not found problem in the InitAclController?

Posted Feb 22, 2008 by rory

 

Just for your information, the method described above, when used along with the built-in AuthComponent : AppController.php :

You must specify the type of authorisation somewhere in the

In fact, using the auth component, you get different ways to check the authorisation. Method described here is 'crud' Don't do like me trying to make it work set to 'actions' ;) Indeed, I find it really more simple to use a 'crud' than an 'actions' based authorisation (I don't have to create acos for every actions).However, I'm still looking how to 'map' actions as C,R,U or D actions....

Posted Mar 5, 2008 by David Coll

 

Hello, after spending a little time on this issue, here's what I get to work efficiently.. If it can help some out there with that wild beast :P First, the Alias for the aCos, I needed to put them in their pluralize way else I was getting not defined node error, when the Acl was looking for a match-up. So, in every models/model.php I use this for parentNode:

Bug27 allow and deny overwrite other fields with 0

Comment28 bug 4190 filed for this

Question29 aro aco not founds

Comment30 Using with the Auth component

Controller Class: <?php var $components = array('Acl','Auth');?>

Controller Class: <?php function beforeFilter(){

$this->Auth->authorize = 'crud';

}?>

Comment31 User Aro Aco creation revisited

Model Class: <?php 

var $name = 'Tag';

    var $actsAs = array('Acl'=>'controlled');

    function parentNode()

    {

I don't remember if I've written the alias by hand for the aCos. But I'm sure I had to write them first for the aRos of the groups. Here is the parentNode for the model/user.php

taken from here : http://realm3.com/articles/setting_up_users_groups_withacl_and_auth_in_cake_1.2.php Note: the parentNode for the Group is the same as the ones for aCos. ---- Then for the creation of your users aro, aco & aros_acos : Here's a simpler version of the one written in this article :

no need to call a new aro, aco stuff. And the best is that you'll add an alias to your aRo directly. Here's a little plus: as a requester, if you delete the user, it's aRo will also be deleted automatically. But the aCo will stay there. Use this in the delete function :

        return Inflector::pluralize($this->name);

    }

?>

Model Class: <?php 

    function parentNode( ) {

        if (!$this->id) {

            return null;

        }

        $data = $this->read();

        if (!$data['User']['group_id']){

            return null;

        } else {

            return array('model' => 'Group', 'foreign_key' => $data['User']['group_id']);

        }

    }

?>

Controller Class: <?php 

if ($this->User->save($this->data)) {

    //Set the alias to be used in Aco, Aro & acos_aros table

    $alias = $this->User->name.'::'.$this->User->id;

    //Only sets the alias of the already pointed Aro

    $this->Acl->Aro->save(array('alias'   => $alias));

    

    //set the Aco $parent node aliased as the controllers (plural, ie. Users)

    $parent = $this->Acl->Aco->findByAlias($this->name);

    //create a Aco for our user

    $this->Acl->Aco->save(array(

                    'model'       => $this->User->name,

                    'foreign_key' => $this->User->id,

                    'parent_id'   => $parent['Aco']['id'],

                    'alias'       => $alias    ));

    

    //Sets permissions

    $this->Acl->allow(

                    $alias, 

                    $alias, 

                    array('read','update'));

    

    $this->Session->setFlash(__('The User has been saved', true));

    $this->redirect(array('action'=>'index'));

} else {.......

