Jump to content
Larry Ullman's Book Forums

Search the Community

Showing results for tags 'authorization'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Single Editions
    • Modern Javascript: Develop and Design
    • The Yii Book
    • Effortless Flex 4 Development
    • Building a Web Site with Ajax: Visual QuickProject
    • Ruby: Visual QuickStart Guide
    • C++ Programming: Visual QuickStart Guide
    • C Programming: Visual QuickStart Guide
    • Adobe AIR: Visual QuickPro Guide
  • PHP and MySQL for Dynamic Web Sites: Visual QuickPro Guide
    • PHP and MySQL for Dynamic Web Sites: Visual QuickPro Guide (5th Edition)
    • PHP and MySQL for Dynamic Web Sites: Visual QuickPro Guide (4th Edition)
    • PHP 6 and MySQL 5 for Dynamic Web Sites: Visual QuickPro Guide (3rd Edition)
    • PHP and MySQL for Dynamic Web Sites: Visual QuickPro Guide (2nd Edition)
    • PHP and MySQL for Dynamic Web Sites: Visual QuickPro Guide (1st Edition)
  • PHP for the Web: Visual QuickStart Guide
    • PHP for the Web: Visual QuickStart Guide (5th Edition)
    • PHP for the Web: Visual QuickStart Guide (4th Edition)
    • PHP for the Web: Visual QuickStart Guide (3rd Edition)
    • PHP for the World Wide Web: Visual QuickStart Guide (2nd Edition)
    • PHP for the World Wide Web: Visual QuickStart Guide (1st Edition)
  • Effortless E-commerce with PHP and MySQL
    • Effortless E-Commerce with PHP and MySQL (2nd Edition)
    • Effortless E-Commerce with PHP and MySQL
  • PHP Advanced: Visual QuickPro Guide
    • PHP Advanced and Object-Oriented Programming: Visual QuickPro Guide (3rd Edition)
    • PHP 5 Advanced: Visual QuickPro Guide (2nd Edition)
    • PHP Advanced: Visual QuickPro Guide
  • MySQL: Visual QuickStart Guide
    • MySQL: Visual QuickStart Guide (2nd Edition)
    • MySQL: Visual QuickStart Guide (1st Edition)
  • Other
    • Announcements
    • Newsletter, Blog, and Other Topics
    • Forum Issues
    • Social

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Found 2 results

  1. How does the code below (p. 268) work? Is it definitely correct? Can someone walk me through this? In actionSetup (A): Why is updateUser a child of updateOwnUser? Doesn't that mean anyone who can update his/her OWN user info can also update anyone else's? In the controller (: Why is checkAccess (array('id' => $id)) used on updateUser instead of updateOwnUser? Does updateUser even use the ID parameter? Please help - thanks... Quite confused! Code A: # protected/controllers/SiteController.php::actionSetup() $auth = Yii::app()->authManager; // Create operations. $task = $auth->createTask('updateOwnUser', 'Allows a user to update her record', 'return $params["id"] == Yii::app()->user->id;'); $task->addChild('updateUser'); Code B: # protected/controllers/UserController.php public actionUpdate($id) { $model=$this->loadModel($id); if (!Yii::app()->user->checkAccess('updateUser', array('id' => $id))) { throw new CHttpException(403, 'You are not allowed to do this.'); } // Code for doing this. }
  2. I've been following this tutorial, which is great btw, and have one question. http://www.larryullman.com/2010/01/07/custom-authentication-using-the-yii-framework/ I can access the role property like this, anywhere in my application code: Yii::app()->user->role but, what I'd really like to do is use the default controller authorization in my UserController: /** * Specifies the access control rules. * This method is used by the 'accessControl' filter. * @return array access control rules */ public function accessRules() { return array( array('allow', // allow all users to perform 'index' and 'view' actions 'actions'=>array('*'), 'users'=>array('@'), // Fails 'roles'=>array(ModelConstantsRole::ADMIN), // Also Fails 'expression'=>'(isset(Yii::app()->user->role) && (Yii::app()->user->role==ModelConstantsRole::ADMIN))', ), array('deny', // deny all users 'users'=>array('*'), ), ); } It appears that the class that actually validates the rules defined in accessRules doesn't actually know anything about my role that I've assigned it. CAccessControlFilter (for those of you who don't want to search for it for 40 minutes XD). Any ideas on how I can make use of the accessRules method when I combine it with Larry's approach? Thanks!
×
×
  • Create New...