php - CakePHP 3 - ownership authorisation for associated tables -


in cakephp 3 blog tutorial, users conditionally authorized use actions edit , delete based on ownership following code:

public function isauthorized($user) {     // registered users can add articles     if ($this->request->getparam('action') === 'add') {         return true;     }      // owner of article can edit , delete     if (in_array($this->request->getparam('action'), ['edit', 'delete'])) {         $articleid = (int)$this->request->getparam('pass.0');         if ($this->articles->isownedby($articleid, $user['id'])) {             return true;         }     }      return parent::isauthorized($user); }  public function isownedby($articleid, $userid) {     return $this->exists(['id' => $articleid, 'user_id' => $userid]); }

i've been attempting implement similar own tables. example, have payments table, linked users through several different tables follows:

  • users->customers->bookings->payments.

foreign keys each:

  • user_id in customers table = users->id (user hasone customer)
  • customer_id in bookings table = customers->id (customer hasmany bookings)
  • booking_id in payments table = bookings->id(booking hasmany payments)

my appcontroller's initialize function:

public function initialize()     {         parent::initialize();          $this->loadcomponent('requesthandler');         $this->loadcomponent('flash');         $this->loadcomponent('auth',[             'authorize' => 'controller',         ]);          $this->auth->allow(['display']); //primarily pagescontroller, other actions across various controllers deny access default     }

in paymentscontroller, have following 

public function initialize()     {         parent::initialize();      }  public function isauthorized($user)     {                 if (in_array($this->request->action,['view', 'edit', 'index', 'add']             return (bool)($user['role_id'] === 1); //admin functions         }          if (in_array($this->request->action,['cart'])) {             return (bool)($user['role_id'] === 2) //customer function         }          if (in_array($this->request->action, ['cart'])) {             $bookingid = (int)$this->request->getparam('pass.0');             if ($this->payments->isownedby($bookingid, $user['id'])) {                 return true;             }         }          return parent::isauthorized($user);     }      public function isownedby($bookingid, $userid)     {         return $this->exists(['id' => $bookingid, 'user_id' => $userid]);     }

i'm unsure how link through different tables determine ownership.

  • currently if customer paying booking #123 change url paying booking #111, provided booking exists in database.
  • additionally, booking id passed cart function (since customers paying specific booking). example: if customer paying booking #123, url = localhost/project/payments/cart/123. upon submitting cart, new payment entry created.

also, regarding getparam , isownedby methods, hovering on them in editor shows this:

  • method 'getparam' not found in \cake\network\request
  • method 'isownedby' not found in app\model\table\paymentstable

however, i've gone through entire blogtutorial , can't find anywhere else getparam or isownedby used or set in model.

in isauthorized function in paymentscontroller:

if (in_array($this->request->action, ['cart'])) {     $id = $this->request->getparam('pass'); //use $this->request->param('pass') cakephp 3.3.x , below.     $booking = $this->payments->bookings->get($id,[         'contain' => ['artists']     ]);     if ($booking->artist->user_id == $user['id']) {         return true;     } }

Comments

Post a Comment

Popular posts from this blog

inversion of control - Autofac named registration constructor injection -

does autofac support specifying registration name in components' constructors? example: ninject's namedattribute . you need use autofac.extras.attributed package on top achieve this so let's have 1 interface , 2 classes: public interface ihello { string sayhello(); } public class englishhello : ihello { public string sayhello() { return "hello"; } } public class frenchhello : ihello { public string sayhello() { return "bonjour"; } } then have consumer class, in want select instance injected: public class helloconsumer { private readonly ihello helloservice; public helloconsumer([withkey("en")] ihello helloservice) { if (helloservice == null) { throw new argumentnullexception("helloservice"); } this.helloservice = helloservice; } public string sayhello() { return this.helloservice.sayhello()...
Read more

verilog - Systemverilog dynamic casting issues -

i've code snippet following in testbench function void write_to_port( my_data_type_base data ); my_data_type_extended data_ext; if(!$cast(data_ext, data)); `uvm_error(get_type_name(), "failed cast"); `uvm_info(get_name(), $psprintf("data_ext :\n%s", data_ext.sprint()), uvm_medium) // write data_ext out port.... endfunction when run it, i'm getting uvm_error "failed cast." i'm not quire sure why $cast not returning 1. can see, i'm printing out extended class data item after casting uvm_info. can see it's being cast properly. if don't use $cast if condition, don't runtime error. isn't coding practice use if dynamic cast check if $cast returning 1 ? what might reason behind cast not returning 1 in above case? i think semicolon on line 'if' not belong? i think consumes if statement, , uvm_error executes regardless of how if evaluates: if(!$cast(data_ext, data)); <- no semico...
Read more

ios - Change Storyboard View using Seague -

i have following code checks connection server, , depending on want change views if no connection found. nsstring *connect = [nsstring stringwithcontentsofurl:[nsurl urlwithstring:@"http://myserver.com"] encoding:nsutf8stringencoding error:nil]; if (connect == null) { [self performseguewithidentifier:@"network_failure" sender:self]; } else { // other code here } my problem not change views. have added storyboard segue between 2 views identifier of network_failure . not have navigation controller or that, problem? thanks help! no not problem. first of all, in objectivec exists nil object oriented null . must use that. so: if(connect == nil) or better: if(!connect) so due fact nil not same of null , probably code does't enter in if scope . you have been able discover breakpoint. anyway: be sure set trigger segue (line) 2 view controller , , name network_failure (that not best name. should instead view1toview2 ) as, m...
Read more