?>

Controller Class: <?php 

        //delete associated Aco

        $aco = $this->Acl->Aco->findByAlias($this->User->name.'::'.$this->User->id);

That way, the aCo table doesn't get filled up with empty references. Cheers. (I'm soooooo happy to finally have made this work :P )

Posted Mar 6, 2008 by David Coll

 

In general, this whole cake thing is simply too vague. The documentation is terrible and I find that I'm spending more time trying to figure out how to do something than actually getting any useful programming done. There's Beta, and then there's unfinished software. Specifically regarding this "tutorial", again it is simply too vague. Being a trained designer, one of the first rules of any kind of good design is too make instructions as simple and straight-forward as possible, while still being as detailed as possible. In short, ANYONE should be able to read the instructions and at least get to a point where they have a basic working prototype. This "tutorial" leaves a lot to be desired, infered, and assumed, which leaves big windows for mistakes. Where is this "ketan" person starting? Where is the code added to? Why are there amateur mistakes like missing brackets, etc...? Furthermore, the console barely works in Mac OSX, and the 'cake acl initdb' has been deprecated for 'cake schema run create DbAcl' which doesn't actually work [on Mac OSX]. You get a MySQL connect error. But if you want to run it, the proper command is: ./console/cake schema run create DbAcl Moreover, the correction to line 5 in the InitAclController class that Mike Green made above is incomplete. Because there is only a missing 's', it is difficult at first glance to know what he is correcting. So here's my correction of Mike's correction to line 5 in the InitAclController class: Line 5 is incorrect in that it defines the variable $component. This variable name MUST BE PLURAL, as in $components. So the correct code should read: var $components = array('Acl'); Next, in the InitAclController class, where the $#@& does the following code go? It obviously doesn't go where "ketan" put it because I get a parsing error. // Give admin full control over acos 'User' & 'Post' $this->Acl->allow('Admin', 'User', '*'); $this->Acl->allow('Admin', 'Post', '*'); // Give the user group only create & read access for 'Post' $this->Acl->allow('User', 'Post', array('create', 'read')); // Give the Guests only create access for 'User' $this->Acl->allow('Guest', 'User', 'create'); My advice is to take this article down and do some serious revision. I feel like CakePHP is one big dis-information campaign designed for rapid frustration rather than rapid development. No offense to anyone, but this is a nightmare!!! This tutorial does absolutely nothing for me.

Posted Apr 15, 2008 by No Name

 

"Being a trained designer..."

        $this->Acl->Aco->del($aco['Aco']['id']);

        

        if ($this->User->del($id)) {            

            $this->Session->setFlash(__('User deleted', true));

            $this->redirect(array('action'=>'index'));

        }

?>

Comment32 Vague...

Comment33 Durrr

Well there's your problem.

Posted Apr 15, 2008 by Nate

 

This is just the type of response I would expect. Just proves that mediocrity is king! Didn't your parents teach you not to say anything if you don't have anything nice to say?

"Being a trained designer..." Well there's your problem.

Posted Apr 15, 2008 by No Name

 

You write a sack of bull with "No Name" and user acajaja ("here hehe" in spanish). That's the type of attitude I would expect from a coward. Come here, bring down years of work and tireless effort from a lot of people, that brought the biggest community for a PHP framework, lots of supporters, but hey... "No Name" has the absolute truth about what should be done and what needs changed. Give me a break. Go ahead and waste someone else's time. People here are too busy getting things done, and helping others.

Posted Apr 15, 2008 by Mariano Iglesias

 

You must specify the type of authorisation somewhere in the

In fact, using the auth component, you get different ways to check the authorisation. Method described here is 'crud' Don't do like me trying to make it work set to 'actions' ;) Indeed, I find it really more simple to use a 'crud' than an 'actions' based authorisation (I don't have to create acos for every actions). However, I'm still looking how to 'map' actions as C,R,U or D actions....

First off, THANK you for adding in the 'crud' method. I never came across that in all of my many nights exploring documentation. How do you get the Auth-> login/logout to work with the ACL? I can get the Auth component to work wonderfully using controller method. Also, when I use the CRUD method, as long as I have the Acos listed in the plural format, they work... except login and logout. Any ideas?

Posted Jun 20, 2008 by Wendy

 

Hi, helpful guide :) I'm new to CakePHP and am halfway through creating my first proper application and have got to the point where I need ACL. I have followed the guide above upto the point where I try and and add ACOs/AROs to the database. I have tried the script above and doing it in the console but both give me this error:

Error: Database table aros for model Aro was not found.

