PHP Acl::addResource方法代碼示例

 public function initialAclRole($e, $serviceAdministratorConfigManager, $authenticationServiceStorage)
 {
     $oAcl = new Acl();
     $oAcl->deny();
     $oAcl->addRole(new Role('staff_1'));
     $oAcl->addRole(new Role('staff_2'));
     $oAcl->addRole(new Role('administrator'));
     $oAcl->addResource('administrator');
     $oAcl->addResource('api');
     $oAcl->allow('staff_1', 'administrator', 'index:index');
     $oAcl->allow('staff_1', 'administrator', 'user:profile');
     $oAcl->allow('staff_1', 'administrator', 'user:list');
     $oAcl->allow('staff_1', 'administrator', 'menu:list');
     $controllerClass = get_class($e->getTarget());
     $moduleName = strtolower(substr($controllerClass, 0, strpos($controllerClass, '\\')));
     $routeMatch = $e->getRouteMatch();
     $aName = strtolower($routeMatch->getParam('action', 'not-found'));
     $cName = strtolower($routeMatch->getParam('__CONTROLLER__', 'not-found'));
     /*
     if (!$oAcl->isAllowed("staff_1",$moduleName, "{$cName}:{$aName}"))
     {
     	$response = $e->getResponse();
     	$response->setStatusCode(302);
     	$response->getHeaders()->addHeaderLine('Location', $e->getRouter()->assemble($serviceAdministratorConfigManager['options']['constraints'], 
     			array('name' => $_SERVER['HTTP_HOST']. '/'. 'default')));
     	$e->stopPropagation();
     }
     */
 }

 /**
  * @return Acl
  */
 protected function roleAcl()
 {
     if (!$this->roleAcl) {
         $id = $this->objId();
         $this->roleAcl = new Acl();
         $this->roleAcl->addRole(new Role($id));
         $this->roleAcl->addResource(new Resource('admin'));
         $q = '
         select
             `denied`,
             `allowed`,
             `superuser`
         from
             `charcoal_admin_acl_roles`
         where
             ident = :id';
         $db = \Charcoal\App\App::instance()->getContainer()->get('database');
         $sth = $db->prepare($q);
         $sth->bindParam(':id', $id);
         $sth->execute();
         $permissions = $sth->fetch(\PDO::FETCH_ASSOC);
         $this->roleAllowed = explode(',', trim($permissions['allowed']));
         $this->roleDenied = explode(',', trim($permissions['denied']));
         foreach ($this->roleAllowed as $allowed) {
             $this->roleAcl->allow($id, 'admin', $allowed);
         }
         foreach ($this->roleDenied as $denied) {
             $this->roleAcl->deny($id, 'admin', $denied);
         }
     }
     return $this->roleAcl;
 }

 /**
  * AccessControl constructor.
  * @param $config
  * @param $entityManager
  * @param $userMapper
  * @param $roleMapper
  * @param $resourceMapper
  */
 public function __construct($config, $entityManager, $userMapper, $roleMapper, $resourceMapper)
 {
     $this->setConfig($config);
     $this->setEntityManager($entityManager);
     $this->setUserMapper($userMapper);
     $this->setRoleMapper($roleMapper);
     $this->setResourceMapper($resourceMapper);
     $this->modules = $this->getConfig()['mfcc_admin']['modules'];
     $this->acl = new Acl();
     foreach ($this->getRoleMapper()->getAll() as $index => $role) {
         /* @var $role RoleEntity */
         $this->acl->addRole(new Role($role->getName()));
     }
     foreach ($this->modules as $index => $module) {
         $this->acl->addResource(new GenericResource($module['module_name']));
     }
     $this->acl->addResource(new GenericResource('Users'));
     $this->acl->addResource(new GenericResource('Roles'));
     foreach ($this->getResourceMapper()->getAll() as $index => $resource) {
         /* @var $resource ResourceEntity */
         $this->acl->allow($resource->getRole()->getName(), $resource->getResource(), $resource->getPermission());
         if ($resource->getPermission() == self::WRITE) {
             $this->acl->allow($resource->getRole()->getName(), $resource->getResource(), self::READ);
         }
     }
 }

