How to use ACL with Cake PHP 1.2.x?
This article is also available in the following languages:
This tutorial will brief you on how to use Acl in CakePHP 1.2.x versions. I had tough time figuring this out. But with help of Gwoo, AD7Six & others, and doing debugging and reading code, here comes the tutorial.
This tutorial assumes you know basic concept of ACL and what it is suppossed to be used for? If not then please read http://manual.cakephp.org/chapter/acl
You can setup the databases needed for ACL through console command
Now we would setup some higher level aros and acos for initial setup. You could do it through console. But I prefered to do it through controller, nothing special, just did it that way!
Think of Aros (could be Users, service, etc) as the one who is requesting access to Acos (could be controller, actions or services). But in this example, we will limit Aros as the users and Acos as the controllers. We will setup the following Aros (users):
We will setup the following Acos (controllers):
This would add two acos 'User' and 'Post'. But now you think if Acos is controller then why not have 'Posts' instead of 'Post'? Good question. This is because usually a controller's action can be divided into four types of action 'create', 'read', 'update' or 'delete' which are performed on a single or group of records belonging to a model. Hence, in this approach we going at record level Access Control. We want to make sure whether the current Aro (a User) has access to do 'C', 'R', 'U' or 'D' action on the Aco ( a record for eg. A post). If yes, then let him do the action otherwise don't. Now the code, that shows you the manual way to create aros and acos as discussed above.
Above you saw that using Acl, we granted the Admin full rights over 'User' and 'Post' Acos. ie. Admin can do CRUD for all user and post, which in turn means that for any controller action which involves creating, reading, updating or deleting a 'User' or 'Post' record, Admin group is allowed to do it. So does any user that belongs to group Admin.
'User' aro is allowed to do only create & read action for 'Post' acos, which means that a 'User' group in general has access to a controller action that can create and read 'post' records, which is what we want. We want that any user that belongs to 'User' group can create new posts and read posts. But we do not want all users (aros) to 'update' or 'delete' any 'Post' (acos) they want. Which means, that belonging to a 'User' group does not give you any previledges to 'U', 'D' actions of 'Post' (acos). But you want to have 'U', 'D' action for the user who created that Post!! I will get to giving user who created post the full CRUD rights later on, but this explanation was just to clear your concepts. Note that, above we did not do any 'allow' statement for 'User' aco, so this means that by default 'User' group and its children, don't have access to 'CRUD' on 'User' records (acos). A user himself only has the CRUD right for his record and not other users. That's why we did it that way :)
'Guest' aro is allowed to only 'create' action for 'User' acos. ie. Guest can only register a new user account, and is denied all other access to everything else.
Now that we have the basic setup done, we would want to get the aros and acos populated as and when user is added to system. Below is shown the code on how to create aros and acos manually and also how to setup the permissions.
Above you saw, how to create aro and aco each time a new user is registered on the system. Also you saw how to allow a user himself the full CRUD previledges on his own record. Say User 'a' with user id '5' just registered on the site. Above code, will create an aro with alias 'User::5' and an aco with alias 'User::5' and will create an entry in aros_acos table that would let aro with alias 'User::5' CRUD rights over aco with alias 'User::5'. Now no other user has access User 'a' except User 'a' and anyone who belongs to 'Admin' aro group. To verify, give following code a try
When you visit the above page (http://localhost/test/view), you will get 'access denied'. Now change the $curLoggedInUserId = 5, and try visiting the same page again, you will get 'allowed access'. This is because the logged in user id now is the same as user 'a'. And we had defined that user 'a' has full rights on user 'a' record. Note what happens when you have $curLoggedInUserId = 1!! You still get 'allowed access', now why did this happen? Just because User with userid 1 belongs to Admin group and he has full CRUD rights over any 'User' aco. Above code is a very crude code and is meant just to demonstrate the purpose of Acl check & is not meant to be used in production use.
