
平台论坛博客文库

› 论坛 › 程序设计 › PHP › cakephp中acl和auth详解

cakephp中acl和auth详解 [复制链接]

sbguh

白手起家

论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2009-11-10 10:40 |只看该作者 |倒序浏览

自学习cakephp以来，一直没有完成搞懂acl,也查过了很多资料，但对它的用法也是一知半解，acl应该是cakephp中一个比较难懂的地方，这几天又重新看了下手册，发现acl没有相信中的难，但比我想象中的好用.欢迎大家转载和访问我的网站http://www.shopokey.com
下面让我说说它的具体用法已经使用过程中应该注意到问题
准备前工作：
最好是能配置好bake，使bake命名有效，虽然这个不是必须的，不过有这个命令行工具以后我们会方便很多
在你的数据库中导入下面的sql语句

CREATE TABLE users (
id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(255) NOT NULL UNIQUE,
password CHAR(40) NOT NULL,
group_id INT(11) NOT NULL,
created DATETIME,
modified DATETIME
);
CREATE TABLE groups (
id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
name VARCHAR(100) NOT NULL,
created DATETIME,
modified DATETIME
);
CREATE TABLE posts (
id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
user_id INT(11) NOT NULL,
title VARCHAR(255) NOT NULL,
body TEXT,
created DATETIME,
modified DATETIME
);
CREATE TABLE widgets (
id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
name VARCHAR(100) NOT NULL,
part_no VARCHAR(12),
quantity INT(11)
);

复制代码

在这里我们使用cake bake all命令工具快速生成models, controllers, 和 views(在这里我就详细介绍怎么使用cakephp中的bake命令了)

下一步，准备使用auth组件认证
首先我们打开users_controller.php在UsersController类中增加登录登出动作

function login() {
//Auth Magic
}
function logout() {
//Leave empty for now.
}
然后创建视图文件app/views/users/login.ctp
<?php
$session->flash('auth');
echo $form->create('User', array('action' => 'login'));
echo $form->inputs(array(
'legend' => __('Login', true),
'username',
'password'
));
echo $form->end('Login');
?>

复制代码

下一步我们需要修改AppController(/app/app_controller.php)，如果你的app目录下面没有app_controller.php文件的话，你可以自己创建一个

<?php
class AppController extends Controller {
var $components = array('Acl', 'Auth');
function beforeFilter() {
//Configure AuthComponent
$this->Auth->authorize = 'actions';
$this->Auth->loginAction = array('controller' => 'users', 'action' => 'login');
$this->Auth->logoutRedirect = array('controller' => 'users', 'action' => 'login');
$this->Auth->loginRedirect = array('controller' => 'posts', 'action' => 'add');
}
}
?>

复制代码

接下来我们需要修改GroupsController和UsersController，这两个文件的目录大家应该都知道在哪里吧..
在这两个控制器中分别添加以下代码

function beforeFilter() {
parent::beforeFilter();
$this->Auth->allowedActions = array('*');
}

复制代码

其实这段代码的意思是允许用户访问所有user和group下的action，当然这个后面是要改回来的

接下来我们要初始化acl表
因为现在我们的数据库中就只有四个表，还没有导入acl表
我们用下面语句导入acl表到数据库中
在命令行中输入cake schema run create DbAcl

我们根据提示导入表

接下来我们需要修改user和group模型
首先我们打开model目录下的user.php增加以下代码(事实上你可以用下面代码替换)

var $name = 'User';
var $belongsTo = array('Group');
var $actsAs = array('Acl' => 'requester');
function parentNode() {
if (!$this->id && empty($this->data)) {
return null;
}
$data = $this->data;
if (empty($this->data)) {
$data = $this->read();
}
if (!$data['User']['group_id']) {
return null;
} else {
return array('Group' => array('id' => $data['User']['group_id']));
}
}

复制代码

然后修改group模型

var $actsAs = array('Acl' => array('requester'));
function parentNode() {
return null;
}

复制代码

好了，到这一步我们需要暂时停一下了，现在在浏览器中打开相应的user和group页面，增加user和group，比如我的，我打开http://localhost/cakephp/groups增加组，打开http://localhost/cakephp/users/ 增加用户，在这里我们增加三个组和三个用户

