PHP Zend_Acl::addResource方法代码示例

 public function init()
 {
     $acl = new Zend_Acl();
     $acl->addRole(OpenSKOS_Db_Table_Users::USER_ROLE_GUEST);
     $acl->addRole(OpenSKOS_Db_Table_Users::USER_ROLE_USER, OpenSKOS_Db_Table_Users::USER_ROLE_GUEST);
     $acl->addRole(OpenSKOS_Db_Table_Users::USER_ROLE_EDITOR, OpenSKOS_Db_Table_Users::USER_ROLE_USER);
     $acl->addRole(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, OpenSKOS_Db_Table_Users::USER_ROLE_EDITOR);
     $acl->addRole(OpenSKOS_Db_Table_Users::USER_ROLE_ROOT, OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR);
     $acl->addResource('website');
     $acl->addResource('editor');
     $acl->addResource('editor.concepts', 'editor');
     $acl->addResource('editor.concept-schemes', 'editor');
     $acl->addResource('editor.institution', 'editor');
     $acl->addResource('editor.collections', 'editor');
     $acl->addResource('editor.delete-all-concepts-in-collection', 'editor');
     $acl->addResource('editor.users', 'editor');
     $acl->addResource('editor.jobs', 'editor');
     $acl->addResource('editor.manage-search-profiles', 'editor');
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_GUEST, 'website', 'view');
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_USER, 'editor', 'view');
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_USER, 'editor.concepts', 'view');
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_EDITOR, 'editor.concepts', array('propose'));
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.concepts', array('full-create', 'edit', 'delete', 'bulk-status-edit'));
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.concept-schemes', array('index', 'create', 'edit', 'delete', 'manage-icons'));
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.institution', null);
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.collections', array('index', 'manage'));
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.users', array('index', 'manage'));
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.jobs', array('index', 'manage'));
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ADMINISTRATOR, 'editor.manage-search-profiles', null);
     $acl->allow(OpenSKOS_Db_Table_Users::USER_ROLE_ROOT, 'editor.delete-all-concepts-in-collection', null);
     Zend_Registry::set(self::REGISTRY_KEY, $acl);
     //store the ACL for the view:
     Zend_View_Helper_Navigation_HelperAbstract::setDefaultAcl($acl);
 }

 public function preDispatch(Zend_Controller_Request_Abstract $request)
 {
     $acl = new Zend_Acl();
     $acl->addRole(new Zend_Acl_Role(Model_Role::GUEST));
     $acl->addRole(new Zend_Acl_Role(Model_Role::ADMIN), Model_Role::GUEST);
     $acl->addResource(new Zend_Acl_Resource('admin'));
     $acl->addResource(new Zend_Acl_Resource('blog'));
     $acl->addResource(new Zend_Acl_Resource('error'));
     $acl->addResource(new Zend_Acl_Resource('index'));
     $acl->allow(Model_Role::GUEST, 'blog');
     $acl->allow(Model_Role::GUEST, 'error');
     $acl->allow(Model_Role::GUEST, 'index');
     $acl->allow(Model_Role::GUEST, 'admin', array('login'));
     $acl->allow(Model_Role::ADMIN, 'admin');
     $auth = Zend_Auth::getInstance();
     if ($auth->hasIdentity()) {
         $user = new Model_User($auth->getIdentity());
         $role = $user->role_id;
     } else {
         $role = Model_Role::GUEST;
     }
     $resource = $request->getControllerName();
     $privilege = $request->getActionName();
     if (!$acl->isAllowed($role, $resource, $privilege)) {
         $this->_request->setControllerName('admin')->setActionName('login');
         $this->_response->setRedirect('/admin/login/');
     }
 }

 protected function _setupResources()
 {
     $this->_acl->addResource(new Zend_Acl_Resource('home_auth', array('index', 'login', 'logout', 'register')));
     $this->_acl->addResource(new Zend_Acl_Resource('home_error', array('index', 'error', 'forbidden')));
     $this->_acl->addResource(new Zend_Acl_Resource('home_index', array('index', 'add', 'edit', 'delete')));
     $this->_acl->addResource(new Zend_Acl_Resource('admin_index', array('index', 'add', 'edit', 'delete')));
 }

 protected function _setupResources()
 {
     $resources = $this->ca->getResources();
     foreach ($resources as $resource) {
         $this->_acl->addResource(new Zend_Acl_Resource($resource['controller']));
     }
 }

