PHP Acl::deny方法代码示例

 private function addAllowAndDeny(Acl $acl)
 {
     foreach ($this->config as $roleName => $roleConfig) {
         $allowList = isset($roleConfig['allow']) ? $roleConfig['allow'] : [];
         foreach ($allowList as $resource => $privilegeList) {
             if (empty($privilegeList)) {
                 $acl->allow($roleName, strtolower($resource));
             } else {
                 foreach ((array) $privilegeList as $privilege) {
                     $acl->allow($roleName, strtolower($resource), strtolower($privilege));
                 }
             }
         }
         $denyList = isset($roleConfig['deny']) ? $roleConfig['deny'] : [];
         foreach ($denyList as $resource => $privilegeList) {
             if (empty($privilegeList)) {
                 $acl->deny($roleName, strtolower($resource));
             } else {
                 foreach ((array) $privilegeList as $privilege) {
                     $acl->deny($roleName, strtolower($resource), strtolower($privilege));
                 }
             }
         }
     }
 }

 /**
  * @return Acl
  */
 protected function roleAcl()
 {
     if (!$this->roleAcl) {
         $id = $this->objId();
         $this->roleAcl = new Acl();
         $this->roleAcl->addRole(new Role($id));
         $this->roleAcl->addResource(new Resource('admin'));
         $q = '
         select
             `denied`,
             `allowed`,
             `superuser`
         from
             `charcoal_admin_acl_roles`
         where
             ident = :id';
         $db = \Charcoal\App\App::instance()->getContainer()->get('database');
         $sth = $db->prepare($q);
         $sth->bindParam(':id', $id);
         $sth->execute();
         $permissions = $sth->fetch(\PDO::FETCH_ASSOC);
         $this->roleAllowed = explode(',', trim($permissions['allowed']));
         $this->roleDenied = explode(',', trim($permissions['denied']));
         foreach ($this->roleAllowed as $allowed) {
             $this->roleAcl->allow($id, 'admin', $allowed);
         }
         foreach ($this->roleDenied as $denied) {
             $this->roleAcl->deny($id, 'admin', $denied);
         }
     }
     return $this->roleAcl;
 }

 public function doAuthorization($e)
 {
     //setting ACL...
     $acl = new Acl();
     //add role ..
     $acl->addRole(new Role('anonymous'));
     $acl->addRole(new Role('user'), 'anonymous');
     $acl->addRole(new Role('admin'), 'user');
     $acl->addResource(new Resource('Application'));
     $acl->addResource(new Resource('Login'));
     $acl->addResource(new Resource('ZfcAdmin'));
     $acl->deny('anonymous', 'Application', 'view');
     $acl->allow('anonymous', 'Login', 'view');
     $acl->allow('user', array('Application'), array('view'));
     //admin is child of user, can publish, edit, and view too !
     $acl->allow('admin', array('Application'), array('publish', 'edit'));
     $controller = $e->getTarget();
     $controllerClass = get_class($controller);
     //echo "<pre>";print_r($controllerClass);exit;
     $namespace = substr($controllerClass, 0, strpos($controllerClass, '\\'));
     // echo "<pre>";print_r($namespace);exit;
     $role = !$this->getSessContainer()->role ? 'anonymous' : $this->getSessContainer()->role;
     if (!isset($_SESSION['admin']['user_id']) && $namespace == 'ZfcAdmin') {
         $router = $e->getRouter();
         $url = $router->assemble(array(), array('name' => 'zfcadmin'));
         $response = $e->getResponse();
         $response->setStatusCode(302);
         //redirect to login route...
         /* change with header('location: '.$url); if code below not working */
         $response->getHeaders()->addHeaderLine('Location', $url);
         $e->stopPropagation();
     }
 }

 /**
  * getAcl - This cannot be called before resources are parsed
  *
  * @param string $resourceId resourceId
  * @param string $providerId  @deprecated No Longer Required - providerId
  *
  * @return Acl
  */
 public function getAcl($resourceId, $providerId)
 {
     if (!isset($this->acl)) {
         $this->buildAcl();
     }
     /* resources privileges
            we load the every time so they maybe updated dynamically
        */
     $resources = $this->getResources($resourceId, $providerId);
     foreach ($resources as $resource) {
         if (!$this->acl->hasResource($resource)) {
             $this->acl->addResource($resource, $resource->getParentResource());
         }
         $privileges = $resource->getPrivileges();
         if (!empty($privileges)) {
             foreach ($privileges as $privilege) {
                 if (!$this->acl->hasResource($privilege)) {
                     $this->acl->addResource($privilege, $resource);
                 }
             }
         }
     }
     // get only for resources
     $rules = $this->getRules($resources);
     /** @var AclRule $aclRule */
     foreach ($rules as $aclRule) {
         if ($aclRule->getRule() == AclRule::RULE_ALLOW) {
             $this->acl->allow($aclRule->getRoleId(), $aclRule->getResourceId(), $aclRule->getPrivileges(), $aclRule->getAssertion());
         } elseif ($aclRule->getRule() == AclRule::RULE_DENY) {
             $this->acl->deny($aclRule->getRoleId(), $aclRule->getResourceId(), $aclRule->getPrivileges(), $aclRule->getAssertion());
         }
     }
     return $this->acl;
 }

