Access Control with Slim/PHP/Twig - php

I have a website based on Slim, Twig, PHP, SQL Server, which is running on an II.
I want to achieve some kind of GUI for an Administrator, where he can simply allow/disallow users to view specific parts (routes) of the website.
I can give a name to a route.
$Slim->map(['GET', 'POST'], '/route', function(){
//
})->setName('route_name');
also i can get all names from the routes like this
$allRoutes = $this->router->getRoutes();
foreach ($allRoutes as $key => $value) {
$target[$value->getPattern()] = [
'methods' => json_encode($value->getMethods()),
'middlewares' => json_encode($value->getMiddleware()),
'pattern' => $value->getPattern(),
'name' => $value->getName(),
];
}
and i can use the name in twig like this
link
I also can give a Slim route a middleware, which is called every call of the route.
My plan is to put the route names into a table, and specify which user is allowed to open which route.
Questions:
Is there any way to uniquely identify a route name? Because relying on a string (route name), which could easily be changed by the developer without getting notified to the website admin seems to be not the best idea.
Is there any way to somehow convince the twig template not to insert the -tag in the final html (which is served to the user), based on if the user is allowed (by the middleware) to open the route?

Actually there is a way to somewhat prevent name-mismatches between the route-names(strings) used in templates and in PHP/by the router.
Use PHP constants for route names.
This will further enable auto-completion in IDEs and give you a central location for your route-names.
A misnamed\non-existant route(-constant) will trigger an exception for both - PHP code and the template - instead of only during rendering of the template. This is the main benefit of using this method.
An interface can be used to store all your route-name constants.
Then use these constants with twig's constant function.
PHP interface
namespace Routing;
interface RouteName
{
public const HOMEPAGE = 'home';
// ... more routes
}
usage in PHP/Slim
use Routing\RouteName;
$Slim->map(['GET'], '/', function(){
// [..]
})->setName(RouteName::HOMEPAGE);
usage in Twig template
{{ path_for(constant('Routing\\RouteName::HOMEPAGE')) }}