 public function testShouldAllowAccessForCorrectRole()
 {
     $request = $this->request->setModuleName('admin')->setControllerName('index')->setActionName('index');
     $this->acl->addResource('admin_index');
     $this->acl->allow(Acl::ROLE_GUEST, 'admin_index');
     $plugin = new Acl($this->acl);
     $plugin->setRequest($this->request);
     $plugin->preDispatch();
     $this->assertEquals('admin', $this->request->getModuleName());
     $this->assertEquals('index', $this->request->getControllerName());
     $this->assertEquals('index', $this->request->getActionName());
 }

 protected function _setupResources()
 {
     //declara os controllers da aplicacao
     $this->_acl->addResource(new Zend_Acl_Resource('index'));
     $this->_acl->addResource(new Zend_Acl_Resource('error'));
     $this->_acl->addResource(new Zend_Acl_Resource('log'));
     $this->_acl->addResource(new Zend_Acl_Resource('relatorios'));
     $this->_acl->addResource(new Zend_Acl_Resource('usuarios'));
     $this->_acl->addResource(new Zend_Acl_Resource('oriente'));
     $this->_acl->addResource(new Zend_Acl_Resource('obreiro'));
     $this->_acl->addResource(new Zend_Acl_Resource('loja'));
     $this->_acl->addResource(new Zend_Acl_Resource('selos'));
 }

 /**
  * 
  */
 public function buildAcl()
 {
     if (is_null($this->acl)) {
         $this->acl = new Zend_Acl();
     }
     $this->acl->removeAll();
     $permissions = $this->getPermissionList();
     $resources = $this->getResourceList();
     $resourceParents = $this->getResourceParentList();
     $roles = $this->getRoleList();
     $roleParents = $this->getRoleParentList();
     $rolesTmp = array();
     foreach ($roles as $role) {
         $roleId = $role['role_id'];
         $roleName = $role['role_name'];
         $rolesTmp[$roleId] = array('name' => $roleId, 'parents' => array());
         $rolesTmp[$roleName] = array('name' => $roleName, 'parents' => array($roleId));
     }
     foreach ($roleParents as $roleParent) {
         $roleId = $roleParent['role_id'];
         $roleIdParent = $roleParent['role_id_parent'];
         $rolesTmp[$roleId]['parents'][] = $roleIdParent;
     }
     foreach ($rolesTmp as $role) {
         $this->acl->addRole($role['name'], $role['parents']);
     }
     #echo '<pre>';
     $resourcesTmp = array();
     foreach ($resources as $resource) {
         $resourceId = $resource['resource_id'];
         $resourceName = $resource['resource_name'];
         $resourcesTmp[$resourceId] = array('name' => $resourceId, 'parent' => null);
         $resourcesTmp[$resourceName] = array('name' => $resourceName, 'parent' => $resourceId);
     }
     foreach ($resourceParents as $resourceParent) {
         $resourceId = $resourceParent['resource_id'];
         $resourceIdParent = $resourceParent['resource_id_parent'];
         $resourcesTmp[$resourceId]['parent'] = $resourceIdParent;
     }
     foreach ($resourcesTmp as $resource) {
         $this->acl->addResource($resource['name'], $resource['parent']);
     }
     foreach ($permissions as $permission) {
         if (empty($permission['allowed'])) {
             $this->acl->deny($permission['role_id'], $permission['resource_id']);
         } else {
             $this->acl->allow($permission['role_id'], $permission['resource_id']);
         }
     }
 }

 protected function _setupResources()
 {
     $this->_acl->addResource(new Zend_Acl_Resource('auth'));
     $this->_acl->addResource(new Zend_Acl_Resource('index'));
     $this->_acl->addResource(new Zend_Acl_Resource('encontre'));
     $this->_acl->addResource(new Zend_Acl_Resource('buscar'));
     $this->_acl->addResource(new Zend_Acl_Resource('error'));
     $this->_acl->addResource(new Zend_Acl_Resource('cadastro'));
     $this->_acl->addResource(new Zend_Acl_Resource('perfil'));
     $this->_acl->addResource(new Zend_Acl_Resource('admin'));
 }

