I have build an e-commerce website with CakePHP Framework.
Now, i need to implement administration log-in, and orders/users management...
The big question is: Should i create a new App (a new CakePHP app folder), or use the existing one?
Using the same folder, would make me spend less time copying models, but, would considerably decrease 'security', because i would need to create methods for admin, and user...
Using separately framework, with almost the same models, would help me with the views... i would use another page template, and the log-in system would be different from the normal website.
So, what is the "best" solution for this case?
Thanks
Build the admin in the same app. It doesn't decrease security. You can easily control which controller methods are accessible by admin users with Prefix Routing. You can also change the view layout based on the route prefix. If you need something more fine-grained, Cake supports Access Control Lists for complex permissions systems.
In the end, your app will be much more maintainable if you are using a single set of models and controllers.
Here's a little code snippet I use in app_controller.php. This is from an app built in CakePHP 1.2, so it may need to be updated slightly for newer versions. This assumes that any registered user has access to the admin URLs, but that could easily be changed:
function beforeFilter(){
if (isset($this->params['prefix']) && $this->params['prefix'] == 'admin') {
if (!$this->Session->check('User')) {
// save the url in the session so that you can redirect there after login
$this->Session->write('lastPageVisited', $this->params['url']['url']);
$this->redirect('/users/login/');
exit();
}
// set the admin layout
$this->layout = 'admin';
}
}
Related
I have a project which includes admin and user section. Both section use the same controllers, just different functions and templates (ex: viewAdmin() and viewUser()). In function beforeRender() of every controllers, I set variable $admin as true for admin functions and false for user functions.
For authentication, I use Shibboleth. Shibboleth uses data from LDAP, while user types were saved in SQL-Database, that means while it can check if the login and password are false, it can't check if the user is admin or not. An user can go to ADMIN section as long as they use the right action (ex: go to the link http://example.com/tool/viewAdmin).
To prevent this, I will have to:
Load model Users
Compare the environment variable uid (login name) with the "login" columns in Users table in my SQL-Database
See the "type" column in Users table to know if user is admin or not.
Compare the result with value of $admin and redirect to an error page when necessary.
The problem is: I don't want to repeat those steps for EVERY controllers.
Currently I have 2 ideas:
Write a function in UsersController, and use it in every controllers.
Create a component and load it in every controllers.
Both methods require me changing code in all controllers. I would like to hear a better way with less work, perhaps by changing app.php or bootstrap.php.
Any suggestion is appreciated.
To share methods in CakePHP controllers you can do:
Create component and include in controller
Or create method in AppController and use it in child controllers
Or PHP way create Trait.
But when you authorize users, then all user data is stored in session, incl. is user roles (example admin, regular, member,.. )
Use the official CakePHP authentication plugin and extend the LDAP adapter with the additional code check you need. This is very easy to do and also a very clean way of solving the problem. Disclaimer: I'm one of the authors of the authentication plugin. https://github.com/cakephp/authentication
Or if you want to stay agnostic to any framework, use my library that is based on the authentication plugin and was decoupled from any framework but still works just nice with Cake https://github.com/Phauthentic/authentication.
I am using this version of codeigniter 2.1.4 and I want to add user roles and permission. I am totally new for this framework I have done this in Zend but I am not able to find any library in codeigniter. I am also confused with Hooks.
Anybody will explain me what the purpose of hooks in a layman language. and also about the library with a small example with the same version so that it will be easy to understand.
Thanks.
Since you already have experience with the Zend ACL, why not use it in your CodeIgniter project? (Link)
Just set up your roles, resources, and permissions in your "MY_Controller.php" file so they're available to all your controllers. Also set up your user in MY_Controller (e.g. $this->theUser) for the same reason.
Set up classes for your resources in your Libraries folder that "implements Zend_Acl_Resource_Interface" and a "User" class for your user that "implements Zend_Acl_Role_Interface".
After setting up the ACL in MY_Controller, retrieve role(s) for the user from your database and add them to your user:
$roles = $this->theUser->getRoles(); // get the assigned role(s) for the user (array)
$acl->addRole($this->theUser, $roles); // then apply them to the user
With that done, I typically put something like the following at the top of each controller:
if ( !$this->acl->isAllowed($this->theUser, 'article', 'modify') ) {
redirect( '/home', 'refresh' ); // go back home
exit;
}
Don't forget, you can even set up dynamic assertions (i.e. implements Zend_Acl_Assert_Interface) if a permission to a resource requires some logic. I typically put assertion classes immediately following their related resource class.
Use Ion_Auth, it is an authentication library with a system of user roles. Should be easier for you to create permissions in your code.
This is only my 2-cents but Hooks are somehow similar to an event-driven approach. This means that they will be triggered at particular times in your code.
In the documentation, you can see that CI has 7 hooks ready. Thus, you can inject any script of yours at those 7 moments.
Let's say that you can add a script during the hook pre_controller that checks for the user's browser's language, so that in all your controllers you already know the language to use.
Note that ion_auth also supports hooks.