Related

Dealing with Views in Phalcon Controllers

I am working on a newly created Phalcon project, and I don't really know how to actually use multiples views.
What is the entry point? I don't really know when each method in the controller is called, under which conditions, etc.
Where is the control flow defined? is it based in the name of the view? or is there a place where you can register them?
Phalcon is a bit different than other well-known PHP frameworks, in that not much is pre-configured or pre-built by default. It's quite loosely-coupled. So you have to decide where and how your control flow will work. This means that you will need to dig deeper in the documentation and also that there could be different way to achieve the same thing.
I'm going to walk you through a simple example and provide references, so you can understand it more.
1) You would start by defining a bootstrap file (or files) that will define the routes, or entry points, and will setup and create the application. This bootstrap file could be called by an index.php file that is the default file served by the web server. Here is an example of how such bootstrap file will define the routes or entry points (note: these are just fragments and do not represent all the things that a bootstrap file should do):
use Phalcon\Di\FactoryDefault;
// initializes the dependency injector of Phalcon framework
$injector = new FactoryDefault();
// defines the routes
$injector->setShared('router', function () {
return require_once('some/path/routes.php');
});
Then it the routes.php file:
use Phalcon\Mvc\Router;
use Phalcon\Mvc\Router\Group as RouterGroup;
// instantiates the router
$router = new Router(false);
// defines routes for the 'users' controller
$user_routes = new RouterGroup(['controller' => 'users']);
$user_routes->setPrefix('/users');
$user_routes->addGet('/show/{id:[0-9]{1,9}}', ['action' => 'show']);
$router->mount($user_routes);
return $router;
Im defining routes in an alternate way, by defining routes groups. I find it to be more easy to organize routes by resource or controller.
2) When you enter the url example.com/users/show/123, the routes above will match this to the controller users and action show. This is specified by the chunks of code ['controller' => 'users'], setPrefix('/users') and '/show/{id:[0-9]{1,9}}', ['action' => 'show']
3) So now you create the controller. You create a file in, let's say, controllers/UsersController.php. And then you create its action; note the name that you used in the route (show) and the suffix of Action:
public function showAction(int $id) {
// ... do all you need to do...
// fetch data
$user = UserModel::findFirst(blah blah);
// pass data to view
$this->view->setVar('user', $user);
// Phalcon automatically calls the view; from the manual:
/*
Phalcon automatically passes the execution to the view component as soon as a particular
controller has completed its cycle. The view component will look in the views folder for
a folder named as the same name of the last controller executed and then for a file named
as the last action executed.
*/
// but in case you would need to specify a different one
$this->view->render('users', 'another_view');
}
There is much more stuff related to views; consult the manual.
Note that you will need to register such controller in the bootstrap file like (Im also including examples on how to register other things):
use Phalcon\Loader;
// registers namespaces and other classes
$loader = new Loader();
$loader->registerNamespaces([
'MyNameSpace\Controllers' => 'path/controllers/',
'MyNameSpace\Models' => 'path/models/',
'MyNameSpace\Views' => 'path/views/'
]);
$loader->register();
4) You will also need to register a few things for the views. In the bootstrap file
use Phalcon\Mvc\View;
$injector->setShared('view', function () {
$view = new View();
$view->setViewsDir('path/views/');
return $view;
});
And this, together with other things you will need to do, particularly in the bootstrap process, will get you started in sending requests to the controller and action/view defined in the routes.
Those were basic examples. There is much more that you will need to learn, because I only gave you a few pieces to get you started. So here are some links that can explain more. Remember, there are several different ways to achieve the same thing in Phalcon.
Bootstrapping:
https://docs.phalconphp.com/en/3.2/di
https://docs.phalconphp.com/en/3.2/loader
https://docs.phalconphp.com/en/3.2/dispatcher
Routing: https://docs.phalconphp.com/en/3.2/routing
Controllers: https://docs.phalconphp.com/en/3.2/controllers
More on Views (from registering to passing data to them, to templating and more): https://docs.phalconphp.com/en/3.2/views
And a simple tutorial to teach you some basic things: https://docs.phalconphp.com/en/3.2/tutorial-rest
The application begins with the routing stage. From there you grab the controller and action from the router, and feed it to the dispatcher. You set the view then call the execute the dispatcher so it access your controller's action. From there you create a new response object and set its contents equal to the view requests, and finally send the response to the client's browser -- both the content and the headers. It's a good idea to do this through Phalcon rather than echoing directly or using PHP's header(), so it's only done at the moment you call $response->send(); This is best practice because it allows you to create tests, such as in phpunit, so you can test for the existence of headers, or content, while moving off to the next response and header without actually sending anything so you can test stuff. Same idea with exit; in code, is best to avoid so you can write tests and move on to the next test without your tests aborting on the first test due to the existence of exit.
As far as how the Phalcon application works, and in what steps, it's much easier to follow the flow by looking at manual bootstrapping:
https://docs.phalconphp.com/en/3.2/application#manual-bootstrapping
At the heart of Phalcon is the DI, the Dependency Injection container. This allows you to create services, and store them on the DI so services can access each other. You can create your own services and store them under your own name on the DI, there's nothing special about the names used. However depending on the areas of Phalcon you used, certain services on the DI are assumed like "db" for interacting with your database. Note services can be set as either shared or not shared on the DI. Shared means it implements singleton and keeps the object alive for all calls afterwards. If you use getShared, it does a similar thing even if it wasn't initially a shared service. The getShared method is considered bad practice and the Phalcon team is talking about removing the method in future Phalcon versions. Please rely on setShared instead.
Regarding multiple views, you can start with $this->view->disable(); from within the controller. This allows you to disable a view so you don't get any content generated to begin with from within a controller so you can follow how views work from within controllers.
Phalcon assumes every controller has a matching view under /someController/someView followed by whatever extension you registered on the view, which defaults to .volt but can also be set to use .phtml or .php.
These two correspond to:
Phalcon\Mvc\View\Engine\Php and Phalcon\Mvc\View\Engine\Volt
Note that you DON'T specify the extension when looking for a template to render, Phalcon adds this for you
Phalcon also uses a root view template index.volt, if it exists, for all interactions with the view so you can use things like the same doctype for all responses, making your life easier.
Phalcon also offers you partials, so from within a view you can render a partial like breadcrumbs, or a header or footer which you'd otherwise be copy-pasting into each template. This allows you to manage all pages from the same template so you're not repeating yourself.
As far as which view class you use within Phalcon, there's two main choices:
Phalcon\Mvc\View and Phalcon\Mvc\View\Simple
While similar, Phalcon\Mvc\View gives you a multiple level hierarchy as described before with a main template, and a controller-action based template as well as some other fancy features. As far as Phalcon\Mvc\View\Simple, it's much more lightweight and is a single level.
You should be familiar with hierarchical rendering:
https://docs.phalconphp.com/en/3.2/views#hierarchical-rendering
The idea is with Phalcon\Mvc\View that you have a Main Layout (if this template exists) usually stored in /views/index.volt, which is used on every page so you can toss in your doctypes, the title (which you would set with a variable the view passed in), etc. You'd have a Controller Layout, which would be stored under /views/layouts.myController.volt and used for every action within a controller (if this template exists), finally you'd have the Action Layout which is used for the specific action of the controller in /views/myController/myAction.volt.
There are all types of ways you can break from Phalcon's default behavior. You can do the earlier stated $this->view->disable(); so you can do everything manually yourself so Phalcon doesn't assume anything about the view template. You can also use ->pick to pick which template to use if it's going to be different than the controller and action it's ran in.
You can also return a response object from within a controller and Phalcon will not try to render the templates and use the response object instead.
For example you might want to do:
return $this->response->redirect('index/index');
This would redirect the user's browser to said page. You could also do a forward instead which would be used internally within Phalcon to access a different controller and/or action.
You can config the directory the views are stored with setViewsDir. You can also do this from within the controller itself, or even within the view as late as you want, if you have some exceptions due to a goofy directory structure.
You can do things like use $this->view->setTemplateBefore('common') or $this->view->setTemplateAfter('common'); so you can have intermediate templates.
At the heart of the view hierarchy is <?php echo $this->getContent(); ?> or {{ content() }} if you're using Volt. Even if you're using Volt, it gets parsed by Phalcon and generates the PHP version with $this->getContent(), storing it in your /cache/ directory, before it is executed.
The idea with "template before" is that it's optional if you need another layer of hierarchy between your main template and your controller template. Same idea with "template after" etc. I would advise against using template before and after as they are confusing and partials are better suited for the task.
It all depends on how you want to organize your application structure.
Note you can also swap between your main template to another main template if you need to swap anything major. You could also just toss in an "if" statement into your main template to decide what to do based on some condition, etc.
With all that said, you should be able to read the documentation and make better sense of how to utilize it:
https://docs.phalconphp.com/en/3.2/api/Phalcon_Mvc_View