 /**
  * @return void
  */
 public function addResource($obj)
 {
     if (!is_object($obj) || $this->_acl->has($obj)) {
         return false;
     }
     $nameParts = explode('_', strtolower(get_class($obj)));
     $simpleName = array_pop($nameParts);
     if (!$this->_acl->has($simpleName)) {
         $this->_acl->addResource(new Zend_Acl_Resource($simpleName));
     }
     $this->_acl->addResource($obj->getResourceId(), $simpleName);
     if ($obj->isPrivate()) {
         $this->_acl->deny(null, $obj->getResourceId(), null, new Default_Model_Acl_HasPermissionAssertion());
     }
     return true;
 }

 protected function _getAcl()
 {
     $acl = false;
     if (Zend_Registry::isRegistered('cache')) {
         $cache = Zend_Registry::get('cache');
         $acl = $cache->load('acl');
     }
     if (!$acl) {
         $acl = new Zend_Acl();
         $role = new Auth_Model_DbTable_Role();
         $resource = new Auth_Model_DbTable_Resource();
         $roleResource = new Auth_Model_DbTable_RoleResource();
         $roles = $role->fetchAll("name <> 'Todos'");
         $resources = $resource->getDistinctModules();
         $relations = $roleResource->fetchAllRelations();
         $acl->addRole('Todos');
         foreach ($roles as $role) {
             $acl->addRole($role['name'], 'Todos');
         }
         foreach ($resources as $resource) {
             $acl->addResource($resource['module']);
         }
         foreach ($relations as $relation) {
             $acl->allow($relation['name'], $relation['module'], $relation['privilege']);
         }
         if (Zend_Registry::isRegistered('cache')) {
             $cache->save($acl, 'acl');
         }
     }
     Zend_Registry::set('acl', $acl);
     return $acl;
 }

 /**
  * Get acl for role
  *
  * @param Zend_Acl_Role_Interface $role
  * @return Zend_Acl
  */
 public function getAcl(Zend_Acl_Role_Interface $role)
 {
     if (isset($this->cache[$role->getRoleId()])) {
         return $this->cache[$role->getRoleId()];
     }
     $acl = new Zend_Acl();
     // set resources
     $resources = $this->getResources();
     foreach (array_keys($resources) as $resource) {
         $acl->addResource($resource);
     }
     // get role parents if possible
     $method = self::PARENTS_METHOD;
     $parents = NULL;
     if (method_exists($role, $method)) {
         foreach ($role->{$method}() as $parent) {
             $parents[] = $parent;
             $acl->addRole($parent);
             $this->addRules($acl, $parent);
         }
     }
     // set role
     $acl->addRole($role, $parents);
     $this->addRules($acl, $role);
     return $this->cache[$role->getRoleId()] = $acl;
 }

 public function preDispatch(Zend_Controller_Request_Abstract $request)
 {
     $acl = new Zend_Acl();
     $acl->addResource("page");
     $acl->addResource("forum");
     $acl->addResource("catalog");
     $acl->addRole("administrator");
     $acl->addRole("moderator");
     $acl->allow("administrator");
     $acl->deny("moderator");
     $acl->allow("moderator", "forum", array("answer", "edit-own"));
     Zend_Registry::set('acl', $acl);
     if (!Zend_Auth::getInstance()->hasIdentity()) {
         $request->setControllerName('index')->setActionName('login');
     }
 }

    /**
     * @group ZF-9643
     */
    public function testRemoveDenyWithNullResourceAppliesToAllResources()
    {
        $this->_acl->addRole('guest');
        $this->_acl->addResource('blogpost');
        $this->_acl->addResource('newsletter');
        
        $this->_acl->allow();
        $this->_acl->deny('guest', 'blogpost', 'read');
        $this->_acl->deny('guest', 'newsletter', 'read');
        $this->assertFalse($this->_acl->isAllowed('guest', 'blogpost', 'read'));
        $this->assertFalse($this->_acl->isAllowed('guest', 'newsletter', 'read'));

        $this->_acl->removeDeny('guest', 'newsletter', 'read');
        $this->assertFalse($this->_acl->isAllowed('guest', 'blogpost', 'read'));
        $this->assertTrue($this->_acl->isAllowed('guest', 'newsletter', 'read'));
        
        $this->_acl->removeDeny('guest', null, 'read');
        $this->assertTrue($this->_acl->isAllowed('guest', 'blogpost', 'read'));
        $this->assertTrue($this->_acl->isAllowed('guest', 'newsletter', 'read'));
        