添加完以后你可以打开phpmyadmin看下aros表看下是不是多了些记录

是不是觉得很神奇不可思议啊，哈哈，这就是框架的魅力，到目前为止和acl有关的表，就只有aros表中存在记录

在我们以后修改每一个user用户时，我们也必须修改aros表记录
所有我们应该做user模型中增加下面代码

/**
* After save callback
*
* Update the aro for the user.
*
* @access public
* @return void
*/
function afterSave($created) {
if (!$created) {
$parent = $this->parentNode();
$parent = $this->node($parent);
$node = $this->node();
$aro = $node[0];
$aro['Aro']['parent_id'] = $parent[0]['Aro']['id'];
$this->Aro->save($aro);
}
}

复制代码

到这里我们aro创建已经完成，接下来我们应该创佳aco了
我们应该知道其实acl的本质是用来定义一个ARO在什么时候可以访问一个aco的组件，明白了这一点一切就变的很简单了。
为了简单我们使用命令行执行cake acl create aco root controllers

你现在再用phpmyadmin打开acors表，你应该会看到表中已经有一条记录了，这条记录就是刚刚执行这个命令的结果，当然我们不一定非得用命令行工具的。

接下来我们还需要修改下AppController，在里面的beforeFilter方法中我们需要增加一行$this->Auth->actionPath = 'controllers/';

下面是重点，在我们的app项目中可能会存在很多的控制器和方法，我们需要把每个action都添加到acors表中来实现权限控制，当然如果你不怕麻烦的话可以一个一个手动添加，但我想大多数程序员还是很懒的，所有我们这里需要使用自动生成工具

这里我们添加下面代码放在users_controller.php中，当然你也可以放在其他的控制器中
下面我就在users_controller.php中增加下面代码

