Zend Framework

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.2
• Fix Version/s: 1.9.1
• Component/s: Zend_Acl
• Labels:

  None

Hi,

I think there is a problem of inheritage of roles. If an inhertited role is checked by isAllowed(), the rules are checked on an instance (Zend_Acl_Role) of the parent and not on the instance of the current role.

Example:

ACL definitions

class TestAcl extends Zend_Acl {

	public function __construct() {
		$this->add(new Zend_Acl_Resource('video'));

		$this->addRole(new Zend_Acl_Role('guest'));
		$this->addRole(new Zend_Acl_Role('member'), 'guest');

		$this->allow('guest', 'video', 'watch', new VideoWatchAssertion());
		$this->allow('member');
	}
}

class Video implements Zend_Acl_Resource_Interface {

	public $property;

	public function __construct($p) {
		$this->property = 0;
		if($p) {
			$this->property = 1;
		}
	}
	
	public function getResourceId() {
		return 'video';
	}
}

class User implements Zend_Acl_Role_Interface {

	public $property;
	private $roleId;

	public function __construct($role, $p) {
		$this->roleId = $role;
		$this->property = 0;
		if($p) {
			$this->property = 1;
		}
	}
	
	public function getRoleId() {	
		return $this->roleId;
	}
}

class VideoWatchAssertion implements Zend_Acl_Assert_Interface {

	public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $user=null, Zend_Acl_Resource_Interface $video=null, $privilege=null) {
		
		if($video->property == 1) {
			if($user->property != 1) {
				return false;
			}
		}

		return true;
	}
}

Check for access:

$acl = new TestAcl();
$user = new User('member', true);
$video = new Video(true);
$result = $acl->isAllowed($user, $video, 'watch');

The assertion is called by an instance of Zend_Acl_Role (roleId = guest) and not by an instance of User; but the check of the User instance for access to object specific properties/methods would be absolutly necessary.
It would be very helpful if the rules of the parent role is checked by the instance of the current role.

Of course it is possible to bypass this problem by defining the rules for each single role, but it is not very nice.

$this->allow('guest', 'video', 'watch', new VideoWatchAssertion());
$this->allow('member', 'video', 'watch', new VideoWatchAssertion());
$this->allow('member');

• Assignee:

  Ralph Schindler

  Reporter:

  Mathias Schreck

• Created:

  04/Jun/08 2:13 PM

  Updated:

  14/Aug/09 2:33 PM

  Resolved:

  14/Aug/09 2:33 PM