PHP Zend_Acl类代码示例

 public function setAcl(Zend_Acl $acl)
 {
     if (!$acl->has($this->getResourceId())) {
         $acl->add($this)->deny(Model_Role::GUEST, $this, array('view', 'delete'));
     }
     $this->_acl = $acl;
 }

 protected function _setupPrivileges()
 {
     $menu = new Application_Model_DbTable_MenuPermissaoPerfil();
     $listaPermissao = $menu->listaPermissaoPapel();
     //Zend_Registry::get('logger')->log($listaPermissao, Zend_Log::INFO);
     //$this->_acl->allow( 'guest', 'index', array('logout', 'login','index','edit-alterar-perfil','ajuda','lista-centro-custo','edit-centro-custo','add-centro-custo','delete-centro-custo','lista-compra','add-compra','edit-compra','delete-compra','add-projeto','add-servico','add-plano-acao','add-contato','add-noticia','edit-noticia','delete-noticia','lista-projeto','lista-tipo-projeto','edit-tipo-projeto','delete-tipo-projeto','lista-status-projeto','edit-status-projeto','delete-status-projeto') )
     //  ->allow( 'guest', 'error', array('error', 'forbidden') );
     // $this->_acl->allow( 'user', 'index', array('index','logout','lista-remessa','view-remessa','add-projeto') );
     //$this->_acl->allow( 'negocio', 'index', array('index', 'ranking-executivo-negocio','lista-fotos-evento','logout') );
     //$this->_acl->allow( 'gerente', 'index', array('index', 'ranking-gerente','lista-fotos-evento','logout') );
     // $this->_acl->allow( 'produtor', 'index', array('index','lista-fotos-evento','logout','observacao-evento') );
     //$this->_acl->allow( 'produtor', 'upload', array('media','uploadjqAction','uploadjq','lista-videos','videos') );
     //$this->_acl->allow( 'admin', 'index' );
     //$this->_acl->allow( 'admin', 'upload' );
     //$this->_acl->allow( 'Operador', 'index', array('index', 'add-pcp') );
     //$this->_acl->allow( 'Operador', 'index', array('add-pcp','index') );
     $arrayPermissao = array();
     $arrayPerfil = array();
     foreach ($listaPermissao as $value) {
         //$this->_acl->addRole( new Zend_Acl_Role($value['nome']) );
         $arrayPermissao[] = $value["NM_PAGINA"];
         $arrayPerfil[] = $value["nome"];
         $this->_acl->allow($value["nome"], 'index', array($value["NM_PAGINA"], 'index', 'logout', 'error', 'forbidden'));
     }
     //Zend_Registry::get('logger')->log($arrayPermissao, Zend_Log::INFO);
     //Zend_Registry::get('logger')->log($arrayPerfil, Zend_Log::INFO);
     //Zend_Registry::get('logger')->log(array('add-pcp','index'), Zend_Log::INFO);
 }

 /**
  * Get acl for role
  *
  * @param Zend_Acl_Role_Interface $role
  * @return Zend_Acl
  */
 public function getAcl(Zend_Acl_Role_Interface $role)
 {
     if (isset($this->cache[$role->getRoleId()])) {
         return $this->cache[$role->getRoleId()];
     }
     $acl = new Zend_Acl();
     // set resources
     $resources = $this->getResources();
     foreach (array_keys($resources) as $resource) {
         $acl->addResource($resource);
     }
     // get role parents if possible
     $method = self::PARENTS_METHOD;
     $parents = NULL;
     if (method_exists($role, $method)) {
         foreach ($role->{$method}() as $parent) {
             $parents[] = $parent;
             $acl->addRole($parent);
             $this->addRules($acl, $parent);
         }
     }
     // set role
     $acl->addRole($role, $parents);
     $this->addRules($acl, $role);
     return $this->cache[$role->getRoleId()] = $acl;
 }

 public static function getAcl()
 {
     $acl = new Zend_Acl();
     $acl->addRole(new Zend_Acl_Role('everyone'));
     $acl->addRole(new Zend_Acl_Role('blocked'), 'everyone');
     $acl->addRole(new Zend_Acl_Role('self'), 'everyone');
     return $acl;
 }