The table are definitely there as I can see aros, acos and aros_acos in my applications database (in phpmyadmin) along with my existing tables. I have tried the same thing on 2 servers now with no luck.

Comment34 Figures...

Comment35 Coward

Comment36 ACL and Auth

Controller Class: <?php function beforeFilter(){

$this->Auth->authorize = 'crud';

}?>

Comment37 Database Table Missing

I am hoping someone can help as I am out of ideas, searching for that error in quotes gives me 2 results on Google. Any help would be much appreciated :)

Posted Jul 10, 2008 by Adrian Harding

 

@Adrian did you set belongsTo in both models? aro and acl? var $hasAndBelongsToMany = array(...) using the console it does that automatically when creating the models I got another problem - and (like many others) don't get it to work properly database and its content is all set but it always throws n error like: Warning (512): DbAcl::allow() - Invalid node [CORE\cake\libs\controller\components\acl.php, line 367] while trying to allow something: $this->Acl->allow('groups', '/posts'); i tried like every tutorial around before this one, i had the "fellowship of the ring tut." with: $this->Acl->allow('Frodo', 'rings'); some problem... this is inside the testing() action in the tests_controller.php

Posted Jul 10, 2008 by Mark

 

Hi Mark I knew it had to be something silly I missed, thanks alot :)

@Adrian did you set belongsTo in both models? aro and acl? var $hasAndBelongsToMany = array(...) using the console it does that automatically when creating the models

Posted Jul 11, 2008 by Adrian Harding

 

I don't see any checks occuring for automatic record level access. I do see that ACO and ARO are created automatically, which is great, even the correct "aros_acos" entries are made (i.e. User:5 has CRUD permission on Post:2), However user::5 is unable to access "/posts/edit/5" ... Ok ... I just looked at mysql logs, I see that it is checking only for my POSTS and ROOT aco_id (aco_id's: POSTS=5, ROOT=1)

I got the same problem. I set all Aro and Aco with Acl and Auth but it won't check the permission at the record level. Any suggestion to this?

Comment38 the above problem

Comment39 Re the above problem

Comment40 check() to a specific Aco

Posted Jul 31, 2008 by KoPanda

 

I get an error that says: Parse error: syntax error, unexpected T_VARIABLE, expecting T_FUNCTION in /VolunteerCake/controllers/init_acl_controller.php on line 62 Which appears to be this bit of code:

Is there a missing function, or should these be moved inside the function in your example?

Posted Oct 20, 2008 by Rob Weaver

 

Login To Submit A Comment

Question41 How to fix code errors

   // Give admin full control over acos 'User' & 'Post' 

   $this->Acl->allow('Admin', 'User', '*'); 

   $this->Acl->allow('Admin', 'Post', '*'); 

   // Give the user group only create & read access for 'Post'  

   $this->Acl->allow('User', 'Post', array('create', 'read')); 

   // Give the Guests only create access for 'User' 

   $this->Acl->allow('Guest', 'User', 'create'); 

Latest Articles

Mobilize your cake app in

minutes

Wizard Component 1.2

Tutorial

Migrating a real-world

application to CakePHP 1.2

Brita component with HTML

Purifier

Bake ROT13 Encoded

"mailto:" Links

Latest Code

Validanguage Helper for

customizable Javascript form

validation

FlashHelper - a wrapper for

the SwfObject js class

Wizard Component 1.2

FlashChartHelper - version 3

How to create an XML-RPC

server with CakePHP

Latest News

introducing something new

to chew on

CakeFest #2

Release: CakePHP RC3 - The

RC of Triumph!

CakePHP Workshop, Sept

6&7, Raleigh NC USA

Release: Some RC2

Sweetness

Latest Comments

Problem

Nothing wrong with

includes...

admin routing

Referrer is not always

reliable

JSON scaffolding

© 2006-2008 Cake Software Foundation