function build_acl() {
if (!Configure::read('debug')) {
return $this->_stop();
}
$log = array();
$aco =& $this->Acl->Aco;
$root = $aco->node('controllers');
if (!$root) {
$aco->create(array('parent_id' => null, 'model' => null, 'alias' => 'controllers'));
$root = $aco->save();
$root['Aco']['id'] = $aco->id;
$log[] = 'Created Aco node for controllers';
} else {
$root = $root[0];
}
App::import('Core', 'File');
$Controllers = Configure::listObjects('controller');
$appIndex = array_search('App', $Controllers);
if ($appIndex !== false ) {
unset($Controllers[$appIndex]);
}
$baseMethods = get_class_methods('Controller');
$baseMethods[] = 'buildAcl';
$Plugins = $this->_getPluginControllerNames();
$Controllers = array_merge($Controllers, $Plugins);
// look at each controller in app/controllers
foreach ($Controllers as $ctrlName) {
$methods = $this->_getClassMethods($this->_getPluginControllerPath($ctrlName));
// Do all Plugins First
if ($this->_isPlugin($ctrlName)){
$pluginNode = $aco->node('controllers/'.$this->_getPluginName($ctrlName));
if (!$pluginNode) {
$aco->create(array('parent_id' => $root['Aco']['id'], 'model' => null, 'alias' => $this->_getPluginName($ctrlName)));
$pluginNode = $aco->save();
$pluginNode['Aco']['id'] = $aco->id;
$log[] = 'Created Aco node for ' . $this->_getPluginName($ctrlName) . ' Plugin';
}
}
// find / make controller node
$controllerNode = $aco->node('controllers/'.$ctrlName);
if (!$controllerNode) {
if ($this->_isPlugin($ctrlName)){
$pluginNode = $aco->node('controllers/' . $this->_getPluginName($ctrlName));
$aco->create(array('parent_id' => $pluginNode['0']['Aco']['id'], 'model' => null, 'alias' => $this->_getPluginControllerName($ctrlName)));
$controllerNode = $aco->save();
$controllerNode['Aco']['id'] = $aco->id;
$log[] = 'Created Aco node for ' . $this->_getPluginControllerName($ctrlName) . ' ' . $this->_getPluginName($ctrlName) . ' Plugin Controller';
} else {
$aco->create(array('parent_id' => $root['Aco']['id'], 'model' => null, 'alias' => $ctrlName));
$controllerNode = $aco->save();
$controllerNode['Aco']['id'] = $aco->id;
$log[] = 'Created Aco node for ' . $ctrlName;
}
} else {
$controllerNode = $controllerNode[0];
}
//clean the methods. to remove those in Controller and private actions.
foreach ($methods as $k => $method) {
if (strpos($method, '_', 0) === 0) {
unset($methods[$k]);
continue;
}
if (in_array($method, $baseMethods)) {
unset($methods[$k]);
continue;
}
$methodNode = $aco->node('controllers/'.$ctrlName.'/'.$method);
if (!$methodNode) {
$aco->create(array('parent_id' => $controllerNode['Aco']['id'], 'model' => null, 'alias' => $method));
$methodNode = $aco->save();
$log[] = 'Created Aco node for '. $method;
}
}
}
if(count($log)>0) {
debug($log);
}
}
function _getClassMethods($ctrlName = null) {
App::import('Controller', $ctrlName);
if (strlen(strstr($ctrlName, '.')) > 0) {
// plugin's controller
$num = strpos($ctrlName, '.');
$ctrlName = substr($ctrlName, $num+1);
}
$ctrlclass = $ctrlName . 'Controller';
$methods = get_class_methods($ctrlclass);
// Add scaffold defaults if scaffolds are being used
$properties = get_class_vars($ctrlclass);
if (array_key_exists('scaffold',$properties)) {
if($properties['scaffold'] == 'admin') {
$methods = array_merge($methods, array('admin_add', 'admin_edit', 'admin_index', 'admin_view', 'admin_delete'));
} else {
$methods = array_merge($methods, array('add', 'edit', 'index', 'view', 'delete'));
}
}
return $methods;
}
function _isPlugin($ctrlName = null) {
$arr = String::tokenize($ctrlName, '/');
if (count($arr) > 1) {
return true;
} else {
return false;
}
}
function _getPluginControllerPath($ctrlName = null) {
$arr = String::tokenize($ctrlName, '/');
if (count($arr) == 2) {
return $arr[0] . '.' . $arr[1];
} else {
return $arr[0];
}
}
function _getPluginName($ctrlName = null) {
$arr = String::tokenize($ctrlName, '/');
if (count($arr) == 2) {
return $arr[0];
} else {
return false;
}
}
function _getPluginControllerName($ctrlName = null) {
$arr = String::tokenize($ctrlName, '/');
if (count($arr) == 2) {
return $arr[1];
} else {
return false;
}
}
/**
* Get the names of the plugin controllers ...
*
* This function will get an array of the plugin controller names, and
* also makes sure the controllers are available for us to get the
* method names by doing an App::import for each plugin controller.
*
* @return array of plugin names.
*
*/
function _getPluginControllerNames() {
App::import('Core', 'File', 'Folder');
$paths = Configure::getInstance();
$folder =& new Folder();
$folder->cd(APP . 'plugins');
// Get the list of plugins
$Plugins = $folder->read();
$Plugins = $Plugins[0];
$arr = array();
// Loop through the plugins
foreach($Plugins as $pluginName) {
// Change directory to the plugin
$didCD = $folder->cd(APP . 'plugins'. DS . $pluginName . DS . 'controllers');
// Get a list of the files that have a file name that ends
// with controller.php
$files = $folder->findRecursive('.*_controller\.php');
// Loop through the controllers we found in the plugins directory
foreach($files as $fileName) {
// Get the base file name
$file = basename($fileName);
// Get the controller name
$file = Inflector::camelize(substr($file, 0, strlen($file)-strlen('_controller.php')));
if (!preg_match('/^'. Inflector::humanize($pluginName). 'App/', $file)) {
if (!App::import('Controller', $pluginName.'.'.$file)) {
debug('Error importing '.$file.' for plugin '.$pluginName);
} else {
/// Now prepend the Plugin name ...
// This is required to allow us to fetch the method names.
$arr[] = Inflector::humanize($pluginName) . "/" . $file;
}
}
}
}
return $arr;
}

复制代码

增加好以后我们打开浏览器访问刚才的方法
比如我的http://localhost/cakephp/users/build_acl
运行后程序会自动把所有controller下的action都添加到acos表中，你现在打开acos表应该就会看到很多记录了，如

接下来应该是做我们最兴奋的事情了，就是实现权限控制，因为我们前期准备工作都做好了，最终我们都是为了实现可以控制权限

1. 先来介绍下语法，允许访问$this->Acl->allow($aroAlias, $acoAlias);
拒绝访问$this->Acl->deny($aroAlias, $acoAlias);

