php Zend-Permissions-Acl-Acl类(方法)实例源码

/**
  * Checks if the current user has the priviledge to do something.
  *
  * @param string $priviledge
  * @return AccessProhibitedException
  **/
 protected function _checkAcl($priviledge)
 {
     $service = new UserService($this->_em);
     if (!$this->_acl->isAllowed($service->getCurrentRole(), $this, $priviledge)) {
         throw new AccessProhibitedException('Access is prohibited.');
     }
 }

/**
  * @return Acl
  */
 protected function roleAcl()
 {
     if (!$this->roleAcl) {
         $id = $this->objId();
         $this->roleAcl = new Acl();
         $this->roleAcl->addRole(new Role($id));
         $this->roleAcl->addResource(new Resource('admin'));
         $q = '
         select
             `denied`,
             `allowed`,
             `superuser`
         from
             `charcoal_admin_acl_roles`
         where
             ident = :id';
         $db = \Charcoal\App\App::instance()->getContainer()->get('database');
         $sth = $db->prepare($q);
         $sth->bindParam(':id', $id);
         $sth->execute();
         $permissions = $sth->fetch(\PDO::FETCH_ASSOC);
         $this->roleAllowed = explode(',', trim($permissions['allowed']));
         $this->roleDenied = explode(',', trim($permissions['denied']));
         foreach ($this->roleAllowed as $allowed) {
             $this->roleAcl->allow($id, 'admin', $allowed);
         }
         foreach ($this->roleDenied as $denied) {
             $this->roleAcl->deny($id, 'admin', $denied);
         }
     }
     return $this->roleAcl;
 }

private function addAllowAndDeny(Acl $acl)
 {
     foreach ($this->config as $roleName => $roleConfig) {
         $allowList = isset($roleConfig['allow']) ? $roleConfig['allow'] : [];
         foreach ($allowList as $resource => $privilegeList) {
             if (empty($privilegeList)) {
                 $acl->allow($roleName, strtolower($resource));
             } else {
                 foreach ((array) $privilegeList as $privilege) {
                     $acl->allow($roleName, strtolower($resource), strtolower($privilege));
                 }
             }
         }
         $denyList = isset($roleConfig['deny']) ? $roleConfig['deny'] : [];
         foreach ($denyList as $resource => $privilegeList) {
             if (empty($privilegeList)) {
                 $acl->deny($roleName, strtolower($resource));
             } else {
                 foreach ((array) $privilegeList as $privilege) {
                     $acl->deny($roleName, strtolower($resource), strtolower($privilege));
                 }
             }
         }
     }
 }

/**
  * autentica o usuário
  */
 public function autenticaAction()
 {
     if ($this->getRequest()->isPost()) {
         $this->adapter->setOptions(array('object_manager' => Conn::getConn(), 'identity_class' => 'MyClasses\\Entities\\AclUsuario', 'identity_property' => 'login', 'credential_property' => 'senha'));
         $this->adapter->setIdentityValue($this->getRequest()->getPost('login'));
         $this->adapter->setCredentialValue(sha1($this->getRequest()->getPost('senha')));
         $result = $this->auth->authenticate($this->adapter);
         if ($result->isValid()) {
             $equipes = $result->getIdentity()->getEquipes();
             $acl = new Acl();
             $acl->addRole(new Role($equipes[0]->getPerfil()));
             $recursos = $equipes[0]->getRecursos();
             foreach ($recursos as $recurso) {
                 if (!$acl->hasResource($recurso->getRecurso())) {
                     /* echo "add recurso: ".
                        $perfil->getPerfil().", ".
                        $recurso->getRecurso()->getRecurso().", ".
                        $recurso->getPermissao(); */
                     $acl->addResource(new Resource($recurso->getRecurso()));
                     $acl->allow($equipes[0]->getPerfil(), $recurso->getRecurso());
                 }
             }
             $this->auth->getStorage()->write(array($result->getIdentity(), $equipes[0]->getPerfil(), $acl));
             $this->layout()->id = $result->getIdentity()->getId();
             $this->layout()->nome = $result->getIdentity()->getNome();
             return new ViewModel(array('nome' => $result->getIdentity()->getNome()));
         } else {
             return new ViewModel(array('erro' => array_pop($result->getMessages())));
         }
     }
 }

