我有一个表,用于拆分链接到users表(user_level_id)的用户(user_levels)。 5级是管理员。
我想限制某些操作被查看和理解我可以使用isAuthorized来执行此操作。我按照书去了,我很确定我做对了,但它不起作用。它允许任何登录用户仍然访问任何操作,尽管我在isAuthorized中否认它。
这是我的代码:
App Controller:public $components = array(
'Session',
'Auth' => array(
'loginAction' => array(
'controller' => 'users',
'action' => 'login',
),
'authError' => "Your username and password is incorrect, please try again.",
'authenticate' => array(
'Form' => array(
'scope' => array('User.user_status_id' => 1)
)
),
'redirect' => array("controller" => "users", "action" => "profile"),
'loginRedirect' => array("controller" => "users", "action" => "profile")
)
);
public function isAuthorized($user = null) {
if($this->Auth->user("user_level_id") == 5) {
return true;
}
// Default deny
return false;
}
public function beforeFilter() {
$this->Auth->allow("display");
if($this->Auth->loggedIn() == true) {
$this->set("user_name",$this->Auth->user("first_name")." ".$this->Auth->user("last_name"));
$this->set("loggedIn",true);
if($this->Auth->user("user_type_id") == 5) {
$this->set("navigation","navigation_admin");
} else {
$this->set("navigation","navigation_loggedin");
}
} else {
$this->set("loggedIn",false);
$this->set("navigation","navigation_notloggedin");
}
}
}
// Users Controller:
public function beforeFilter() {
$this->Auth->allow("login");
parent::beforeFilter();
}
public function isAuthorized($user = null) {
if($this->Auth->user("user_level_id") == 5) {
return true;
}
// Default deny
return parent::isAuthorized($user);
}
答案 0 :(得分:6)
看起来你只是错过了配置,只是告诉AuthComponent使用isAuthorized()
。
'Auth' => array(
'loginAction' => array(
'controller' => 'users',
'action' => 'login',
),
'authError' => "Your username and password is incorrect, please try again.",
'authenticate' => array(
'Form' => array(
'scope' => array('User.user_status_id' => 1)
)
),
'authorize' => array('Controller'), // <- here
'redirect' => array("controller" => "users", "action" => "profile"),
'loginRedirect' => array("controller" => "users", "action" => "profile")
)