Laravel 5 redirect to path with parameters (not route name)

I've been reading everywhere but couldn't find a way to redirect and include parameters in the redirection.
This method is for flash messages only so I can't use this.
return redirect('user/login')->with('message', 'Login Failed');
This method is only for routes with aliases my routes.php doesn't currently use an alias.
return redirect()->route('profile', [1]);
Question 1
Is there a way to use the path without defining the route aliases?
return redirect('schools/edit', compact($id));
When I use this approach I get this error
InvalidArgumentException with message 'The HTTP status code "0" is not valid.'
I have this under my routes:
Route::get('schools/edit/{id}', 'SchoolController#edit');
Edit
Based on the documentation the 2nd parameter is used for http status code which is why I'm getting the error above. I thought it worked like the URL facade wherein URL::to('schools/edit', [$school->id]) works fine.
Question 2
What is the best way to approach this (without using route aliases)? Should I redirect to Controller action instead? Personally I don't like this approach seems too long for me.
I also don't like using aliases because I've already used paths in my entire application and I'm concerned it might affect the existing paths if I add an alias? No?
redirect("schools/edit/$id");
or (if you prefer)
redirect("schools/edit/{$id}");
Just build the path needed.
'Naming' routes isn't going to change any URI's. It will allow you to internally reference a route via its name as opposed to having to use paths everywhere.
Did you watch the class Illuminate\Routing\Redirector?
You can use:
public function route($route, $parameters = [], $status = 302, $headers = [])
It depends on the route you created. If you create in your app\Http\Routes.php like this:
get('schools/edit/{id}', 'SchoolController#edit');
then you can create the route by:
redirect()->action('SchoolController#edit', compact('id'));
If you want to use the route() method you need to name your route:
get('schools/edit/{id}', ['as' => 'schools.edit', 'uses' => 'SchoolController#edit']);
// based on CRUD it would be:
get('schools/{id}/edit', ['as' => 'schools.edit', 'uses' => 'SchoolController#edit']);
This is pretty basic.
PS. If your schools controller is a resource (CRUD) based you can create a resource() and it will create the basic routes:
Route::resource('schools', 'SchoolController');
// or
$router->resource('schools', 'SchoolController');
PS. Don't forget to watch in artisan the routes you created