 public function initAcl(MvcEvent $e)
 {
     //Creamos el objeto ACL
     $acl = new Acl();
     //Incluimos la lista de roles y permisos, nos devuelve un array
     $roles = (require 'config/autoload/acl.roles.php');
     foreach ($roles as $role => $resources) {
         //Indicamos que el rol será genérico
         $role = new \Zend\Permissions\Acl\Role\GenericRole($role);
         //Añadimos el rol al ACL
         $acl->addRole($role);
         //Recorremos los recursos o rutas permitidas
         foreach ($resources["allow"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Permitimos a ese rol ese recurso
             $acl->allow($role, $resource);
         }
         foreach ($resources["deny"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Denegamos a ese rol ese recurso
             $acl->deny($role, $resource);
         }
     }
     //Establecemos la lista de control de acceso
     $e->getViewModel()->acl = $acl;
 }

 public function doAuthorization($e)
 {
     return;
     //setting ACL...
     $acl = new Acl();
     //add role ..
     $acl->addRole(new Role('anonymous'));
     $acl->addRole(new Role('user'), 'anonymous');
     $acl->addRole(new Role('admin'), 'user');
     $acl->addResource(new Resource('Stick'));
     $acl->addResource(new Resource('Auth'));
     $acl->deny('anonymous', 'Stick', 'list');
     $acl->allow('anonymous', 'Auth', 'login');
     $acl->allow('anonymous', 'Auth', 'signup');
     $acl->allow('user', 'Stick', 'add');
     $acl->allow('user', 'Auth', 'logout');
     //admin is child of user, can publish, edit, and view too !
     $acl->allow('admin', 'Stick');
     $controller = $e->getTarget();
     $controllerClass = get_class($controller);
     $namespace = substr($controllerClass, strrpos($controllerClass, '\\') + 1);
     $role = !$this->getSessContainer()->role ? 'anonymous' : $this->getSessContainer()->role;
     echo $role;
     exit;
     if (!$acl->isAllowed($role, $namespace, 'view')) {
         $router = $e->getRouter();
         $url = $router->assemble(array(), array('name' => 'Login/auth'));
         $response = $e->getResponse();
         $response->setStatusCode(302);
         //redirect to login route...
         $response->getHeaders()->addHeaderLine('Location', $url);
     }
 }

 /**
  * Constroi a ACL de acordo com as entities
  * @see Core\Entity\System\Roles
  * @todo Inclusao das ACLS no Cache
  * @return Acl
  */
 public function build()
 {
     $em = $this->getServiceManager()->get('Doctrine\\ORM\\EntityManager');
     $roles = $em->getRepository('Core\\Entity\\System\\Roles')->findAll();
     $resources = $em->getRepository('Core\\Entity\\System\\Resources')->findAll();
     $acl = new Acl();
     foreach ($roles as $role) {
         $acl->addRole(new Role($role->getRoleName()), $role->getRoleParent());
     }
     foreach ($resources as $r) {
         $acl->addResource(new Resource($r->getResourceName()));
     }
     foreach ($roles as $role) {
         $rolename = $role->getRoleName();
         $allowed = $em->getRepository('Core\\Entity\\System\\Permissions')->findBy(array('idRole' => $role->getId(), 'permission' => 'allow'));
         foreach ($allowed as $allow) {
             $resources = $em->getRepository('Core\\Entity\\System\\Resources')->find($allow->getIdResource());
             $acl->allow($rolename, $resources->getResourceName());
         }
         $denyed = $em->getRepository('Core\\Entity\\System\\Permissions')->findBy(array('idRole' => $role->getId(), 'permission' => 'deny'));
         foreach ($denyed as $deny) {
             $resources = $em->getRepository('Core\\Entity\\System\\Resources')->find($deny->getIdResource());
             $acl->deny($rolename, $resources->getResourceName());
         }
     }
     return $acl;
 }