public function __invoke($serviceLocator)
 {
     $config = $serviceLocator->get('config');
     $this->acl = $serviceLocator->get('MultiRoleAclBase\\Service\\MultiRolesAcl');
     if (get_class($this->acl) == 'MultiRoleAclBase\\Service\\MultiRolesAcl' || is_subclass_of($this->acl, 'MultiRoleAclBase\\Service\\MultiRolesAcl')) {
         $this->acl->setAllowAccessWhenResourceUnknown(false);
     }
     $this->roleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RoleBuilder');
     $this->resourceBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\ResourceBuilder');
     $this->ruleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RuleBuilder');
     // Get all Roles from RoleBuilder
     $roles = $this->roleBuilder->buildRoles($this->acl, $serviceLocator);
     if (is_array($roles)) {
         foreach ($roles as $role) {
             $this->acl->addRole($role);
         }
     }
     // Get all Resources from ResourceBuilder
     $resources = $this->resourceBuilder->buildResources($this->acl, $serviceLocator);
     if (is_array($resources)) {
         foreach ($resources as $resource) {
             $this->acl->addResource($resource);
         }
     }
     // Build all the rules
     $this->ruleBuilder->buildRules($this->acl, $serviceLocator);
     return $this->acl;
 }

public function assert(Acl $acl, RoleInterface $role = null, ResourceInterface $resource = null, $privilege = null)
 {
     if (!$resource instanceof User) {
         return false;
     }
     return $acl->isAdminRole($resource->getRole());
 }

/**
  * Check the acl
  *
  * @param string $resource
  * @param string $privilege
  * @return boolean
  */
 public function isAllowed($resource = null, $privilege = null)
 {
     if (null === $this->acl) {
         $this->getAcl();
     }
     return $this->acl->isAllowed($this->getIdentity()->getRoleId(), $resource, $privilege);
 }

/**
  * @param Acl $acl
  * @param $resource
  */
 protected function addAclResource(ZendAcl $acl, AclResource $resource)
 {
     if (!$acl->hasResource($resource->getResource())) {
         $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource->getResource()));
     }
     return $this;
 }

/**
  * Set and get Zend\Permissions\Acl\Acl
  *
  * @see \Contentinum\Service\AclAwareInterface::getAcl()
  * @return Zend\Permissions\Acl\Acl
  */
 public function getAcl($settings)
 {
     if (null === $this->acl) {
         $acl = new Acl();
         // start to set first roles ...
         foreach ($settings['roles'] as $role) {
             $parents = null;
             if (isset($settings['parent'][$role])) {
                 $parents = array($settings['parent'][$role]);
             }
             $acl->addRole($role, $parents);
         }
         $role = null;
         // ... then resoures ...
         foreach ($settings['resources'] as $resource) {
             $acl->addResource($resource);
         }
         // ... and now the rules
         foreach ($settings['rules'] as $access => $rule) {
             foreach ($rule as $role => $restrictions) {
                 foreach ($restrictions as $resource => $restriction) {
                     if ('all' == $restriction) {
                         $acl->{$access}($role, $resource);
                     } else {
                         $acl->{$access}($role, $resource, $restriction);
                     }
                 }
             }
         }
         $this->setAcl($acl);
     }
     return $this->acl;
 }

/**
  * Create the service using the configuration from the modules config-file
  *
  * @param ServiceLocator $services The ServiceLocator
  *
  * @see \Zend\ServiceManager\FactoryInterface::createService()
  * @return Hybrid_Auth
  */
 public function createService(ServiceLocatorInterface $serviceLocator)
 {
     $config = $serviceLocator->get('config');
     $config = $config['acl'];
     if (!isset($config['roles']) || !isset($config['resources'])) {
         throw new \Exception('Invalid ACL Config found');
     }
     $roles = $config['roles'];
     if (!isset($roles[self::DEFAULT_ROLE])) {
         $roles[self::DEFAULT_ROLE] = '';
     }
     $this->admins = $config['admins'];
     if (!isset($this->admins)) {
         throw new \UnexpectedValueException('No admin-user set');
     }
     $acl = new Acl();
     foreach ($roles as $name => $parent) {
         if (!$acl->hasRole($name)) {
             if (empty($parent)) {
                 $parent = array();
             } else {
                 $parent = explode(',', $parent);
             }
             $acl->addRole(new Role($name), $parent);
         }
     }
     foreach ($config['resources'] as $permission => $controllers) {
         foreach ($controllers as $controller => $actions) {
             if ($controller == 'all') {
                 $controller = null;
             } else {
                 if (!$acl->hasResource($controller)) {
                     $acl->addResource(new Resource($controller));
                 }
             }
             foreach ($actions as $action => $role) {
                 if ($action == 'all') {
                     $action = null;
                 }
                 $assert = null;
                 if (is_array($role)) {
                     $assert = $serviceLocator->get($role['assert']);
                     $role = $role['role'];
                 }
                 $role = explode(',', $role);
                 foreach ($role as $roleItem) {
                     if ($permission == 'allow') {
                         $acl->allow($roleItem, $controller, $action, $assert);
                     } elseif ($permission == 'deny') {
                         $acl->deny($roleItem, $controller, $action, $assert);
                     } else {
                         continue;
                     }
                 }
             }
         }
     }
     return $acl;
 }

public function testBuildItemWillAddRulesToAcl()
 {
     $this->assertFalse($this->acl->isAllowed('guest', 'login'));
     $this->assertFalse($this->acl->isAllowed('user', null, 'GET'));
     $this->assertTrue($this->object->buildItem());
     $this->assertTrue($this->acl->isAllowed('guest', 'login'));
     $this->assertTrue($this->acl->isAllowed('user', null, 'GET'));
 }