 public function doAuthorization($e)
 {
     return;
     //setting ACL...
     $acl = new Acl();
     //add role ..
     $acl->addRole(new Role('anonymous'));
     $acl->addRole(new Role('user'), 'anonymous');
     $acl->addRole(new Role('admin'), 'user');
     $acl->addResource(new Resource('Stick'));
     $acl->addResource(new Resource('Auth'));
     $acl->deny('anonymous', 'Stick', 'list');
     $acl->allow('anonymous', 'Auth', 'login');
     $acl->allow('anonymous', 'Auth', 'signup');
     $acl->allow('user', 'Stick', 'add');
     $acl->allow('user', 'Auth', 'logout');
     //admin is child of user, can publish, edit, and view too !
     $acl->allow('admin', 'Stick');
     $controller = $e->getTarget();
     $controllerClass = get_class($controller);
     $namespace = substr($controllerClass, strrpos($controllerClass, '\\') + 1);
     $role = !$this->getSessContainer()->role ? 'anonymous' : $this->getSessContainer()->role;
     echo $role;
     exit;
     if (!$acl->isAllowed($role, $namespace, 'view')) {
         $router = $e->getRouter();
         $url = $router->assemble(array(), array('name' => 'Login/auth'));
         $response = $e->getResponse();
         $response->setStatusCode(302);
         //redirect to login route...
         $response->getHeaders()->addHeaderLine('Location', $url);
     }
 }

 public function __invoke($serviceLocator)
 {
     $config = $serviceLocator->get('config');
     $this->acl = $serviceLocator->get('MultiRoleAclBase\\Service\\MultiRolesAcl');
     if (get_class($this->acl) == 'MultiRoleAclBase\\Service\\MultiRolesAcl' || is_subclass_of($this->acl, 'MultiRoleAclBase\\Service\\MultiRolesAcl')) {
         $this->acl->setAllowAccessWhenResourceUnknown(false);
     }
     $this->roleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RoleBuilder');
     $this->resourceBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\ResourceBuilder');
     $this->ruleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RuleBuilder');
     // Get all Roles from RoleBuilder
     $roles = $this->roleBuilder->buildRoles($this->acl, $serviceLocator);
     if (is_array($roles)) {
         foreach ($roles as $role) {
             $this->acl->addRole($role);
         }
     }
     // Get all Resources from ResourceBuilder
     $resources = $this->resourceBuilder->buildResources($this->acl, $serviceLocator);
     if (is_array($resources)) {
         foreach ($resources as $resource) {
             $this->acl->addResource($resource);
         }
     }
     // Build all the rules
     $this->ruleBuilder->buildRules($this->acl, $serviceLocator);
     return $this->acl;
 }

 /**
  * Constructor
  * 
  * @param array $roles
  * @param array $resources
  */
 public function __construct($roles, $resources)
 {
     //Create brand new Acl object
     $this->acl = new Acl();
     //Add each resources
     foreach ($resources as $resource) {
         //Add the resource
         $this->acl->addResource(new Resource($resource));
     }
     //Add each roles
     foreach ($roles as $role => $resources) {
         //Add the role
         $this->acl->addRole(new Role($role));
         //If we want to grant all privileges on all resources
         if ($resources === true) {
             //Allow all privileges
             $this->acl->allow($role);
             //Else if we have specific privileges for the role
         } elseif (is_array($resources)) {
             //Create each resource permissions
             foreach ($resources as $resource => $permissions) {
                 //Add resource permissions of the role
                 $this->acl->allow($role, $resource, $permissions);
             }
         }
     }
 }

 public function doAuthorization($e)
 {
     //setting ACL...
     $acl = new Acl();
     //add role ..
     $acl->addRole(new Role('anonymous'));
     $acl->addRole(new Role('user'), 'anonymous');
     $acl->addRole(new Role('admin'), 'user');
     $acl->addResource(new Resource('Application'));
     $acl->addResource(new Resource('Login'));
     $acl->addResource(new Resource('ZfcAdmin'));
     $acl->deny('anonymous', 'Application', 'view');
     $acl->allow('anonymous', 'Login', 'view');
     $acl->allow('user', array('Application'), array('view'));
     //admin is child of user, can publish, edit, and view too !
     $acl->allow('admin', array('Application'), array('publish', 'edit'));
     $controller = $e->getTarget();
     $controllerClass = get_class($controller);
     //echo "<pre>";print_r($controllerClass);exit;
     $namespace = substr($controllerClass, 0, strpos($controllerClass, '\\'));
     // echo "<pre>";print_r($namespace);exit;
     $role = !$this->getSessContainer()->role ? 'anonymous' : $this->getSessContainer()->role;
     if (!isset($_SESSION['admin']['user_id']) && $namespace == 'ZfcAdmin') {
         $router = $e->getRouter();
         $url = $router->assemble(array(), array('name' => 'zfcadmin'));
         $response = $e->getResponse();
         $response->setStatusCode(302);
         //redirect to login route...
         /* change with header('location: '.$url); if code below not working */
         $response->getHeaders()->addHeaderLine('Location', $url);
         $e->stopPropagation();
     }
 }

