From 8f566e04991b841069d24857c1cbe16b21a279ba Mon Sep 17 00:00:00 2001 From: Paolo Date: Thu, 28 Jun 2018 16:09:12 +0200 Subject: [PATCH] Auth_Controller is now able to display a better message if the user is unauthorized This message contains: - the name of the called controller - the name of the called method of the called controller - all the possible permissions and related modes needed to acces to this content --- application/core/APIv1_Controller.php | 2 +- application/core/Auth_Controller.php | 45 ++++++++++++++-- application/libraries/PermissionLib.php | 69 ++++++++++++++----------- 3 files changed, 80 insertions(+), 36 deletions(-) diff --git a/application/core/APIv1_Controller.php b/application/core/APIv1_Controller.php index 927265346..e3ffcb533 100644 --- a/application/core/APIv1_Controller.php +++ b/application/core/APIv1_Controller.php @@ -25,7 +25,7 @@ class APIv1_Controller extends REST_Controller /** * Checks if the caller is allowed to access to this content with the given permissions * If it is not allowed will set the HTTP header with code 401 - * Wrapper for _checkPermissions + * Wrapper for permissionlib->isEntitled */ private function _isAllowed($requiredPermissions) { diff --git a/application/core/Auth_Controller.php b/application/core/Auth_Controller.php index fe661f1e3..1af83ba2c 100644 --- a/application/core/Auth_Controller.php +++ b/application/core/Auth_Controller.php @@ -21,18 +21,55 @@ class Auth_Controller extends FHC_Controller /** * Checks if the caller is allowed to access to this content with the given permissions * If it is not allowed will set the HTTP header with code 401 - * Wrapper for _checkPermissions + * Wrapper for permissionlib->isEntitled */ private function _isAllowed($requiredPermissions) { // Loads permission lib $this->load->library('PermissionLib'); + // Checks if this user is entitled to access to this content if (!$this->permissionlib->isEntitled($requiredPermissions, $this->router->method)) { - header('HTTP/1.0 401 Unauthorized'); - echo 'You are not allowed to access to this content'; - exit; + header('HTTP/1.0 401 Unauthorized'); // set the HTTP header as unauthorized + + $this->load->library('EPrintfLib'); // loads the EPrintfLib to format the output + + // Prints the main error message + $this->eprintflib->printError('You are not allowed to access to this content'); + // Prints the called controller name + $this->eprintflib->printInfo('Controller name: '.$this->router->class); + // Prints the called controller method name + $this->eprintflib->printInfo('Method name: '.$this->router->method); + // Prints the required permissions needed to access to this method + $this->eprintflib->printInfo('Required permissions: '.$this->_rpsToString($requiredPermissions, $this->router->method)); + + exit; // immediately terminate the execution } } + + private function _rpsToString($requiredPermissions, $method) + { + $strRequiredPermissions = ''; // string that contains all the required permissions needed to access to this method + + if (isset($requiredPermissions[$method])) // if the called method is present in the permissions array + { + // If it is NOT then convert it into an array + $rpsMethod = $requiredPermissions[$method]; + if (!is_array($rpsMethod)) + { + $rpsMethod = array($rpsMethod); + } + + // Copy all the permissions into $strRequiredPermissions separated by a comma + for ($i = 0; $i < count($rpsMethod); $i++) + { + $strRequiredPermissions .= $rpsMethod[$i].', '; + } + + $strRequiredPermissions = rtrim($strRequiredPermissions, ', '); + } + + return $strRequiredPermissions; + } } diff --git a/application/libraries/PermissionLib.php b/application/libraries/PermissionLib.php index 34744ef3a..dbfd2a018 100644 --- a/application/libraries/PermissionLib.php +++ b/application/libraries/PermissionLib.php @@ -144,52 +144,59 @@ class PermissionLib $permissions = array($requiredPermissions[$calledMethod]); } - // Loops through the required permissions - for ($pCounter = 0; $pCounter < count($permissions); $pCounter++) + if (!isEmptyArray($permissions)) { - // Checks if the permission is well formatted - if (strpos($permissions[$pCounter], PermissionLib::PERMISSION_SEPARATOR) !== false) + // Loops through the required permissions + for ($pCounter = 0; $pCounter < count($permissions); $pCounter++) { - // Retrives permission and required access type from the $requiredPermissions array - list($permission, $requiredAccessType) = explode(PermissionLib::PERMISSION_SEPARATOR, $permissions[$pCounter]); - - $accessType = null; - - // Checks if the required access type is compliant with the HTTP method (GET => r, POST => w) - if ($requestMethod == self::READ_HTTP_METHOD - && strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false) + // Checks if the permission is well formatted + if (strpos($permissions[$pCounter], PermissionLib::PERMISSION_SEPARATOR) !== false) { - $accessType = PermissionLib::SELECT_RIGHT; // S + // Retrives permission and required access type from the $requiredPermissions array + list($permission, $requiredAccessType) = explode(PermissionLib::PERMISSION_SEPARATOR, $permissions[$pCounter]); + + $accessType = null; + + // Checks if the required access type is compliant with the HTTP method (GET => r, POST => w) + if ($requestMethod == self::READ_HTTP_METHOD + && strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false) + { + $accessType = PermissionLib::SELECT_RIGHT; // S + } + elseif ($requestMethod == self::WRITE_HTTP_METHOD + && strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false) + { + $accessType = PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID + } + + if ($accessType != null) // if compliant + { + // Checks if the user has the same required permissiond with the same required access type + $checkPermissions = $this->isBerechtigt($permission, $accessType); + + // If the user has one of the permissionsm than exit the loop + if ($checkPermissions === true) break; + } } - elseif ($requestMethod == self::WRITE_HTTP_METHOD - && strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false) + else { - $accessType = PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID - } - - if ($accessType != null) // if compliant - { - // Checks if the user has the same required permissiond with the same required access type - $checkPermissions = $this->isBerechtigt($permission, $accessType); - - // If the user has one of the permissionsm than exit the loop - if ($checkPermissions === true) break; + show_error('The given permission does not use the correct format'); } } - else - { - show_error('The given permission does not use the correct format'); - } + } + else + { + show_error('No permissions are set for this method, an empty array is given'); } } else { - show_error('Your are trying to access to this content with a not valid HTTP method'); + show_error('You are trying to access to this content with a not valid HTTP method'); } } else { - show_error('The given permission array does not contain the called method'); + show_error('The given permission array does not contain the called method or is not correctly set'); } } else