/**
  * @param \Zend\Permissions\Acl\Resource\ResourceInterface|string $resource
  * @param string $action
  * @return bool
  */
 public function can($resource, $action)
 {
     foreach ($this->roles as $role) {
         if ($this->acl->isAllowed($role, $resource, $action)) {
             return true;
         }
     }
     return false;
 }

public function testBuildCanAcceptXMLAsString()
 {
     $content = file_get_contents(__DIR__ . '/fixtures/test.xml');
     $this->object = new AclBuilder(new StringType($content), $this->acl);
     $this->assertTrue($this->object->build());
     $this->assertTrue($this->acl->hasRole('guest'));
     $this->assertTrue($this->acl->hasResource('logout'));
     $this->assertTrue($this->acl->isAllowed('guest', 'login'));
     $this->assertTrue($this->acl->isAllowed('user', null, 'GET'));
 }

public function getPermissosAclRecursoDesprotegidos(\Zend\Permissions\Acl\Acl $acl, \Doctrine\ORM\EntityManager $em)
 {
     $repo = $em->getRepository('Security\\Entity\\Grupo');
     foreach ($repo->fetchPairs() as $grupo) {
         foreach ($this->getRecursosDesprotegidos() as $recurso) {
             $acl->allow($grupo, $recurso);
         }
     }
     return $acl;
 }

public function testIsAuthorizedNegative()
 {
     $acl = new Acl();
     $acl->addRole('administrator');
     $acl->addRole('foo', 'administrator');
     $acl->addRole('bar');
     $access = new AclInheritRoleAccess();
     $access->setAcl($acl);
     $access->setUser('bar');
     $this->assertFalse($access->isAuthorized());
 }

public function __construct()
 {
     // 添加初始化事件函数
     $eventManager = $this->getEventManager();
     $serviceLocator = $this->getServiceLocator();
     $eventManager->attach(MvcEvent::EVENT_DISPATCH, function ($event) use($eventManager, $serviceLocator) {
         // 权限控制
         $namespace = $this->params('__NAMESPACE__');
         $controller = $this->params('controller');
         $action = $this->params('action');
         if ($namespace == 'Idatabase\\Controller' && php_sapi_name() !== 'cli') {
             // 身份验证不通过的情况下，执行以下操作
             if (!isset($_SESSION['account'])) {
                 $event->stopPropagation(true);
                 $event->setViewModel($this->msg(false, '未通过身份验证'));
             }
             // 授权登录后，检查是否有权限访问指定资源
             $role = isset($_SESSION['account']['role']) ? $_SESSION['account']['role'] : false;
             $resources = isset($_SESSION['account']['resources']) ? $_SESSION['account']['resources'] : array();
             $action = $this->getMethodFromAction($action);
             $currentResource = $controller . 'Controller\\' . $action;
             if ($role && $role !== 'root') {
                 $acl = new Acl();
                 $acl->addRole(new Role($role));
                 foreach ($resources as $resource) {
                     $acl->addResource(new Resource($resource));
                     $acl->allow($role, $resource);
                 }
                 $isAllowed = false;
                 try {
                     if ($acl->isAllowed($role, $currentResource) === true) {
                         $isAllowed = true;
                     }
                 } catch (InvalidArgumentException $e) {
                 }
                 if (!$isAllowed) {
                     $event->stopPropagation(true);
                     $event->setViewModel($this->deny());
                 }
             }
         }
         $this->preDispatch();
         if (method_exists($this, 'init')) {
             try {
                 $this->init();
             } catch (\Exception $e) {
                 $event->stopPropagation(true);
                 $event->setViewModel($this->deny($e->getMessage()));
             }
         }
     }, 200);
 }