 public function createService(ServiceLocatorInterface $serviceLocator)
 {
     $config = $serviceLocator->get('config.helper')->get('acl');
     $acl = new Acl();
     foreach ($config['roles'] as $role => $parents) {
         if (empty($parents)) {
             $parents = null;
         }
         $role = new GenericRole($role);
         $acl->addRole($role, $parents);
     }
     foreach ($config['resources'] as $permission => $controllers) {
         foreach ($controllers as $controller => $actions) {
             if (!$acl->hasResource($controller)) {
                 $acl->addResource(new GenericResource($controller));
             }
             foreach ($actions as $action => $role) {
                 if ($action == '*') {
                     $action = null;
                 }
                 if ($permission == 'allow') {
                     $acl->allow($role, $controller, $action);
                 } elseif ($permission == 'deny') {
                     $acl->deny($role, $controller, $action);
                 } else {
                     throw new Exception('No valid permission defined: ' . $permission);
                 }
             }
         }
     }
     if (class_exists('Zend\\View\\Helper\\Navigation')) {
         Navigation::setDefaultAcl($acl);
     }
     return $acl;
 }

 public function build()
 {
     $authService = $this->getServiceLocator()->get('user-service-auth');
     $role = $authService->getRole();
     $repositoryPerfil = $this->getEm('Admin\\Entity\\Perfil');
     $repositoryResource = $this->getEm('Admin\\Entity\\Resource');
     $repositoryAcl = $this->getEm('Admin\\Entity\\Acl');
     $config = $repositoryAcl->listaAcl();
     $config['acl']['roles'] = $repositoryPerfil->getRoles();
     $config['acl']['roles']['visitante'] = null;
     $config['acl']['resources'] = $repositoryResource->getResources();
     $acl = new ZendAcl();
     foreach ($config['acl']['roles'] as $role => $parent) {
         $acl->addRole(new GenericRole($role), $parent);
     }
     foreach ($config['acl']['resources'] as $resouce) {
         $acl->addResource(new GenericResource($resouce));
     }
     if (isset($config['acl']['previlege'])) {
         foreach ($config['acl']['previlege'] as $role => $privilege) {
             if (isset($privilege['allow'])) {
                 foreach ($privilege['allow'] as $permissao) {
                     $acl->allow($role, $permissao);
                 }
             }
             if (isset($privilege['deny'])) {
                 foreach ($privilege['deny'] as $permissao) {
                     $acl->deny($role, $permissao);
                 }
             }
         }
     }
     return $acl;
 }

 public function initialAclRole($e, $serviceAdministratorConfigManager, $authenticationServiceStorage)
 {
     $oAcl = new Acl();
     $oAcl->deny();
     $oAcl->addRole(new Role('staff_1'));
     $oAcl->addRole(new Role('staff_2'));
     $oAcl->addRole(new Role('administrator'));
     $oAcl->addResource('administrator');
     $oAcl->addResource('api');
     $oAcl->allow('staff_1', 'administrator', 'index:index');
     $oAcl->allow('staff_1', 'administrator', 'user:profile');
     $oAcl->allow('staff_1', 'administrator', 'user:list');
     $oAcl->allow('staff_1', 'administrator', 'menu:list');
     $controllerClass = get_class($e->getTarget());
     $moduleName = strtolower(substr($controllerClass, 0, strpos($controllerClass, '\\')));
     $routeMatch = $e->getRouteMatch();
     $aName = strtolower($routeMatch->getParam('action', 'not-found'));
     $cName = strtolower($routeMatch->getParam('__CONTROLLER__', 'not-found'));
     /*
     if (!$oAcl->isAllowed("staff_1",$moduleName, "{$cName}:{$aName}"))
     {
     	$response = $e->getResponse();
     	$response->setStatusCode(302);
     	$response->getHeaders()->addHeaderLine('Location', $e->getRouter()->assemble($serviceAdministratorConfigManager['options']['constraints'], 
     			array('name' => $_SERVER['HTTP_HOST']. '/'. 'default')));
     	$e->stopPropagation();
     }
     */
 }