Above was a manual & tedious way to create aros and acos. Now I will now show you the magical way to create aros and acos without much effort on your end. All you have to do is implement the Acl Behavior which comes with cake 1.2 distribution. Below is the code that you would have to add to 'Post' Model.
Above code, will now automatically create a new aco for every new post that is posted. The Acl behavior takes care of all details. Just so you know, in Acl behavior, there is 'afterSave' callback, which would be called once the save callback is completed in current model.
Acl behavior would even delete the aco whenever the post is deleted, without any extra effort on your end. Isn't this cool? Hell yaaa! it is... Now you would want to setup the permissions on the newly create 'aco'? How do you do that, check out the code below:
So if a save is successful from Post then we know that the Aco is created and then all we have to do is setup proper aro and aco nodes and then give the required permissions and we are done!!
I would welcome feedback via comments and suggestions. Let me know if you have any troubles implementing this. Till then enjoy baking.
Cheers,
Ketan Patel
You can setup the databases needed for ACL through console command
cake acl initdb
Now we would setup some higher level aros and acos for initial setup. You could do it through console. But I prefered to do it through controller, nothing special, just did it that way!
Think of Aros (could be Users, service, etc) as the one who is requesting access to Acos (could be controller, actions or services). But in this example, we will limit Aros as the users and Acos as the controllers. We will setup the following Aros (users):
- Admin
- |-->User::1
- User
- Guest
We will setup the following Acos (controllers):
- User
- Post
This would add two acos 'User' and 'Post'. But now you think if Acos is controller then why not have 'Posts' instead of 'Post'? Good question. This is because usually a controller's action can be divided into four types of action 'create', 'read', 'update' or 'delete' which are performed on a single or group of records belonging to a model. Hence, in this approach we going at record level Access Control. We want to make sure whether the current Aro (a User) has access to do 'C', 'R', 'U' or 'D' action on the Aco ( a record for eg. A post). If yes, then let him do the action otherwise don't. Now the code, that shows you the manual way to create aros and acos as discussed above.
Controller Class:
<?php
class InitAclController extends AppController
{
var $name = 'InitAcl';
var $component = array('Acl');
var $uses = array();
function setupAcl()
{
$aro = new aro();
$aro->create();
$aro->save(array(
'model'=>'User',
'foreign_key'=>null,
'parent_id'=>null,
'alias'=>'Admin'));
$aro->create();
$aro->save(array(
'model'=>'User',
'foreign_key'=>null,
'parent_id'=>null,
'alias'=>'User'));
$aro->create();
$aro->save(array(
'model'=>'User',
'foreign_key'=>null,
'parent_id'=>null,
'alias'=>'Guest'));
$parent = $aro->findByAlias('Admin');
$parentId = $parent['Aro']['id'];
$aro->create();
$aro->save(array(
'model'=>'User',
'foreign_key'=>1,
'parent_id'=>$parentId,
'alias'=>'User::1'));
$aco = new Aco();
$aco->create();
$aco->save(array(
'model'=>'User',
'foreign_key'=>null,
'parent_id'=>null,
'alias'=>'User'));
$aco->create();
$aco->save(array(
'model'=>'Post',
'foreign_key'=>null,
'parent_id'=>null,
'alias'=>'Post'));
}
// Give admin full control over acos 'User' & 'Post'
$this->Acl->allow('Admin', 'User', '*');
$this->Acl->allow('Admin', 'Post', '*');
// Give the user group only create & read access for 'Post'
$this->Acl->allow('User', 'Post', array('create', 'read'));
// Give the Guests only create access for 'User'
$this->Acl->allow('Guest', 'User', 'create');
}
?>
Above you saw that using Acl, we granted the Admin full rights over 'User' and 'Post' Acos. ie. Admin can do CRUD for all user and post, which in turn means that for any controller action which involves creating, reading, updating or deleting a 'User' or 'Post' record, Admin group is allowed to do it. So does any user that belongs to group Admin.