cakephp 3 prefix routing

I'm trying to set up a routing prefix in cakephp 3 so any URLs starting with /json/ get the prefix key set and I can change the layout accordingly in the app controller. Other than that, they should use the usual controller and action. I have added the following to routes.php
$routes->prefix('json', function($routes) {
$routes->connect(
'/:controller/:action/*',
[],
['routeClass' => 'InflectedRoute']
);
});
I want to direct all requests with json as first url segment to controller specified in second url segment. e.g. /json/users/add_account_type/ goes to users controller. However when accessing this URL I get the message:
Error: Create the class UsersController below in file:
src/Controller/Json/UsersController.php
whereas I want it to be using
src/Controller/UsersController.php
I think this should be possible but I can't quite see what I'm doing wrong when consulting the book. Have partly based my code on: CakePHP3.x controller name in url when using prefix routing
Thanks a lot in advance
That's simply how prefix routing now works in 3.x, as explained in the docs, prefixes are being mapped to subnamespaces, and thus to separate controllers in subfolders.
http://book.cakephp.org/3.0/en/development/routing.html#prefix-routing
If you'd wanted to change that behavior (I don't really see why), one way would be to implement a custom ControllerFactory dispatcher filter.
http://book.cakephp.org/3.0/en/development/dispatch-filters.html
On a side note, the RequestHandler component supports layout/template switching out of the box, so maybe you should give that a try.
http://book.cakephp.org/3.0/en/controllers/components/request-handling.html
http://book.cakephp.org/3.0/en/views/json-and-xml-views.html
Prefix routing is a way of namespacing parts of your routes to a dedicated controller. It seem that what you want is a scope and not a prefix, for what you describe:
Router::scope('/json', function($routes) {
$routes->fallbacks('InfledtedRoute')
});

Dynamic Routing in cakephp issue

I want to use Dynamic Routing for the static pages of my site.
I have used the following code in my Routes file
$arr = ClassRegistry::init('Page');
and
$this->loadModel('Page');
$arr = $this->Page->find('all');
foreach($arr as $value)
{
//my code
}
But it doesn't work, and shows an error like below:
ClassRegistry is not defined
Don't do that
you've tried to put controller code in your routes file and are intending to make your site so needlessly dependent on the database. Of course, your whole site is likely dependent on the database, but by making your routes db-dependent all requests that make it to cakephp (which means, all requests that are not a static file in the webroot) need to talk to the db at least slowing things down, and if anything goes wrong with the db, your site is white page of fatal error awesomeness for all requests. This is because the routes file is loaded very early in the request handling process. The routes file is not supposed to contain any real logic - just Router::connect statements.
Alternative: Use a catchall route
If you have any pattern that you can use for your static pages, use it so that you have only one route definition. i.e.:
Router::connect('/x/*', array('controller' => 'some', 'action' => 'thing')); //eerily similar to the default static pages route
Alternative: Write a static routes file
Build, however you like, your routes logic whenever the rules for your routes change and write them to a static file. Therefore your routes.php file becomes:
<?php
... routes that don't change ...
require 'path/to/dynamic_routes_file.php';
You can use the afterSave handler for a relevant model to trigger rebuilding this dynamic routes file.
More alternatives
There are many other ways to handle this kind of thing e.g. override the error handling process to first check if there's one of these db-dependent routes to process - Or simply create a custom route class which implements literally whatever you want.
Whatever you do though - aim for the logic at run time to be as simple/cached/static as possible - don't build a system which makes all requests need to talk to the db all the time.