你先打开aros_acos表中看下，到目前为止该表应该还是没有记录的
我们可以写一个初始化函数
我同样把这段代码放在user控制器中

function initDB() {
$group =& $this->User->Group;
//Allow admins to everything
$group->id = 1;
$this->Acl->allow($group, 'controllers');
//allow managers to posts and widgets
$group->id = 2;
$this->Acl->deny($group, 'controllers');
$this->Acl->allow($group, 'controllers/Posts');
$this->Acl->allow($group, 'controllers/Widgets');
//allow users to only add and edit on posts and widgets
$group->id = 3;
$this->Acl->deny($group, 'controllers');
$this->Acl->allow($group, 'controllers/Posts/add');
$this->Acl->allow($group, 'controllers/Posts/edit');
$this->Acl->allow($group, 'controllers/Widgets/add');
$this->Acl->allow($group, 'controllers/Widgets/edit');
}

复制代码

接下来我们在浏览器中访问这个action

这个是时候你就应该发现你的aros_acos表中多了很多条记录，哈哈，这个就是acl的秘密所在.

接下来你可以使用不同组的用户名登录访问，你还可以修改initDB里面的代码进行测试，至于实际工作中如何使用，那就要看你自己的了，最后祝大家工作愉快！最后我把文档放在这里，有兴趣的朋友可以下载

cakephp中acl详解.rar (95.39 KB, 下载次数: 340)

[ 本帖最后由 sbguh 于 2009-11-10 19:11 编辑 ]

文库|博客

sbguh

白手起家

论坛徽章:: 0

2楼 [报告]

发表于 2009-11-11 14:46 |只看该作者

这里我接着上面的做一个很简单的后台管理，让我们可以从后台修改编辑权限
先编辑修改UsersController，在beforeFilter方法中增加下面几句

$this->set("Acl",&$this->Acl);
$userinfo = $this->Auth->user();
$this->set('userinfo',$userinfo);

复制代码

这几句话的目的是为了让我们可以在views里面中可以访问到acl以及user等信息

我现在要做的就是在修改用户信息的时候也可以修改该用户的权限
于是我修改UsersController下面的edit

function edit($id = null) {
if (!$id && empty($this->data)) {
$this->Session->setFlash(__('Invalid User', true));
$this->redirect(array('action'=>'index'));
}
if (!empty($this->data)) {
$this->User->id=$this->data['User']['id'];
//$this->Acl->deny($this->User, '*');
$controller=$this->Aco->find("all",array('conditions' => array("parent_id=1")));
foreach($controller as $k=>$v){
$controller[$k]['Aco']['children']=$this->Aco->children($v['Aco']['id']);
foreach($controller[$k]['Aco']['children'] as $k2=> $v2){
$kk="controllers/".$v['Aco']['alias']."/".$v2['Aco']['alias'];
if(in_array($kk,$this->data['aco'])){
$this->Acl->allow($this->User, $kk);
}else{
$this->Acl->deny($this->User, $kk);
}
}
}
if ($this->User->save($this->data)) {
$this->Session->setFlash(__('The User has been saved', true));
$this->redirect(array('action'=>'index'));
} else {
$this->Session->setFlash(__('The User could not be saved. Please, try again.', true));
}
}
if (empty($this->data)) {
$this->data = $this->User->read(null, $id);
$this->Aco->Behaviors->attach('Containable');
$this->Aco->contain();
$controller=$this->Aco->find("all",array('conditions' => array("parent_id=1")));
$this->User->id=$id;
foreach($controller as $k=>$v){
$controller[$k]['Aco']['children']=$this->Aco->children($v['Aco']['id']);
foreach($controller[$k]['Aco']['children'] as $k2=> $v2){
$c=$this->Acl->check(array('model' => 'User', 'foreign_key' => $id), "controllers/".$v['Aco']['alias']."/".$v2['Aco']['alias']);
if($c){
$controller[$k]['Aco']['children'][$k2]['Aco']['checked']=1;
}else{
$controller[$k]['Aco']['children'][$k2]['Aco']['checked']=0;
}
}
}
$this->set("aco",$controller);
}
$groups = $this->User->Group->find('list');
$this->set(compact('groups'));
}