'User' aro is allowed to do only create & read action for 'Post' acos, which means that a 'User' group in general has access to a controller action that can create and read 'post' records, which is what we want. We want that any user that belongs to 'User' group can create new posts and read posts. But we do not want all users (aros) to 'update' or 'delete' any 'Post' (acos) they want. Which means, that belonging to a 'User' group does not give you any previledges to 'U', 'D' actions of 'Post' (acos). But you want to have 'U', 'D' action for the user who created that Post!! I will get to giving user who created post the full CRUD rights later on, but this explanation was just to clear your concepts. Note that, above we did not do any 'allow' statement for 'User' aco, so this means that by default 'User' group and its children, don't have access to 'CRUD' on 'User' records (acos). A user himself only has the CRUD right for his record and not other users. That's why we did it that way :)
'Guest' aro is allowed to only 'create' action for 'User' acos. ie. Guest can only register a new user account, and is denied all other access to everything else.
Now that we have the basic setup done, we would want to get the aros and acos populated as and when user is added to system. Below is shown the code on how to create aros and acos manually and also how to setup the permissions.
Controller Class:
<?php
class UsersController extends AppController
{
var $name = 'Users';
var $components = array('Acl');
function register()
{
if(!empty($this->data))
{
$this->User->data = $this->data;
if ($this->User->validates())
{
if ($this->User->save())
{
$aro = new Aro();
$parent = $aro->findByAlias('User');
$parentId = $parent['aro']['id'];
$aro->create();
$alias = $this->User->name.'::'.$this->User->id;
$aro->save(
'model' => $this->User->name,
'foreign_key' => $this->User->id,
'parent_id' => $parentId,
'alias' => $alias
);
$aco = new Aco();
$parent = $aco->findByAlias('User');
$parentId = $parent['aco']['id'];
$aco->create();
$aco->save(
'model' => $this->User->name,
'foreign_key' => $this->User->id,
'parent_id' => $parentId,
'alias' => $alias
);
$this->Acl->allow(
$alias,
$alias,
array('read','update'));
}
}
}
}
}
?>
Above you saw, how to create aro and aco each time a new user is registered on the system. Also you saw how to allow a user himself the full CRUD previledges on his own record. Say User 'a' with user id '5' just registered on the site. Above code, will create an aro with alias 'User::5' and an aco with alias 'User::5' and will create an entry in aros_acos table that would let aro with alias 'User::5' CRUD rights over aco with alias 'User::5'. Now no other user has access User 'a' except User 'a' and anyone who belongs to 'Admin' aro group. To verify, give following code a try
Controller Class:
<?php
class TestController extends AppController
{
var $name = 'Test';
var $components = array('Acl');
var $uses = array('User');
var $curLoggedInUserId = 3;
function view()
{
$aroAlias = 'User::'.$curLoggedInUserId;
$acoAlias = 'User::5';
if ($this->Acl->check($aroAlias, $acoAlias, 'read'))
{
echo 'Read access allowed for User Id'.$curLoggedInUserId;
}
else
{
echo 'Read access denied for User Id'.$curLoggedInUserId;
}
}
}
?>
When you visit the above page (http://localhost/test/view), you will get 'access denied'. Now change the $curLoggedInUserId = 5, and try visiting the same page again, you will get 'allowed access'. This is because the logged in user id now is the same as user 'a'. And we had defined that user 'a' has full rights on user 'a' record. Note what happens when you have $curLoggedInUserId = 1!! You still get 'allowed access', now why did this happen? Just because User with userid 1 belongs to Admin group and he has full CRUD rights over any 'User' aco. Above code is a very crude code and is meant just to demonstrate the purpose of Acl check & is not meant to be used in production use.
Above was a manual & tedious way to create aros and acos. Now I will now show you the magical way to create aros and acos without much effort on your end. All you have to do is implement the Acl Behavior which comes with cake 1.2 distribution. Below is the code that you would have to add to 'Post' Model.