 /**
  * Get ACL lists
  * 
  * @return Zend_Acl
  */
 public function getAcl()
 {
     if (null === $this->_acl) {
         $acl = new Zend_Acl();
         $acl->add(new Zend_Acl_Resource('admin'))->add(new Zend_Acl_Resource('kap'))->add(new Zend_Acl_Resource('members'))->addRole(new Zend_Acl_Role('guest'))->addRole(new Zend_Acl_Role('kap'), 'guest')->addRole(new Zend_Acl_Role('admin'), 'kap')->deny()->allow('admin', 'admin')->allow('admin', 'members')->allow('admin', 'kap')->allow('kap', 'kap')->allow('kap', 'members')->allow('guest', 'members', array('index', 'team', 'player', 'turnir', 'old', 'regno'));
         $this->_acl = $acl;
     }
     return $this->_acl;
 }

 public function testApplyPermissions()
 {
     $acl = new Zend_Acl();
     $this->setExpectedException('Zend_Acl_Role_Registry_Exception');
     $acl->isAllowed($this->guestRole, 'documents');
     $roleConfig = new Application_Security_RoleConfig('guest');
     $roleConfig->applyPermissions($acl);
     $this->assertTrue($acl->isAllowed($this->guestRole, 'documents'), "Expected role 'guest' can access resource 'documents'");
 }

 /**
  * Checks if user has the right to do privilege on resource
  * 
  * @param Zend_Acl_Resource $resource
  * @param string $privilege
  * @return boolean
  */
 public function isAllowed($resource, $privilege)
 {
     if (empty(self::$_acl)) {
         self::$_acl = Zend_Registry::get('Zend_Acl');
     }
     if (!self::$_acl->has($resource)) {
         return true;
     }
     return self::$_acl->isAllowed('fansubcms_user_custom_role_logged_in_user', $resource, $privilege);
 }

 /**
  * Get ACL lists
  *
  * @return Zend_Acl
  */
 public function getAcl()
 {
     if (null === $this->_acl) {
         $acl = new Zend_Acl();
         $this->_loadAclClasses();
         $acl->add(new Zend_Acl_Resource('page'))->addRole(new Brightfame_Acl_Role_Guest())->addRole(new Brightfame_Acl_Role_Member(), 'guest')->addRole(new Brightfame_Acl_Role_Administrator(), 'member')->deny()->allow('guest', 'page', array('view'))->allow('member', 'page', array('comment'))->allow('administrator', 'page', array('add', 'edit', 'delete', 'buildindex'));
         $this->_acl = $acl;
     }
     return $this->_acl;
 }

 /**
  * Get an ACL object for this post. 
  *
  * For now this is generic for all posts, but in the future may be post 
  * specific
  *
  * @return Zend_Acl
  */
 public function getAcl()
 {
     $acl = new Zend_Acl();
     $acl->addRole('guest')->addRole('user', 'guest')->addRole('admin');
     // Guests can view and comment
     $acl->allow('guest', null, array('view', 'comment'));
     // Admin can do anything
     $acl->allow('admin');
     return $acl;
 }

 public function checkAccess(Zend_Controller_Request_Abstract $request)
 {
     $resource = new User_Model_Acl_Resource();
     $resource->getPrivileges($request);
     if (!$resource->privileges || !$resource->resource_id) {
         //error in getting resource privileges or nobody is allowed access, deny access and redirect to forbidden
         return false;
     }
     $acl = new Zend_Acl();
     $acl->add(new Zend_Acl_Resource($resource->resource_id));
     foreach ($resource->privileges as $key => $privilege) {
         if (!$acl->hasRole($privilege["role_id"])) {
             $acl->addRole(new Zend_Acl_Role($privilege["role_id"]));
             $acl->allow($privilege["role_id"], $resource->resource_id);
         }
     }
     $authorization = Zend_Auth::getInstance();
     if ($authorization->hasIdentity()) {
         $user = $authorization->getIdentity();
         if ($acl->hasRole($user['role_id']) && $acl->isAllowed($user['role_id'], $resource->resource_id)) {
             //role has access
             return true;
         }
         //user role does not have access to this resource
         return false;
     } else {
         $aclrole = new User_Model_Acl_Role();
         $aclrole->getDefaultRole();
         if (!$aclrole->default_role || !$acl->hasRole($aclrole->default_role) || !$acl->isAllowed($aclrole->default_role, $resource->resource_id)) {
             //redirect to login
             return false;
         }
     }
     return true;
 }

 public function __construct($aclInfo = null, $options = null)
 {
     if (!empty($aclInfo)) {
         $acl = new Zend_Acl();
         $this->_role = $aclInfo['role'];
         $groupPrivileges = $aclInfo['privileges'];
         $acl->addRole(new Zend_Acl_Role($this->_role));
         $acl->allow($this->_role, null, $groupPrivileges);
         $this->_acl = $acl;
     }
 }

