PHP Acl::isAllowed方法代码示例

	public static function modules()
	{
		$session = UserSession::get();
		if ($session)
		{
			$user = $session->user();
			if (!Acl::isAllowed($user->username, 'admin'))
			{
				return null;
			}
		}
		else
		{
			return null;
		}	
		
		CoOrg::loadPluginInfo('admin');
		$modules = array();
		foreach (self::$_modules as $m)
		{
			if ($m->isAllowed($user))
			{
				$modules[] = $m;
			}
		}
		usort($modules, array('Admin', 'cmpModule'));
		return $modules;
	}

	public function in($what, $key)
	{
		if ($this->_allowed !== null) return;
		
		if ($what == 'allow')
		{
			$this->_onlyDenied = false;
			if ($key[0] == ':') // Pseudo key
			{
				if ($key == ':loggedIn')
				{
					if (UserSession::get() != null)
					{
						$this->_allowed = true;
					}
				}
			}
			else
			{
				if ($u = UserSession::get())
				{
					if (Acl::isAllowed(UserSession::get()->username, $key))
					{
						$this->_allowed = true;
					}
				}
			}
		}
		else if ($what == 'deny')
		{
			if ($key[0] == ':') // Pseudo key
			{
				if ($key == ':anonymous')
				{
					if (UserSession::get() == null)
					{
						$this->_allowed = false;
					}
				}
			}
			else
			{
				if (Acl::isAllowed(UserSession::get()->username, $key))
				{
					$this->_allowed = false;
				}
			}
		}
		else if ($what == 'owns')
		{
			if ($this->_allowed !== null) return;
			$this->_onlyDenied = false;
			if (UserSession::get())
			{
				$this->_allowed = Acl::owns(UserSession::get()->username, $key) ? true : $this->_allowed;
			}
		}
	}

 /**
  * A basic functional package test example
  *
  * @return void
  */
 public function testBasicPackage()
 {
     // Acl package simple test
     Acl::setup(Config::get('acl::acl'));
     $this->assertFalse(Acl::isAllowed(array('guest'), 'admin_panel'));
     $this->assertFalse(Acl::isAllowed(array('user'), 'admin_panel'));
     $this->assertTrue(Acl::isAllowed(array('admin'), 'admin_panel'));
     // Here we could test other package facades for its basic functionalities...
 }

	public function run($widgetParams, $orient, $request)
	{
		if (UserSession::get() &&
		    Acl::isAllowed(UserSession::get()->username, 'admin'))
		{
			if (substr($request, 0, strpos($request, '/')) == 'admin')
			{
				$this->menu = Admin::modules();
			}
			else
			{
				$this->menu = array(new FakeAdminModule);
			}
			return $this->render('widgets/admin-menu');
		}
	}

	public function testGroup()
	{
		$group = new UserGroup('Webmasters');
		$group->save();
		$group->grant('someGrant');
		
		$this->assertFalse(Acl::isAllowed('dvorak', 'someGrant'));
		$group->add('dvorak');
		$this->assertTrue(Acl::isAllowed('dvorak', 'someGrant'));
		
		$group = new UserGroup('BadGroup');
		$group->save();
		$group->revoke('someGrant');
		$group->add('dvorak');
		
		$this->assertTrue(Acl::isAllowed('dvorak', 'someGrant')); // Even if dvorak is in a group that has no right he is allowed
	}

 /**
  * @param array Array of roles
  */
 public function __construct($roles)
 {
     $resources = dibi::fetchAll('SELECT key_name, name FROM [' . TABLE_RESOURCES . '] ORDER BY name;');
     $privileges = dibi::fetchAll('SELECT key_name, name FROM [' . TABLE_PRIVILEGES . '] ORDER BY name;');
     $acl = new Acl();
     $i = 0;
     foreach ($resources as $res) {
         foreach ($privileges as $pri) {
             foreach ($roles as $role) {
                 if ($acl->isAllowed($role->key_name, $res->key_name, $pri->key_name)) {
                     $this->access[$i]['resource'] = $res->name;
                     $this->access[$i]['privileg'] = $pri->name;
                     $i++;
                     break 1;
                 }
             }
         }
     }
 }

 /**
  * @param array Array of roles
  */
 public function __construct($roles)
 {
     $resources = dibi::fetchAll('SELECT key_name, name FROM [' . self::ACL_RESOURCES_TABLE . '] ORDER BY name;');
     $privileges = dibi::fetchAll('SELECT key_name, name FROM [' . self::ACL_PRIVILEGES_TABLE . '] ORDER BY name;');
     $acl = new Acl();
     $i = 0;
     foreach ($resources as $res) {
         foreach ($privileges as $pri) {
             foreach ($roles as $role) {
                 if (@$acl->isAllowed($role->key_name, $res->key_name, $pri->key_name)) {
                     // @ to repress NOTICE if assertion required and resource property (id, owner_id, ...) not set yet
                     $this->access[$i]['resource'] = $res->name;
                     $this->access[$i]['privileg'] = $pri->name;
                     $i++;
                     break 1;
                 }
             }
         }
     }
 }

 /**
  * Returns controller name read from mvc_controller URL parameter
  * (POST has precedence over GET). If mvc_controller is not given,
  * falls back to default controller.
  *
  * @param Request $request
  * @return null
  * @todo currently only cares about first role. Make work for array of roles.
  */
 public function getControllerName(Request $request)
 {
     // Fallback: route to default controller and action.
     $controllerName = $this->defaultControllerName;
     // GET parameter overrides the default controller.
     if ($request->hasGet('mvc_controller')) {
         $controllerName = $request->get('mvc_controller');
     }
     // POST parameter overrides GET parameter.
     if ($request->hasPost('mvc_controller')) {
         $controllerName = $request->post('mvc_controller');
     }
     $roles = $this->authenticationAdapter->getRoles();
     $role = $roles[0];
     // If that controller is not allowed, select authentication controller.
     if (!$this->acl->isAllowed($role, $controllerName)) {
         $controllerName = $this->authenticationControllerName;
     }
     // @todo remember selected controller & action to back-direct later
     // @todo either redirect to auth controller (for anonymous) OR FAIL?
     return $controllerName;
 }

	public function isAllowed($user)
	{
		return Acl::isAllowed($user->username, 'admin-user');
	}

        // Always return Not found response for banned user!
        throw new DomainException('acl.banned');
    }
});
Route::filter('can_login', function () {
    if (!Acl::isAllowed(Session::get('roles'), 'login')) {
        return Redirect::to('/')->with('message', 'acl.login');
    }
});
Route::filter('can_register', function () {
    if (!Acl::isAllowed(Session::get('roles'), 'register')) {
        return Redirect::to('/error')->with('error', 'acl.register');
    }
});
Route::filter('can_access_admin_panel', function () {
    if (!Acl::isAllowed(Session::get('roles'), 'admin_panel')) {
        if (Auth::check()) {
            return Redirect::to('/error')->with('error', 'acl.insufficient');
        } else {
            return Redirect::to('/auth/login')->with('error', 'acl.insufficient');
        }
    }
});
/*
 ************************************************
 *              Forum Filters                   *
 *                                              *
 ************************************************
 */
/**
 * | Saas forum filter to determine whether or not a user has the proper groups,

	public function owns($user, $blog)
	{
		return ($blog->authorID == $user || Acl::isAllowed($user, 'blog-admin'));
	}