I am trying to create a login system thats generic so that it can be adapted for use in various apps. I decided that 2 main "parts" of the system will be User Meta Data & Roles/Resources/ACL.
1. Metadata
I thought of keeping most data like what meta data are available for users in the database, so that admins can manage them using some GUI.
Problem is how can I then configue how I want inputs to render (textbox, checkbox, radios etc.). Then another problem is validation, filters.
2. ACL
I think for simple ACL it will work fine. But suppose I want say users to be able to modify posts they own. In Zend_ACL that is accomplished with Assertions. I thought that will make a "simple" login system overlly complex? Also it will be hard to build I suppose?
Currently I have my database like
Logging in users: I recommend using a separate controller (call it Auth for instance) that has loginAction and logoutAction. Zend_Auth (Zend_Auth using database) will check the database for the right credentials. Once the user is verified, you will save it in the global accessible place(the Zend_Auth class has methods to do this). This is also a good moment to query which roles the user has and store them.
Metadata part of your application: I'm not sure what the question is exactly but I assume you want to store dynamic information about user and have a GUI for admins to manage this. Why you would render different types of controls? Validating the information can be done by defining a lot of the most common metadata (like Twitter) and create rules for them. In the save action for the metadata you would validate using these rules.
ACL: Resources rarely change, you are better off putting them in a configuration file (for speed). You should give a lot thought to resources: what are they exactly to you? Controllers? Modules? Create a plugin that will preDispatch every request checking the role of the logged in user against the requested resource. E.g.:
$action = $request->getActionName();
$controller = $request->getControllerName();
// role, resource, privilage
if (!$acl->isAllowed($user->role, $controller, $action) {
//go to access denied page!
}
Now that Zend_ACL is used for the global access rules, you are better off checking for specific access inside the action itself (like if ($loggedInUser == $article->author) {//edit the article};).
Also don't forget Zend_ACL can be integrated with Zend_Navigation to hide menu items users are not allowed to use (and more).
I have built an app using codeigniter which has 3 different member groups
Admininstrators - Who login to a dashboard and have CRUD facilities to Add/Edit/Delete Events, shows and artists
Clients - Who Login from the front end and see all the items that the admin have added via the back end.
Media Partners - Who Login from the front-end and see certain parts of what the client can see but not all things.
I have integrated the Tank_Auth Library for the Clients section which all works fine. What I would like to achieve though is for the administrator to be able to login to a seperate admin area and the media partners to be able to login to a seperate area too.
What is the best way to approach this?
Do I need to create sepearate dashboard controllers for each userbase and duplicate the Tank_Auth controller 3 times and tweak this?
Ideally The Admin users also need to be able to add news users and login to all 3 seperate areas?
Has anybody achieved such a solution before, If so how did you go about it? perhaps tank auth isn't the correct approach?
Any input would be appreciated.
Thanks Dan
I am using CI, but haven't used Tank_Auth, I have my auth class and in every function I have the following method called: $this->auth->accessMap(get_class($this),__FUNCTION__);
In auth class:
public function accessMap($controller_name,$function_name)
{
if ($this->perms_array[$controller_name][$function_name])
return true;
else $this->redir();
}
I have permissions array in config:
$config['user_perms']['className']['method1'] = array($config['user_types']['admin']);
$config['user_perms']['className']['method2'] = array($config['user_types']['admin'],$config['user_types']['user']);
Like this you can specify for each method which user has permission to use it.
I hope this will help.
I can't find the thread on the CI forums because I can't seem to login to their website right now, however do a search for 'zend_acl in codeigniter'. Alternatively there is this blog post about how to implement it, but it is slightly dated.
ACL stands for Access Control List, it will allow you to setup various permissions for different types of users. Zend has one of the best implementations of ACL in my opinion.
More information about ACL's can be found on zend's website.
Absence of user group is a pain when using tank_auth if we have multiple user groups. I ran into this issue recently. Here is the solution posted in CI forms.
Using tank_auth for both front end user registration and login and back end admin login
I'm having a hard time understanding how the CakePHP admin system works.
Should all controllers who has an action which requires login include AuthComponent or just the one who handles the login/logout?
Let's say I want to protect the add action of a controller. First I create admin_add() in the controller and then in the beforeFilter() method I check if $this->Session->check('Auth.User') is set a redirect based on this? Turns out it was better to just controll this with $this->Auth->allow()
What is the easiest way to return to the URL the user was trying to access? Is there a better way than setting a session variable? Turns out it does this automagically :)
If someone has a good tutorial for this I would happily read it :)
I've already read this tutorial but I found it to be a little to basic and the CakePHP-docs are not that great on this topic either.
There is no Cake admin system as such. There is Authentication component and there is Access Control List component. You can use only Authentication component if you wish or you can use both of them. If you want to create your admin system from scratch follow this tutorial. Or you can try already created admin panel - PoundCake Control Panel.
we have created an admin system for cakePHP, works similar to the scaffolding but it's configurable and ready to deploy, check it at http://browniephp.org
You can learn a lot from others codes, specially something like CakePHP Admin plugin at: https://github.com/Maldicore/Admin