 /**
  * AclRepository constructor.
  *
  * the user_id injected should be a "role name"
  * Each Role would actually be a user.
  * Then each User can have 1 or more different roles
  * which then correspond to one or more different resources
  *
  * $aclList = [
  * "resources" => [list of resources names]
  * "roles" => [list of role names]
  * "assignments" => [
  *      "allow" => [
  *          "rolename" => [list of resources]
  *      ]
  *      "deny" => [
  *          "rolename" => [list of resources]
  *      ]
  * ]
  *
  *
  * @param string $role This is the current Role(s) you are testing for
  * @param array  $aclList
  */
 public function __construct(array $role, array $aclList = [])
 {
     $this->acl = new Acl();
     $this->role = $role;
     if (isset($aclList['resources'])) {
         foreach ($aclList['resources'] as $resource) {
             $this->acl->addResource($this->makeResource($resource));
         }
     }
     if (isset($aclList['roles'])) {
         foreach ($aclList['roles'] as $role) {
             $this->acl->addRole($this->makeRole($role));
         }
     }
     if (isset($aclList['assignments'])) {
         foreach ($aclList['assignments']['allow'] as $role => $resources) {
             foreach ($resources as $resource) {
                 $this->addAllow($role, $resource);
             }
         }
         foreach ($aclList['assignments']['deny'] as $role => $resources) {
             foreach ($resources as $resource) {
                 $this->addDeny($role, $resource);
             }
         }
     }
 }

 public function initAcl(MvcEvent $e)
 {
     //Creamos el objeto ACL
     $acl = new Acl();
     //Incluimos la lista de roles y permisos, nos devuelve un array
     $roles = (require 'config/autoload/acl.roles.php');
     foreach ($roles as $role => $resources) {
         //Indicamos que el rol será genérico
         $role = new \Zend\Permissions\Acl\Role\GenericRole($role);
         //Añadimos el rol al ACL
         $acl->addRole($role);
         //Recorremos los recursos o rutas permitidas
         foreach ($resources["allow"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Permitimos a ese rol ese recurso
             $acl->allow($role, $resource);
         }
         foreach ($resources["deny"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Denegamos a ese rol ese recurso
             $acl->deny($role, $resource);
         }
     }
     //Establecemos la lista de control de acceso
     $e->getViewModel()->acl = $acl;
 }

 public function loginAction()
 {
     $authenticationService = new AuthenticationService();
     if ($authenticationService->hasIdentity()) {
         return $this->redirect()->toRoute('dashboard');
     }
     $form = new LoginForm();
     $viewModel = new ViewModel();
     $this->layout("layout/login");
     $viewModel->setVariable("form", $form);
     $viewModel->setVariable("config", $this->config);
     $request = $this->getRequest();
     if ($request->isPost()) {
         $login = new Login();
         $login->getInputFilter()->get('captcha')->setRequired(false);
         $form->setInputFilter($login->getInputFilter());
         $form->setData($request->getPost());
         if ($form->isValid()) {
             $username = $form->get('username')->getValue();
             $password = $form->get('password')->getValue();
             $authSessionAdapter = $this->getAuthSessionAdapter();
             if ($authSessionAdapter->authenticate($username, $password)) {
                 $userObject = $authenticationService->getStorage()->read();
                 $rol = $userObject->rol;
                 $acl = new Acl();
                 $acl->addResource(new Resource("dashboard"));
                 $acl->addResource(new Resource("note"));
                 if ($rol == 1) {
                     $resources = $this->config['resources'];
                     foreach ($resources as $module => $resource) {
                         foreach ($resource as $resourceValue) {
                             $acl->addResource(new Resource($resourceValue));
                         }
                     }
                 } else {
                     $acl->addRole(new Role($rol));
                     $modules = $this->getModuleRolTable()->fetchAll($rol);
                     foreach ($modules as $module) {
                         $acl->addResource(new Resource($module));
                     }
                 }
                 $userObject->acl = serialize($acl);
                 return $this->redirect()->toRoute('dashboard');
             } else {
                 $form->get('username')->setValue("");
                 $form->get('password')->setValue("");
                 if ($authSessionAdapter->getCode() == -5) {
                     $form->get("username")->setMessages(array('username' => $this->config['authentication_codes'][$authSessionAdapter->getCode()]));
                 } else {
                     $form->get("username")->setMessages(array('username' => $this->config['authentication_codes'][-6]));
                 }
             }
         } else {
             $form->get("username")->setMessages(array('username' => $this->config['authentication_codes'][-6]));
         }
     }
     return $viewModel;
 }

