Sub-resource with same privileges as parent resource causes wrong return value of Permission::isAllowed()
- bene
- Member | 82
PHP: 5.4.8
Nette: 2.1.0
// - r1:
// - privileges:
// - p1
// - p2
// - resources:
// - r1:
// - privileges:
// - p1 (x)
// - p2
// Bug
$p = new \Nette\Security\Permission;
$p->addRole('role');
$p->addResource('r1');
$p->addResource('r2', 'r1');
$p->allow('role', 'r1', 'p1');
$p->allow('role', 'r1', 'p2');
$p->allow('role', 'r2', 'p1');
var_dump($p->isAllowed('role', 'r1', 'p1')); // true
var_dump($p->isAllowed('role', 'r1', 'p2')); // true
var_dump($p->isAllowed('role', 'r2', 'p1')); // true
var_dump($p->isAllowed('role', 'r2', 'p2')); // false - Bug: returns true!
// Ok
$p = new \Nette\Security\Permission;
$p->addRole('role');
$p->addResource('r1');
$p->addResource('r2', 'r1');
$p->allow('role', 'r1', 'p1');
$p->allow('role', 'r2', 'p1');
$p->allow('role', 'r2', 'p2');
var_dump($p->isAllowed('role', 'r1', 'p1')); // true
var_dump($p->isAllowed('role', 'r1', 'p2')); // false
var_dump($p->isAllowed('role', 'r2', 'p1')); // true
var_dump($p->isAllowed('role', 'r2', 'p2')); // true
- bene
- Member | 82
This behaviour doesn't have sense to me for following example:
- Car (resource) has drive (privilege).
- Lorry inherit from car and have drive too.
If I allow to role car_driver drive car, this role has access to drive lorry too.
But if this behaviour is feature, OK, we have to write own permission class.
Thx
- bene
- Member | 82
That was only example which shows object and more special object. Our application has forms with privileges “add” and “edit” and more special forms sometimes inherit from more common forms. I don't want to talk about right and wrong design. @enumag wrote example and explained that is feature and I'll take it. One angle of view is different as second. I wrote we have to write own permission class because this behaviour is not for us. I think there is no reason keep this topic opened.
Thanks for comments