Model Class:
<?php
class Post extends AppModel{
var $name = 'Post';
var $actsAs = array('Acl'=>'controlled');
// 'controlled' means you want to create a 'aco'
// 'requester' means you want to create an 'aro'
/**
* Returns the parent Alias for current
*/
function parentNode()
{
return $this->name;
}
}
?>
Above code, will now automatically create a new aco for every new post that is posted. The Acl behavior takes care of all details. Just so you know, in Acl behavior, there is 'afterSave' callback, which would be called once the save callback is completed in current model.
Acl behavior would even delete the aco whenever the post is deleted, without any extra effort on your end. Isn't this cool? Hell yaaa! it is... Now you would want to setup the permissions on the newly create 'aco'? How do you do that, check out the code below:
Controller Class:
<?php
class PostsController extends AppController {
var $name = 'Posts';
var $helpers = array('Html', 'Form' );
var $uses = array('Post');
var $components = array('Acl');
function add() {
if(!empty($this->data)) {
$this->Post->data = $this->data;
if ($this->Post->validates())
{
$this->Post->create();
if($this->Post->save($this->data))
{
$acoNode = array('model'=>$this->Post->name,
'foreign_key' =>$this->Post->id);
$aroNode = array('model'=>'User',
'foreign_key'=>$this->getUserId());
// User has full control of the post he created
$this->Acl->allow($aroNode, $acoNode, '*');
}
}
}
}
?>
So if a save is successful from Post then we know that the Aco is created and then all we have to do is setup proper aro and aco nodes and then give the required permissions and we are done!!
I would welcome feedback via comments and suggestions. Let me know if you have any troubles implementing this. Till then enjoy baking.
Cheers,
Ketan Patel
use Aro;
$this->Acl->allow('Admin', 'User', '*'); and rest should be in function otherwise "Invalid use of $this" syntax error occurs
am i right?
"var $component = array('Acl');"
instead
"var $components = array('Acl');"
C O M P O N E N T S
aaaaaaaaa, shit!
did you set belongsTo in both models? aro and acl?
var $hasAndBelongsToMany = array(...)
using the console it does that automatically when creating the models
I got another problem - and (like many others) don't get it to work properly
database and its content is all set
but it always throws n error like:
Warning (512): DbAcl::allow() - Invalid node [CORE\cake\libs\controller\components\acl.php, line 367]
while trying to allow something:
$this->Acl->allow('groups', '/posts');
i tried like every tutorial around
before this one, i had the "fellowship of the ring tut."
with:
$this->Acl->allow('Frodo', 'rings');
some problem...
this is inside the testing() action in the tests_controller.php
I knew it had to be something silly I missed, thanks alot :)
I'm new to CakePHP and am halfway through creating my first proper application and have got to the point where I need ACL. I have followed the guide above upto the point where I try and and add ACOs/AROs to the database. I have tried the script above and doing it in the console but both give me this error:
The table are definitely there as I can see aros, acos and aros_acos in my applications database (in phpmyadmin) along with my existing tables. I have tried the same thing on 2 servers now with no luck.
I am hoping someone can help as I am out of ideas, searching for that error in quotes gives me 2 results on Google.
Any help would be much appreciated :)
Go ahead and waste someone else's time. People here are too busy getting things done, and helping others.
Well there's your problem.
Specifically regarding this "tutorial", again it is simply too vague. Being a trained designer, one of the first rules of any kind of good design is too make instructions as simple and straight-forward as possible, while still being as detailed as possible. In short, ANYONE should be able to read the instructions and at least get to a point where they have a basic working prototype.
This "tutorial" leaves a lot to be desired, infered, and assumed, which leaves big windows for mistakes. Where is this "ketan" person starting? Where is the code added to? Why are there amateur mistakes like missing brackets, etc...?
