108 lines
2.8 KiB
PHP
108 lines
2.8 KiB
PHP
|
<?php
|
||
|
|
use Phalcon\Acl;
|
||
|
|
use Phalcon\Acl\Role;
|
||
|
|
use Phalcon\Acl\Resource;
|
||
|
|
use Phalcon\Events\Event;
|
||
|
|
use Phalcon\Mvc\User\Plugin;
|
||
|
|
use Phalcon\Mvc\Dispatcher;
|
||
|
|
use Phalcon\Acl\Adapter\Memory as AclList;
|
||
|
|
/**
|
||
|
|
* SecurityPlugin
|
||
|
|
*
|
||
|
|
* This is the security plugin which controls that users only have access to the modules they're assigned to
|
||
|
|
*/
|
||
|
|
class SecurityPlugin extends Plugin {
|
||
|
|
/**
|
||
|
|
* Returns an existing or new access control list
|
||
|
|
*
|
||
|
|
* @return s AclList
|
||
|
|
*/
|
||
|
|
public function getAcl() {
|
||
|
|
if (! isset ( $this->persistent->acl )) {
|
||
|
|
$acl = new AclList ();
|
||
|
|
// Register roles
|
||
|
|
$roles = array (
|
||
|
|
'users' => new Role ( 'Users' ),
|
||
|
|
'guests' => new Role ( 'Guests' )
|
||
|
|
);
|
||
|
|
foreach ( $roles as $role ) {
|
||
|
|
$acl->addRole ( $role );
|
||
|
|
}
|
||
|
|
// Private area resources
|
||
|
|
$privateResources = array ();
|
||
|
|
foreach ( $privateResources as $resource => $actions ) {
|
||
|
|
$acl->addResource ( new Resource ( $resource ), $actions );
|
||
|
|
}
|
||
|
|
// Public area resources
|
||
|
|
$publicResources = array (
|
||
|
|
'index' => array (
|
||
|
|
'index'
|
||
|
|
),
|
||
|
|
'logs' => array (
|
||
|
|
'index'
|
||
|
|
),
|
||
|
|
'errors' => array (
|
||
|
|
'show401',
|
||
|
|
'show404',
|
||
|
|
'show500'
|
||
|
|
),
|
||
|
|
'session' => array (
|
||
|
|
'index',
|
||
|
|
'register',
|
||
|
|
'start',
|
||
|
|
'end'
|
||
|
|
)
|
||
|
|
);
|
||
|
|
foreach ( $publicResources as $resource => $actions ) {
|
||
|
|
$acl->addResource ( new Resource ( $resource ), $actions );
|
||
|
|
}
|
||
|
|
// Grant access to public areas to both users and guests
|
||
|
|
foreach ( $roles as $role ) {
|
||
|
|
foreach ( $publicResources as $resource => $actions ) {
|
||
|
|
foreach ( $actions as $action ) {
|
||
|
|
$acl->allow ( $role->getName (), $resource, $action );
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// Grant access to private area to role Users
|
||
|
|
foreach ( $privateResources as $resource => $actions ) {
|
||
|
|
foreach ( $actions as $action ) {
|
||
|
|
$acl->allow ( 'Guests', $resource, $action );
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// The acl is stored in session, APC would be useful here too
|
||
|
|
$this->persistent->acl = $acl;
|
||
|
|
}
|
||
|
|
return $this->persistent->acl;
|
||
|
|
}
|
||
|
|
/**
|
||
|
|
* This action is executed before execute any action in the application
|
||
|
|
*
|
||
|
|
* @param Event $event
|
||
|
|
* @param Dispatcher $dispatcher
|
||
|
|
* @return bool
|
||
|
|
*/
|
||
|
|
public function beforeDispatch(Event $event, Dispatcher $dispatcher) {
|
||
|
|
$auth = $this->session->get ( 'auth' );
|
||
|
|
if (! $auth) {
|
||
|
|
$role = 'Guests';
|
||
|
|
} else {
|
||
|
|
$role = 'Users';
|
||
|
|
}
|
||
|
|
$controller = $dispatcher->getControllerName ();
|
||
|
|
$controller = strtolower ( $controller );
|
||
|
|
$action = $dispatcher->getActionName ();
|
||
|
|
$controller = strtolower ( $action );
|
||
|
|
$acl = $this->getAcl ();
|
||
|
|
$allowed = $acl->isAllowed ( $role, $controller, $action );
|
||
|
|
if ($allowed != Acl::ALLOW) {
|
||
|
|
$dispatcher->forward(array(
|
||
|
|
'controller' => 'errors',
|
||
|
|
'action' => 'show401'
|
||
|
|
));
|
||
|
|
$this->session->destroy();
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
?>
|