 private function _load()
 {
     if ($this->loaded == false) {
         // Add roles
         $config = $this->serviceLocator->get('config');
         if (isset($config['acl']['role_providers'])) {
             $roles = [];
             foreach ($config['acl']['role_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Role\ProviderInterface $roleProvider */
                 $roleProvider = $this->serviceLocator->get($class);
                 $roles = $roles + $roleProvider->getRoles();
             }
             foreach ($roles as $role) {
                 /** @var \Acl\Entity\Role $role */
                 $this->acl->addRole($role, $role->getParents());
             }
         }
         // Add resources
         if (isset($config['acl']['resource_providers'])) {
             foreach ($config['acl']['resource_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Resource\ProviderInterface $resourceProvider */
                 $resourceProvider = $this->serviceLocator->get($class);
                 $resources = $resourceProvider->getResources();
                 if ($resources) {
                     foreach ($resources as $r) {
                         if (!$this->acl->hasResource($r)) {
                             $this->acl->addResource($r);
                         }
                     }
                 }
             }
         }
         // Add rules
         if (isset($config['acl']['rule_providers'])) {
             $rules = [];
             foreach ($config['acl']['rule_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Rule\ProviderInterface $ruleProvider */
                 $ruleProvider = $this->serviceLocator->get($class);
                 $rules = $rules + $ruleProvider->getRules();
             }
             foreach ($rules as $rule) {
                 /** @var \Acl\Entity\Rule $rule */
                 if ($rule->allow) {
                     $this->acl->allow($rule->obj_id, $rule->resource, $rule->privilege);
                 } else {
                     $this->acl->deny($rule->obj_id, $rule->resource, $rule->privilege);
                 }
             }
         }
         $this->loaded = true;
     }
 }

 public function fillResources(array $resourcesConfig)
 {
     foreach ($resourcesConfig as $resource => $options) {
         $inherit = $this->getOption($options, self::INHERIT);
         if (null !== $inherit && !is_string($inherit) && !$inherit instanceof ResourceInterface) {
             throw new Exceptions\RuntimeException('Inherit option must be a string or implement ResourceInterface for resources');
         }
         $this->acl->addResource($resource, $inherit);
         $privileges = $this->getOption($options, self::PRIVILEGES, []);
         foreach ($privileges as $role => $actions) {
             $this->acl->allow([$role], [$resource], $actions);
         }
     }
 }

 public function getResourcesACL(\Zend\Permissions\Acl\Acl $acl, \Doctrine\ORM\EntityManager $em)
 {
     $repo = $em->getRepository('Security\\Entity\\RecursoSistema');
     foreach ($repo->fetchPairs() as $recurso) {
         $acl->addResource($recurso);
     }
     // carrega os recurso desprotegidos
     foreach ($this->getRecursosDesprotegidos() as $recurso) {
         if (!$acl->hasResource($recurso)) {
             $acl->addResource($recurso);
         }
     }
     return $acl;
 }

 /**
  * Constroi a ACL
  * @return Acl 
  */
 public function build()
 {
     // servico de config (array de configuracao)
     $config = $this->getServiceManager()->get('Config');
     $acl = new Acl();
     foreach ($config['acl']['roles'] as $role => $parent) {
         $acl->addRole(new Role($role), $parent);
     }
     foreach ($config['acl']['resources'] as $r) {
         $acl->addResource(new Resource($r));
     }
     foreach ($config['acl']['privilege'] as $role => $privilege) {
         if (isset($privilege['allow'])) {
             foreach ($privilege['allow'] as $p) {
                 $acl->allow($role, $p);
             }
         }
         if (isset($privilege['deny'])) {
             foreach ($privilege['deny'] as $p) {
                 $acl->deny($role, $p);
             }
         }
     }
     return $acl;
 }

 public function build()
 {
     $authService = $this->getServiceLocator()->get('user-service-auth');
     $role = $authService->getRole();
     $repositoryPerfil = $this->getEm('Admin\\Entity\\Perfil');
     $repositoryResource = $this->getEm('Admin\\Entity\\Resource');
     $repositoryAcl = $this->getEm('Admin\\Entity\\Acl');
     $config = $repositoryAcl->listaAcl();
     $config['acl']['roles'] = $repositoryPerfil->getRoles();
     $config['acl']['roles']['visitante'] = null;
     $config['acl']['resources'] = $repositoryResource->getResources();
     $acl = new ZendAcl();
     foreach ($config['acl']['roles'] as $role => $parent) {
         $acl->addRole(new GenericRole($role), $parent);
     }
     foreach ($config['acl']['resources'] as $resouce) {
         $acl->addResource(new GenericResource($resouce));
     }
     if (isset($config['acl']['previlege'])) {
         foreach ($config['acl']['previlege'] as $role => $privilege) {
             if (isset($privilege['allow'])) {
                 foreach ($privilege['allow'] as $permissao) {
                     $acl->allow($role, $permissao);
                 }
             }
             if (isset($privilege['deny'])) {
                 foreach ($privilege['deny'] as $permissao) {
                     $acl->deny($role, $permissao);
                 }
             }
         }
     }
     return $acl;
 }