Furthermore, the console barely works in Mac OSX, and the 'cake acl initdb' has been deprecated for 'cake schema run create DbAcl' which doesn't actually work [on Mac OSX]. You get a MySQL connect error. But if you want to run it, the proper command is: ./console/cake schema run create DbAcl
Moreover, the correction to line 5 in the InitAclController class that Mike Green made above is incomplete. Because there is only a missing 's', it is difficult at first glance to know what he is correcting. So here's my correction of Mike's correction to line 5 in the InitAclController class:
Line 5 is incorrect in that it defines the variable $component. This variable name MUST BE PLURAL, as in $components. So the correct code should read:
var $components = array('Acl');
Next, in the InitAclController class, where the $#@& does the following code go? It obviously doesn't go where "ketan" put it because I get a parsing error.
// Give admin full control over acos 'User' & 'Post'
$this->Acl->allow('Admin', 'User', '*');
$this->Acl->allow('Admin', 'Post', '*');
// Give the user group only create & read access for 'Post'
$this->Acl->allow('User', 'Post', array('create', 'read'));
// Give the Guests only create access for 'User'
$this->Acl->allow('Guest', 'User', 'create');
My advice is to take this article down and do some serious revision. I feel like CakePHP is one big dis-information campaign designed for rapid frustration rather than rapid development.
No offense to anyone, but this is a nightmare!!! This tutorial does absolutely nothing for me.
Parse error: syntax error, unexpected T_VARIABLE, expecting T_FUNCTION in /VolunteerCake/controllers/init_acl_controller.php on line 62
Which appears to be this bit of code:
// Give admin full control over acos 'User' & 'Post'
$this->Acl->allow('Admin', 'User', '*');
$this->Acl->allow('Admin', 'Post', '*');
// Give the user group only create & read access for 'Post'
$this->Acl->allow('User', 'Post', array('create', 'read'));
// Give the Guests only create access for 'User'
$this->Acl->allow('Guest', 'User', 'create');
Is there a missing function, or should these be moved inside the function in your example?
First, the Alias for the aCos, I needed to put them in their pluralize way else I was getting not defined node error, when the Acl was looking for a match-up.
So, in every models/model.php I use this for parentNode:
Model Class:
<?phpvar $name = 'Tag';
var $actsAs = array('Acl'=>'controlled');
function parentNode()
{
return Inflector::pluralize($this->name);
}
?>
I don't remember if I've written the alias by hand for the aCos. But I'm sure I had to write them first for the aRos of the groups.
Here is the parentNode for the model/user.php
Model Class:
<?phptaken from here : http://realm3.com/articles/setting_up_users_groups_withacl_and_auth_in_cake_1.2.phpfunction parentNode( ) {
if (!$this->id) {
return null;
}
$data = $this->read();
if (!$data['User']['group_id']){
return null;
} else {
return array('model' => 'Group', 'foreign_key' => $data['User']['group_id']);
}
}
?>
Note: the parentNode for the Group is the same as the ones for aCos.
----
Then for the creation of your users aro, aco & aros_acos :
Here's a simpler version of the one written in this article :
Controller Class:
<?php
no need to call a new aro, aco stuff. And the best is that you'll add an alias to your aRo directly.if ($this->User->save($this->data)) {
//Set the alias to be used in Aco, Aro & acos_aros table
$alias = $this->User->name.'::'.$this->User->id;
//Only sets the alias of the already pointed Aro
$this->Acl->Aro->save(array('alias' => $alias));
//set the Aco $parent node aliased as the controllers (plural, ie. Users)
$parent = $this->Acl->Aco->findByAlias($this->name);
//create a Aco for our user
$this->Acl->Aco->save(array(
'model' => $this->User->name,
'foreign_key' => $this->User->id,
'parent_id' => $parent['Aco']['id'],
'alias' => $alias ));
//Sets permissions
$this->Acl->allow(
$alias,
$alias,
array('read','update'));
$this->Session->setFlash(__('The User has been saved', true));
$this->redirect(array('action'=>'index'));
} else {.......