ZEND - Conflicting route patterns

I'm using Zend framework 1.12, trying to come up with custom routes.
I'm trying to create something that looks like facebook's profile URL (http://facebook.com/username). So, at first I tried something like that:
$router->addRoute(
'eventName',
new Zend_Controller_Router_Route(
'/:eventName',
array(
'module' => 'default',
'controller' => 'event',
'action' => 'detail'
)
)
);
I kept getting the following error anytime I tried running mydomain.com/something:
Fatal error: Uncaught exception 'Zend_Controller_Router_Exception'
with message 'eventName is not specified' in
/var/desenvolvimento/padroes/zf/ZendFramework-1.12.0/library/Zend/Controller/Plugin/Broker.php
on line 336
Not only I was unable to make that piece of code work, all my default routes were (obviously) overwritten. So I have, for example, stuff like "mydomain.com/admin" that should send me to the "admin" module, on the Index controller, but was now returning the same error (as it fell in the same pattern as /:eventName).
What I need to do is to create this custom route, without overwriting the default ones and actually working (dûh).
I have already checked the online docs and a lot (A LOT) of stuff on google, but I didn't find anything related to the error I'm getting or how to not overwrite the default routes. I'd appreciate anything that could point me the right direction.
Thanks.
EDIT¹:
I managed to get it working, but I didn't use any routing at all. I just made a plugin with the following:
public function preDispatch(\Zend_Controller_Request_Abstract $request) {
if (!\Zend_Controller_Front::getInstance()->getDispatcher()->isDispatchable($request)) {
$request->setModuleName($this->_eventRouter["module"]);
$request->setControllerName($this->_eventRouter["controller"]);
$request->setActionName($this->_eventRouter["action"]);
}
}
It feels like an ugly workaround, though... As Tim Fountain pointed out, my events are dynamic (I load them from a database), so I can't hardcode it. Also, my current implementation prevents me from having to hardcode every module/controller/action combination.
I'd just like to know if there's a way to avoid using a plugin.
EDIT²: I'm not doing that crappy plugin thing anymore. I figured out what was causing the router error. My routing definition did not have a valid default value for variable 'eventName'. My fix was:
$router->addRoute(
'eventName',
new Zend_Controller_Router_Route(
'/:eventName',
array(
'module' => 'default',
'controller' => 'event',
'action' => 'detail',
'eventName' => ''
)
)
);
I am still unable to create routes with "conflicting" patterns, such as /admin and /:eventName. If only there was a way to make /admin override /:eventName...
Routes are applied/matched on a LIFO basis. As the routing docs note:
Note: Reverse Matching
Routes are matched in reverse order so make sure your most generic routes are defined first.
So, in order to have your "static" routes (static, in the sense that they do not pull from the db, /admin and the like) apply over your dynamic ones (/:eventName), make sure you define the static ones later in the execution flow.
In practical terms, this means that you cannot define your static routes during bootstrap, so you'll have to do it in a plugin with a routeStartup hook. Perhaps, two plugins: one for your dynamic routes, then another for the static ones, just make sure that the priority on the plugins is set so that the static ones are added later.
The error you are getting is probably coming from a URL helper call you have in your template. You need to specify the eventName param to this since you've made it required, e.g.:
Something
The answer to your other question depends a bit on whether you have a static, unchanging list of events or non-event URLs. You need to give the router a way to determine whether /foo is an event, or a controller. You do this by either hardcoding the possible events in to your event route, hardcoding routes for your other non-event URLs, or (if your events are dynamic and based on some database content) writing a custom route class for your event route which can do a lookup to see whether a given string is an event.
Since you are using Zend Framework 1.x
Here is the solution which I have added here : How to redirect Error Page and perform Routes in Zend Framework 1.x
Also, to make life easier... here it is:
I am still unable to create routes with "conflicting" patterns, such as /admin and /:eventName. If only there was a way to make /admin override /:eventName...
Once you are on the action which calls your eventName, you can put a check if that == admin, later you can define a re-route by specifying which action needs to be loaded, in that condition itself.
Simple? :)
define the eventName, and even if it's not required, just leave it blank.

Categories