        // ensure deny null/all resources works
        $this->_acl->deny('guest', null, 'read');
        $this->assertFalse($this->_acl->isAllowed('guest', 'blogpost', 'read'));
        $this->assertFalse($this->_acl->isAllowed('guest', 'newsletter', 'read'));
    }

 /**
  * @group 4226
  */
 public function testAllowNullPermissionAfterResourcesExistShouldAllowAllPermissionsForRole()
 {
     $this->_acl->addRole('admin');
     $this->_acl->addResource('newsletter');
     $this->_acl->allow('admin');
     $this->assertTrue($this->_acl->isAllowed('admin'));
 }

 public function getAcl()
 {
     $acl = new Zend_Acl();
     // Add roles.
     $acl->addRole('super');
     // Admins inherit privileges from super users.
     $acl->addRole('admin', 'super');
     $acl->addRole('researcher');
     // Contributors inherit privileges from researchers.
     $acl->addRole('contributor', 'researcher');
     // Add resources, corresponding to Omeka controllers.
     $resources = array('Items', 'Collections', 'ElementSets', 'Files', 'Plugins', 'Settings', 'Security', 'Upgrade', 'Tags', 'Themes', 'SystemInfo', 'ItemTypes', 'Users', 'Search', 'Appearance', 'Elements');
     foreach ($resources as $resource) {
         $acl->addResource($resource);
     }
     // Define allow rules for everyone.
     // Everyone can view and browse these resources.
     $acl->allow(null, array('Items', 'ItemTypes', 'Tags', 'Collections', 'Search', 'ElementSets', 'Elements'), array('index', 'browse', 'show', 'home', 'print-cart'));
     // Everyone can view an item's tags and use the item search.
     $acl->allow(null, array('Items'), array('tags', 'search'));
     // Everyone can view files.
     $acl->allow(null, 'Files', 'show');
     // Non-authenticated users can access the upgrade script, for logistical reasons.
     $acl->allow(null, 'Upgrade');
     // Deny privileges from admin users
     $acl->deny('admin', array('Settings', 'Plugins', 'Themes', 'ElementSets', 'Security', 'SystemInfo', 'Appearance'));
     // Assert ownership for certain privileges.
     // Owners can edit and delete items and collections.
     $acl->allow(null, array('Items', 'Collections'), array('edit', 'delete'), new Omeka_Acl_Assert_Ownership());
     // Owners can edit files.
     $acl->allow(null, 'Files', 'edit', new Omeka_Acl_Assert_Ownership());
     // Define allow rules for specific roles.
     // Super users have full privileges.
     $acl->allow('super');
     // Researchers can view and search items and collections that are not public.
     $acl->allow('researcher', array('Items', 'Collections', 'Search'), 'showNotPublic');
     // Contributors can add and tag items, edit or delete their own items, and see
     // their items that are not public.
     $acl->allow('contributor', 'Items', array('add', 'tag', 'batch-edit', 'batch-edit-save', 'change-type', 'delete-confirm', 'editSelf', 'deleteSelf', 'showSelfNotPublic'));
     // Contributors can edit their own files.
     $acl->allow('contributor', 'Files', 'editSelf');
     // Contributors have access to tag autocomplete.
     $acl->allow('contributor', 'Tags', array('autocomplete'));
     // Contributors can add collections, edit or delete their own collections, and
     // see their collections that are not public.
     $acl->allow('contributor', 'Collections', array('add', 'delete-confirm', 'editSelf', 'deleteSelf', 'showSelfNotPublic'));
     $acl->allow('contributor', 'Elements', 'element-form');
     // Define deny rules.
     // Deny admins from accessing some resources allowed to super users.
     $acl->deny('admin', array('Settings', 'Plugins', 'Themes', 'ElementSets', 'Security', 'SystemInfo'));
     // Deny admins from deleting item types and item type elements.
     $acl->deny('admin', 'ItemTypes', array('delete', 'delete-element'));
     // Deny Users to admins since they normally have all the super permissions.
     $acl->deny(null, 'Users');
     $acl->allow(array('super', 'admin', 'contributor', 'researcher'), 'Users', null, new Omeka_Acl_Assert_User());
     // Always allow users to login, logout and send forgot-password notifications.
     $acl->allow(array(null, 'admin'), 'Users', array('login', 'logout', 'forgot-password', 'activate'));
     return $acl;
 }