?>
Here's a little plus: as a requester, if you delete the user, it's aRo will also be deleted automatically. But the aCo will stay there. Use this in the delete function :
Controller Class:
<?php
That way, the aCo table doesn't get filled up with empty references.//delete associated Aco
$aco = $this->Acl->Aco->findByAlias($this->User->name.'::'.$this->User->id);
$this->Acl->Aco->del($aco['Aco']['id']);
if ($this->User->del($id)) {
$this->Session->setFlash(__('User deleted', true));
$this->redirect(array('action'=>'index'));
}
?>
Cheers. (I'm soooooo happy to finally have made this work :P )
AppController.php :
Controller Class:
<?php var $components = array('Acl','Auth');?>You must specify the type of authorisation somewhere in the
Controller Class:
<?php function beforeFilter(){$this->Auth->authorize = 'crud';
}?>
In fact, using the auth component, you get different ways to check the authorisation. Method described here is 'crud'
Don't do like me trying to make it work set to 'actions' ;)
Indeed, I find it really more simple to use a 'crud' than an 'actions' based authorisation (I don't have to create acos for every actions).
However, I'm still looking how to 'map' actions as C,R,U or D actions....
First off, THANK you for adding in the 'crud' method. I never came across that in all of my many nights exploring documentation.
How do you get the Auth-> login/logout to work with the ACL? I can get the Auth component to work wonderfully using controller method. Also, when I use the CRUD method, as long as I have the Acos listed in the plural format, they work... except login and logout. Any ideas?
https://trac.cakephp.org/ticket/4190
Unless I'm missing something, Cake's rewritten Acl is horribly broken, because you cannot do an Acl->allow followed by an Acl->deny (or vice versa) for the same Aro/Aco combination. Instead Cake will overwrite the previously allowed fields with 0 (i.e. inherited).
This has provided a major headache as I was trying to update a project to Cake 1.2 and could not understand why the ACL stuff was totally butchering things.
Parse error: syntax error, unexpected T_VARIABLE, expecting T_FUNCTION in C:\wamp\www\cakephp\test\controllers\init_acl_controller.php on line 62
Can you help me?
EDIT: I found it finally. Look in app/config/sql/db_acl/sql
Thanks for any help, David
My ARO's
|-ADMINMy ACO's|-USER
|-User::5
|-GUEST
ROOTOk ... I just looked at mysql logs, I see that it is checking only for my POSTS and ROOT aco_id (aco_id's: POSTS=5, ROOT=1)|-USERS
|-User::5
|-POSTS
|-Post::1
|-Post::2
|-Post::3
...Seems that it should also check for aco_id that matches the record I have chose to editWHERE Permission.aro_id = 2 AND Permission.aco_id IN (5, 1)
...
WHERE Permission.aro_id = 4 AND Permission.aco_id IN (5, 1)
I got the same problem. I set all Aro and Aco with Acl and Auth but it won't check the permission at the record level. Any suggestion to this?
The SQL is constructed in the file cake/console/libs/acl.php from line 317 onwards (in the latest beta version).
Hope that helps you.
I have created a new behavior Acl2 that extends AclBehavior
Model Class:
<?phpvar $actsAs = array('Acl'=>'controlled','Acl2'=>'requester');
?>
It's right so?
---------------------------------------------------------
Using allow and deny method as the following code, I notice that the last call (deny) overwrite the first (allow).
Controller Class:
<?php$this->Acl->allow($aroAlias, $acoAlias, '*');
$this->Acl->deny($aroAlias, $acoAlias, 'read');
?>
the result in db is:
CRUD: 0 -1 0 0
but the result attended for me is:
CRUD: 1 -1 1 1
An other example:
Controller Class:
<?php$this->Acl->allow($aroAlias, $acoAlias, 'create');
$this->Acl->allow($aroAlias, $acoAlias, 'read');
?>
the result in db is:
CRUD: 0 1 0 0
but the result attended for me is:
CRUD: 1 1 0 0
There is a way to call method allow and deny on single action CRUD without overwrite other action CRUD?