 /**
  * Inicializa a ACL juntamente com as permissões.
  *
  * @author  Alex Oliveira <bsi.alexoliveira@gmail.com>
  * @version 1.0
  *
  * @return  Zend_Acl
  */
 protected static function init()
 {
     # instancia a ACL
     $acl = new Zend_Acl();
     # adiciona recursos disponíveis na ACL # trocar null pelo tipo de permissão {publica, protegida, privada}
     foreach (self::resources() as $controller => $actions) {
         $acl->addResource(new Zend_Acl_Resource($controller))->allow(null, $controller, $actions);
     }
     # retorna uma instância da acl
     return $acl;
 }

 public function preDispatch(Zend_Controller_Request_Abstract $request)
 {
     $this->_initAcl();
     if ($this->_auth->hasIdentity()) {
         $ident = $this->_auth->getIdentity();
         $date = new Zend_Date();
         $ident->last_login = $date->get(DATABASE_DATE_FORMAT);
         $ident->save();
     }
     if ($request->getControllerName() != 'admin' && $request->getModuleName() != 'admin') {
         return;
     }
     // if this is not admin skip the rest
     if (!$this->_auth->hasIdentity() && !($request->getControllerName() == 'auth' && $request->getActionName() == 'login' && $request->getModuleName() == 'admin')) {
         $redirect = new Zend_Controller_Action_Helper_Redirector();
         $redirect->gotoSimple('login', 'auth', 'admin');
     }
     if ($request->getModuleName() == 'user' && $request->getControllerName() == 'admin' && $request->getActionName() == 'profile') {
         return;
     }
     // the profile is a free resource
     $resource = $request->getModuleName() . '_' . $request->getControllerName();
     $hasResource = $this->_acl->has($resource);
     if ($hasResource && !$this->_acl->isAllowed('fansubcms_user_custom_role_logged_in_user', $resource, $request->getActionName())) {
         throw new FansubCMS_Exception_Denied('The user is not allowd to do this');
     }
 }

 /**
  * @param Zend_Controller_Request_Abstract $oHttpRequest
  */
 public function preDispatch(Zend_Controller_Request_Abstract $oHttpRequest)
 {
     $sControllerName = $oHttpRequest->getControllerName();
     $sActionName = $oHttpRequest->getActionName();
     $aRequestedParams = $oHttpRequest->getUserParams();
     $sQuery = '';
     unset($aRequestedParams['controller']);
     unset($aRequestedParams['action']);
     // Define user role
     if (Zend_Auth::getInstance()->hasIdentity()) {
         $aData = Zend_Auth::getInstance()->getStorage()->read();
         $sRole = $aData['role'];
     } else {
         // Default role
         $sRole = 'guest';
     }
     // Check access
     if (!$this->_oAcl->isAllowed($sRole, $sControllerName, $sActionName)) {
         $oHttpRequest->setParam('referer_controller', $sControllerName);
         $oHttpRequest->setParam('referer_action', $sActionName);
         $aParams = array();
         if (count($aRequestedParams)) {
             foreach ($aRequestedParams as $sKey => $sValue) {
                 $aParams[] = $sKey;
                 $aParams[] = $sValue;
             }
             $sQuery = implode('/', $aParams) . '/';
         }
         $oHttpRequest->setParam('query', $sQuery);
         $oHttpRequest->setControllerName('auth')->setActionName('login');
         $this->_response->setHttpResponseCode(401);
     }
 }

 /**
  * Check the acl
  *
  * @param string $resource
  * @param string $privilege
  * @return boolean
  */
 public function isAllowed($resource = null, $privilege = null)
 {
     if (null === $this->_acl) {
         return null;
     }
     return $this->_acl->isAllowed($this->getIdentity(), $resource, $privilege);
 }