private function _load()
 {
     if ($this->loaded == false) {
         // Add roles
         $config = $this->serviceLocator->get('config');
         if (isset($config['acl']['role_providers'])) {
             $roles = [];
             foreach ($config['acl']['role_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Role\ProviderInterface $roleProvider */
                 $roleProvider = $this->serviceLocator->get($class);
                 $roles = $roles + $roleProvider->getRoles();
             }
             foreach ($roles as $role) {
                 /** @var \Acl\Entity\Role $role */
                 $this->acl->addRole($role, $role->getParents());
             }
         }
         // Add resources
         if (isset($config['acl']['resource_providers'])) {
             foreach ($config['acl']['resource_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Resource\ProviderInterface $resourceProvider */
                 $resourceProvider = $this->serviceLocator->get($class);
                 $resources = $resourceProvider->getResources();
                 if ($resources) {
                     foreach ($resources as $r) {
                         if (!$this->acl->hasResource($r)) {
                             $this->acl->addResource($r);
                         }
                     }
                 }
             }
         }
         // Add rules
         if (isset($config['acl']['rule_providers'])) {
             $rules = [];
             foreach ($config['acl']['rule_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Rule\ProviderInterface $ruleProvider */
                 $ruleProvider = $this->serviceLocator->get($class);
                 $rules = $rules + $ruleProvider->getRules();
             }
             foreach ($rules as $rule) {
                 /** @var \Acl\Entity\Rule $rule */
                 if ($rule->allow) {
                     $this->acl->allow($rule->obj_id, $rule->resource, $rule->privilege);
                 } else {
                     $this->acl->deny($rule->obj_id, $rule->resource, $rule->privilege);
                 }
             }
         }
         $this->loaded = true;
     }
 }

public function getAcl()
 {
     if (!$this->acl) {
         $acl = new Acl();
         $roleGuest = new Role('guest');
         $acl->addRole($roleGuest);
         $acl->addRole(new Role('admin'), $roleGuest);
         $acl->allow($roleGuest, null, 'view');
         $acl->allow('admin', null, array('add', 'edit', 'delete'));
         $this->acl = $acl;
     }
     return $this->acl;
 }

public function onInit(MvcEvent $e)
 {
     $routerMatch = $e->getRouteMatch();
     $arrayController = explode("\\", $routerMatch->getParam("controller"));
     $module = strtolower($arrayController[0]);
     $viewModel = $e->getViewModel();
     $this->_mainParam['module'] = strtolower($arrayController[0]);
     $this->_mainParam['controller'] = strtolower($arrayController[2]);
     $this->_mainParam['action'] = strtolower($routerMatch->getParam("action"));
     //truyền ra cho layout
     $viewModel->params = array("module" => strtolower($arrayController[0]), "controller" => strtolower($arrayController[2]), "action" => strtolower($routerMatch->getParam("action")));
     $config = $this->getServiceLocator()->get("config");
     $layout = $config["module_for_layouts"][strtolower($arrayController[0])];
     //set layout
     $this->layout($layout);
     $infoObj = new \ZendVN\System\Info();
     //KIEM TRA USER AuTH
     if ($this->_mainParam['module'] == 'admin') {
         //chưa đăng nhập
         if (!$this->identity()) {
             return $this->redirect()->toRoute('homeShop');
         } else {
             //đăng nhập rồi mà không có quyền vào
             $group_acp = $infoObj->getGroupInfo('group_acp');
             if ($group_acp != 1) {
                 return $this->redirect()->toRoute('homeShop');
             } else {
                 // KIEM TRA PERMISSION
                 $aclObj = new Acl();
                 $role = $infoObj->getPermissionInfo()['role'];
                 $privilegesOfRole = $infoObj->getPermissionInfo()['privileges'];
                 $aclObj->addRole($role);
                 $aclObj->allow($role, null, $privilegesOfRole);
                 $privilegesOfArea = $this->_mainParam['module'] . "|" . $this->_mainParam['controller'] . "|" . $this->_mainParam['action'];
                 if ($aclObj->isAllowed($role, null, $privilegesOfArea) == false) {
                     return $this->goNoAccess();
                 }
             }
         }
     }
     //kiem tra controller user khong đăng nhập thi không được vào
     if ($this->_mainParam['controller'] == 'user' && $this->_mainParam['module'] == 'shop') {
         //chưa đăng nhập
         if (!$this->identity()) {
             return $this->redirect()->toRoute('homeShop');
         }
     }
     // ------------------------------------------------------------
     //func Init() giúp cho các controller extends có thể override onInit()
     $this->init();
 }

public function initAcl(MvcEvent $e)
 {
     //Creamos el objeto ACL
     $acl = new Acl();
     //Incluimos la lista de roles y permisos, nos devuelve un array
     $roles = (require 'config/autoload/acl.roles.php');
     foreach ($roles as $role => $resources) {
         //Indicamos que el rol será genérico
         $role = new \Zend\Permissions\Acl\Role\GenericRole($role);
         //Añadimos el rol al ACL
         $acl->addRole($role);
         //Recorremos los recursos o rutas permitidas
         foreach ($resources["allow"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Permitimos a ese rol ese recurso
             $acl->allow($role, $resource);
         }
         foreach ($resources["deny"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Denegamos a ese rol ese recurso
             $acl->deny($role, $resource);
         }
     }
     //Establecemos la lista de control de acceso
     $e->getViewModel()->acl = $acl;
 }