Sorry for my english,
I hope I have been clear.
Thanks to all
(1) The ACL page in the Cake Manual for Cake 1.1 is not applicable to Cake 1.2 ACLs
(2) The multiple $aro->create() calls in this article's examples are to instantiate a new ARO each time, and then the $aro->save(array(...)) bit saves the new ARO to the database.
(3) The $aro = new Aro(); could have been skipped and the Aro Model that is in the Acl component been used instead, directly, like so:
$this->Acl->Aro->create();
$this->Acl->Aro->save(array(...data...));
(4) The location of the data Array() in the create() and save() operations could have been transposed. That is to say, one create() operation and one save() operation is needed to save each new ARO, but the data array() could be placed in either the create() or the save() method.
Possibly more, but that's all for now.
later...
For example, a key difference in the code here versus the code in, say, this article: http://bakery.cakephp.org/articles/view/real-world-access-control
Is that $aro->create() is used differently.
Cake 1.1
$aro->create( 1, null, 'This is the Alias' );
Cake 1.2
$aro->create();
$aro->save( array('foreign_key'=>1, 'parent_id'=>null, 'alias'=>'This is the Alias') );
Is that right? Can anyone confirm this stuff?
Thanks!
. Kindly any one explain differences b/w the two db structure and purpose .For example model field in aro /aco table has added in acl 1.2 and for what purpose is not define in this article (or i may have not noticed).
All Your Kindness .
$this->Acl->allow('User', 'Post', 'create');Can anybody tell me why the array notation doesn't work?$this->Acl->allow('User', 'Post', 'read');
$this->curLoggedInUserId;
in all occurences within the view() method.
var $components = array('Acl');
Hopefully this will help others too :)
Mike
The case sensetivity seems to be irrelevant, it cannot even find the 'Aro' (or aro).
What are the pre-requisites for this tutorial to work correctly? Is it possible for you to show us your views?
Also, in users_controller, shouldnt the lines that say:
$aro->save(
'model' => $this->User->name,
'foreign_key' => $this->User->id,
'parent_id' => $parentId,
'alias' => $alias
);
actually be
$aro->save(array(
'model' => $this->User->name,
'foreign_key' => $this->User->id,
'parent_id' => $parentId,
'alias' => $alias)
);
I assume your "posts" table is from the blog tutorial, speaking of the posts controller, there is an extra closing brace on line 27.
var $uses = array();
What version of cake are you using? This code uses the Acl Component that is available with cake 1.2.x.x and will work with 1.2.x.x.
I just did a fresh install of 1.2.0.5427alpha and I get the same "Fatal error: Class 'aro' not found in ..." error.
I've a question about Access Control for groups of records.
Say your app is multilingual and you have a model for articles that you use across all territories. You also have several administrator users all belonging to the same user group, each of which also belong to a territory or are "global".
You only want to allow update & delete (and ideally read in the Admin part of the app) access to the articles belonging to a particular territory, to the users that also belong to that territory (or are global), but deny access to those administrators belonging to a different territory?
Would you handle that scenario using ACL, if so, how, or would you do it another way? I do it using my own access control methods, which I'll bung on the bakery soon, but I wonder how easy it would be to do it using ACL.
I know this question might be more suited to the google group, but I think its a common problem that no tutorials on ACL that I've seen yet, actually discuss, so thought add it here.
Sorry if the answer is too obvious, but after spending many hours on it I can't work this out.
For example:
$aro->save(array(
'model'=>'User',
'foreign_key'=>null,
'parent_id'=>null,
'alias'=>'Admin'));
Reading the console help, I can see the format is:
create aro|aco
would that translate into something like:
cake acl create aro / User/Admin ?
Any help would be very welcome. Thanks
The above command would translate to
create aro root Admin
create aro root User
create aro User User::1
It would ideal if you could use the init_acl_controller as it gives you clear idea of what you are getting started with.
New York Classifieds
Comments are closed for articles over a year old