blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-23 01:42:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auth_Controller is now able to display a better message if the user is unauthorized

Browse Source 
This message contains:
- the name of the called controller
- the name of the called method of the called controller
- all the possible permissions and related modes needed to acces to this content
This commit is contained in:
Paolo
2018-06-28 16:09:12 +02:00
parent 46e85a2317
commit 8f566e0499
3 changed files with 80 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/core/APIv1_Controller.php
+1 -1
View File
@@ -25,7 +25,7 @@ class APIv1_Controller extends REST_Controller
/**
* Checks if the caller is allowed to access to this content with the given permissions
* If it is not allowed will set the HTTP header with code 401
* Wrapper for _checkPermissions
* Wrapper for permissionlib->isEntitled
*/
private function _isAllowed($requiredPermissions)
{
application/core/Auth_Controller.php
+41 -4
View File
@@ -21,18 +21,55 @@ class Auth_Controller extends FHC_Controller
/**
* Checks if the caller is allowed to access to this content with the given permissions
* If it is not allowed will set the HTTP header with code 401
* Wrapper for _checkPermissions
* Wrapper for permissionlib->isEntitled
*/
private function _isAllowed($requiredPermissions)
{
// Loads permission lib
$this->load->library('PermissionLib');
// Checks if this user is entitled to access to this content
if (!$this->permissionlib->isEntitled($requiredPermissions, $this->router->method))
{
header('HTTP/1.0 401 Unauthorized');
echo 'You are not allowed to access to this content';
exit;
header('HTTP/1.0 401 Unauthorized'); // set the HTTP header as unauthorized
$this->load->library('EPrintfLib'); // loads the EPrintfLib to format the output
// Prints the main error message
$this->eprintflib->printError('You are not allowed to access to this content');
// Prints the called controller name
$this->eprintflib->printInfo('Controller name: '.$this->router->class);
// Prints the called controller method name
$this->eprintflib->printInfo('Method name: '.$this->router->method);
// Prints the required permissions needed to access to this method
$this->eprintflib->printInfo('Required permissions: '.$this->_rpsToString($requiredPermissions, $this->router->method));
exit; // immediately terminate the execution
}
}
private function _rpsToString($requiredPermissions, $method)
{
$strRequiredPermissions = ''; // string that contains all the required permissions needed to access to this method
if (isset($requiredPermissions[$method])) // if the called method is present in the permissions array
{
// If it is NOT then convert it into an array
$rpsMethod = $requiredPermissions[$method];
if (!is_array($rpsMethod))
{
$rpsMethod = array($rpsMethod);
}
// Copy all the permissions into $strRequiredPermissions separated by a comma
for ($i = 0; $i < count($rpsMethod); $i++)
{
$strRequiredPermissions .= $rpsMethod[$i].', ';
}
$strRequiredPermissions = rtrim($strRequiredPermissions, ', ');
}
return $strRequiredPermissions;
}
}
application/libraries/PermissionLib.php
+38 -31
View File
@@ -144,52 +144,59 @@ class PermissionLib
$permissions = array($requiredPermissions[$calledMethod]);
}
// Loops through the required permissions
for ($pCounter = 0; $pCounter < count($permissions); $pCounter++)
if (!isEmptyArray($permissions))
{
// Checks if the permission is well formatted
if (strpos($permissions[$pCounter], PermissionLib::PERMISSION_SEPARATOR) !== false)
// Loops through the required permissions
for ($pCounter = 0; $pCounter < count($permissions); $pCounter++)
{
// Retrives permission and required access type from the $requiredPermissions array
list($permission, $requiredAccessType) = explode(PermissionLib::PERMISSION_SEPARATOR, $permissions[$pCounter]);
$accessType = null;
// Checks if the required access type is compliant with the HTTP method (GET => r, POST => w)
if ($requestMethod == self::READ_HTTP_METHOD
&& strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false)
// Checks if the permission is well formatted
if (strpos($permissions[$pCounter], PermissionLib::PERMISSION_SEPARATOR) !== false)
{
$accessType = PermissionLib::SELECT_RIGHT; // S
// Retrives permission and required access type from the $requiredPermissions array
list($permission, $requiredAccessType) = explode(PermissionLib::PERMISSION_SEPARATOR, $permissions[$pCounter]);
$accessType = null;
// Checks if the required access type is compliant with the HTTP method (GET => r, POST => w)
if ($requestMethod == self::READ_HTTP_METHOD
&& strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false)
{
$accessType = PermissionLib::SELECT_RIGHT; // S
}
elseif ($requestMethod == self::WRITE_HTTP_METHOD
&& strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false)
{
$accessType = PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID
}
if ($accessType != null) // if compliant
{
// Checks if the user has the same required permissiond with the same required access type
$checkPermissions = $this->isBerechtigt($permission, $accessType);
// If the user has one of the permissionsm than exit the loop
if ($checkPermissions === true) break;
}
}
elseif ($requestMethod == self::WRITE_HTTP_METHOD
&& strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false)
else
{
$accessType = PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID
}
if ($accessType != null) // if compliant
{
// Checks if the user has the same required permissiond with the same required access type
$checkPermissions = $this->isBerechtigt($permission, $accessType);
// If the user has one of the permissionsm than exit the loop
if ($checkPermissions === true) break;
show_error('The given permission does not use the correct format');
}
}
else
{
show_error('The given permission does not use the correct format');
}
}
else
{
show_error('No permissions are set for this method, an empty array is given');
}
}
else
{
show_error('Your are trying to access to this content with a not valid HTTP method');
show_error('You are trying to access to this content with a not valid HTTP method');
}
}
else
{
show_error('The given permission array does not contain the called method');
show_error('The given permission array does not contain the called method or is not correctly set');
}
}
else