phpcakephpauthorization

CakePHP: How do I access the Auth->allow action array?


I've been working on an application using CakePHP 2.6. We have a class called AuthUser which builds upon the functionality of AuthComponent and allows us to check permissions against our roles for sections in our database.

However I have noticed that our "isAuthorised" function ignores the $this->Auth->allow() which means actions that shouldn't need authorisation are being caught by our checks and this needs to be updated to check properly.

Is it possible to access the $this->Auth->allow() array of actions and if so how would someone go about accessing it?

Below I have included the "isAuthorised" function from the AuthUser class:

public function isAuthorised($controllerName = null) {
        //Admin has access to everything
        if (AuthUser::isAdmin() === true) {
            return true;
        }

        $roles = array();

        //Get the roles allowed for the section
        $results = AppController::runStoredProcedure('spGetCurrentSectionRolesForSectionBySectionName', array( $controllerName ));

        if (isset($results) && is_array($results)) {
            foreach ($results as $row) {
                if (isset($row['RoleName'])) {
                    array_push($roles, $row['RoleName']);
                }
            }
        }

        //Check if authenticated user has permission to current controller (is one of the allowed roles)
        $userRoles = AuthComponent::user('role');

        if (isset($userRoles) && is_array($userRoles)) {
            foreach ($userRoles as $key => $value) {
                if ($value == true) {5
                    if (in_array($key, $roles)) {
                        return true;
                    }
                }
            }
        }

        return false;
    }

Solution

  • Please try this

    pr($this->Auth->allowedActions);
    

    This will list you all auth->allow() function name that are defined in $this->Auth->allow()