复制代码

然后修改app\views\users\edit.ctp

<div class="users form">
<?php echo $form->create('User');?>
<fieldset>
<legend><?php __('Edit User');?></legend>
<?php
echo $form->input('id');
echo $form->input('username');
echo $form->input('password');
echo $form->input('group_id');
?>
</fieldset>
<?php
foreach($aco as $v){
echo "<div>";
echo "<div>".$v['Aco']['alias']."</div>";
foreach($v['Aco']['children'] as $vv){
$cc=$vv['Aco']['checked']?" checked ":"";
echo "<div><input name=\"data[aco][]\" type='checkbox'".$cc." value='"."controllers/".$v['Aco']['alias']."/".$vv['Aco']['alias']."'>".$vv['Aco']['alias']."</div>";
}
echo "</div>";
}
?>
<?php echo $form->end('Submit');?>
</div>
<div class="actions">
<ul>
<li><?php echo $html->link(__('Delete', true), array('action' => 'delete', $form->value('User.id')), null, sprintf(__('Are you sure you want to delete # %s?', true), $form->value('User.id'))); ?></li>
<li><?php echo $html->link(__('List Users', true), array('action' => 'index'));?></li>
</ul>
</div>

复制代码

最后我们稍微修改下views\users\index.ctp，我的目的是如果某个用户没有删除修改的权限，则在列表中不显示出链接

<div class="users index">
<h2><?php __('Users');?></h2>
<p>
<?php
echo $paginator->counter(array(
'format' => __('Page %page% of %pages%, showing %current% records out of %count% total, starting on record %start%, ending on %end%', true)
));
?></p>
<table cellpadding="0" cellspacing="0">
<tr>
<th><?php echo $paginator->sort('id');?></th>
<th><?php echo $paginator->sort('username');?></th>
<th><?php echo $paginator->sort('password');?></th>
<th><?php echo $paginator->sort('group_id');?></th>
<th><?php echo $paginator->sort('created');?></th>
<th><?php echo $paginator->sort('modified');?></th>
<th class="actions"><?php __('Actions');?></th>
</tr>
<?php
$i = 0;
foreach ($users as $user):
$class = null;
if ($i++ % 2 == 0) {
$class = ' class="altrow"';
}
?>
<tr<?php echo $class;?>>
<td>
<?php echo $user['User']['id']; ?>
</td>
<td>
<?php echo $user['User']['username']; ?>
</td>
<td>
<?php echo $user['User']['password']; ?>
</td>
<td>
<?php echo $user['User']['group_id']; ?>
</td>
<td>
<?php echo $user['User']['created']; ?>
</td>
<td>
<?php echo $user['User']['modified']; ?>
</td>
<td class="actions">
<?php if($Acl->check(array('model' => 'User', 'foreign_key' => $userinfo['User']['id']), "controllers/Users/view")) echo $html->link(__('View', true), array('action' => 'view', $user['User']['id'])); ?>
<?php if($Acl->check(array('model' => 'User', 'foreign_key' => $userinfo['User']['id']), "controllers/Users/edit")) echo $html->link(__('Edit', true), array('action' => 'edit', $user['User']['id'])); ?>
<?php if($Acl->check(array('model' => 'User', 'foreign_key' => $userinfo['User']['id']), "controllers/Users/delete")) echo $html->link(__('Delete', true), array('action' => 'delete', $user['User']['id']), null, sprintf(__('Are you sure you want to delete # %s?', true), $user['User']['id'])); ?>
</td>
</tr>
<?php endforeach; ?>
</table>
</div>
<div class="paging">
<?php echo $paginator->prev('<< '.__('previous', true), array(), null, array('class'=>'disabled'));?>
| <?php echo $paginator->numbers();?>
<?php echo $paginator->next(__('next', true).' >>', array(), null, array('class' => 'disabled'));?>
</div>
<div class="actions">
<ul>
<li><?php if($Acl->check(array('model' => 'User', 'foreign_key' => $userinfo['User']['id']), "controllers/Users/add")) echo $html->link(__('New User', true), array('action' => 'add')); ?></li>
</ul>
</div>

复制代码

里面很多代码我用的都是默认的，如果大家用的也都是默认的话可以直接复制过去看效果了，相信大家现在可以在后台自由编辑user的权限了，其实group的权限编辑修改原理也是一样的，我就不重复了，有兴趣的朋友可以自己去试试，呵呵，是不是很简单啊？

[ 本帖最后由 sbguh 于 2009-11-11 14:53 编辑 ]