cakePHP被授权不起作用

时间:2012-05-30 14:53:50

标签: php cakephp authentication controller

我有一个表,用于拆分链接到users表(user_level_id)的用户(user_levels)。 5级是管理员。

我想限制某些操作被查看和理解我可以使用isAuthorized来执行此操作。我按照书去了,我很确定我做对了,但它不起作用。它允许任何登录用户仍然访问任何操作,尽管我在isAuthorized中否认它。

这是我的代码:

 App Controller:public $components = array(
    'Session',

    'Auth' => array(
        'loginAction' => array(
            'controller' => 'users',
            'action' => 'login',
        ),
        'authError' => "Your username and password is incorrect, please try again.",
        'authenticate' => array(
            'Form' => array(
                'scope' => array('User.user_status_id' => 1)
            )
        ),
        'redirect' => array("controller" => "users", "action" => "profile"),
        'loginRedirect' => array("controller" => "users", "action" => "profile")
    )
);

public function isAuthorized($user = null) {
    if($this->Auth->user("user_level_id") == 5) {
        return true;
    }
    // Default deny
    return false;
}

public function beforeFilter() {
    $this->Auth->allow("display");
   if($this->Auth->loggedIn() == true) {
       $this->set("user_name",$this->Auth->user("first_name")." ".$this->Auth->user("last_name"));
       $this->set("loggedIn",true);
       if($this->Auth->user("user_type_id") == 5) {
           $this->set("navigation","navigation_admin");
       } else {
           $this->set("navigation","navigation_loggedin");
       }
   } else {
       $this->set("loggedIn",false);
       $this->set("navigation","navigation_notloggedin");
   }

}

 }

 // Users Controller:

 public function beforeFilter() {
    $this->Auth->allow("login");
    parent::beforeFilter();
}

public function isAuthorized($user = null) {
    if($this->Auth->user("user_level_id") == 5) {

        return true;
    }
    // Default deny
    return parent::isAuthorized($user);
}

1 个答案:

答案 0 :(得分:6)

看起来你只是错过了配置,只是告诉AuthComponent使用isAuthorized()

'Auth' => array(
        'loginAction' => array(
            'controller' => 'users',
            'action' => 'login',
        ),
        'authError' => "Your username and password is incorrect, please try again.",
        'authenticate' => array(
            'Form' => array(
                'scope' => array('User.user_status_id' => 1)
            )
        ),
        'authorize' => array('Controller'), // <- here
        'redirect' => array("controller" => "users", "action" => "profile"),
        'loginRedirect' => array("controller" => "users", "action" => "profile")
    )