 /**
  * Constroi a ACL
  * @return Acl 
  */
 public function build()
 {
     // servico de config (array de configuracao)
     $config = $this->getServiceManager()->get('Config');
     $acl = new Acl();
     foreach ($config['acl']['roles'] as $role => $parent) {
         $acl->addRole(new Role($role), $parent);
     }
     foreach ($config['acl']['resources'] as $r) {
         $acl->addResource(new Resource($r));
     }
     foreach ($config['acl']['privilege'] as $role => $privilege) {
         if (isset($privilege['allow'])) {
             foreach ($privilege['allow'] as $p) {
                 $acl->allow($role, $p);
             }
         }
         if (isset($privilege['deny'])) {
             foreach ($privilege['deny'] as $p) {
                 $acl->deny($role, $p);
             }
         }
     }
     return $acl;
 }

 private function _load()
 {
     if ($this->loaded == false) {
         // Add roles
         $config = $this->serviceLocator->get('config');
         if (isset($config['acl']['role_providers'])) {
             $roles = [];
             foreach ($config['acl']['role_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Role\ProviderInterface $roleProvider */
                 $roleProvider = $this->serviceLocator->get($class);
                 $roles = $roles + $roleProvider->getRoles();
             }
             foreach ($roles as $role) {
                 /** @var \Acl\Entity\Role $role */
                 $this->acl->addRole($role, $role->getParents());
             }
         }
         // Add resources
         if (isset($config['acl']['resource_providers'])) {
             foreach ($config['acl']['resource_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Resource\ProviderInterface $resourceProvider */
                 $resourceProvider = $this->serviceLocator->get($class);
                 $resources = $resourceProvider->getResources();
                 if ($resources) {
                     foreach ($resources as $r) {
                         if (!$this->acl->hasResource($r)) {
                             $this->acl->addResource($r);
                         }
                     }
                 }
             }
         }
         // Add rules
         if (isset($config['acl']['rule_providers'])) {
             $rules = [];
             foreach ($config['acl']['rule_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Rule\ProviderInterface $ruleProvider */
                 $ruleProvider = $this->serviceLocator->get($class);
                 $rules = $rules + $ruleProvider->getRules();
             }
             foreach ($rules as $rule) {
                 /** @var \Acl\Entity\Rule $rule */
                 if ($rule->allow) {
                     $this->acl->allow($rule->obj_id, $rule->resource, $rule->privilege);
                 } else {
                     $this->acl->deny($rule->obj_id, $rule->resource, $rule->privilege);
                 }
             }
         }
         $this->loaded = true;
     }
 }

 public function getPermissionsACL(\Zend\Permissions\Acl\Acl $acl, \Doctrine\ORM\EntityManager $em)
 {
     $repoPermissao = $em->getRepository('Security\\Entity\\PermissaoAcl');
     $permissions = $repoPermissao->getPermissions();
     foreach ($permissions as $permission) {
         if ($permission->getPermissao() == 'allow') {
             $acl->allow($permission->getGrupo()->getNome(), $permission->getRecursoSistema()->getUrl());
         } else {
             $acl->deny($permission->getGrupo()->getNome(), $permission->getRecursoSistema()->getUrl());
         }
     }
     return $acl;
 }

 public function setupAcl(MvcEvent $e)
 {
     $acl = new Acl();
     $rolInvitado = new Role('invitado');
     $admin = new Admin();
     $rolAdmin = new Role($admin->getRol());
     $acl->addRole($rolInvitado);
     $acl->addRole($rolAdmin, $rolInvitado);
     //el admin hereda los permisos de invitado
     $acl->addResource('index_empleado');
     $acl->addResource('login');
     $acl->deny($rolInvitado, 'index_empleado');
     $acl->allow($rolInvitado, 'login');
     //$acl->allow($rolAdmin, 'login');
     $acl->allow($rolAdmin, 'index_empleado');
     $vista = $e->getApplication()->getMvcEvent()->getViewModel();
     $vista->acl = $acl;
     $this->acl = $acl;
 }

 /**
  * @group ZF2-3454
  */
 public function testAclResourcePermissionsAreInheritedWithMultilevelResourcesAndDenyPolicy()
 {
     $this->_acl->addRole('guest');
     $this->_acl->addResource('blogposts');
     $this->_acl->addResource('feature', 'blogposts');
     $this->_acl->addResource('post_1', 'feature');
     $this->_acl->addResource('post_2', 'feature');
     // Allow a guest to read feature posts and
     // comment on everything except feature posts.
     $this->_acl->deny();
     $this->_acl->allow('guest', 'feature', 'read');
     $this->_acl->allow('guest', null, 'comment');
     $this->_acl->deny('guest', 'feature', 'comment');
     $this->assertFalse($this->_acl->isAllowed('guest', 'feature', 'write'));
     $this->assertTrue($this->_acl->isAllowed('guest', 'post_1', 'read'));
     $this->assertTrue($this->_acl->isAllowed('guest', 'post_2', 'read'));
     $this->assertFalse($this->_acl->isAllowed('guest', 'post_1', 'comment'));
     $this->assertFalse($this->_acl->isAllowed('guest', 'post_2', 'comment'));
 }