adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Throw exceptions when invalid permission keys are used.

Browse source 
Silently 'failing' to save permissions is bad, throw exceptions instead.

Fixes #3851
This commit is contained in:
mark_story 2013-05-24 21:47:10 -04:00
parent a63b54c34b
commit 9ee610757e
2 changed files with 19 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lib/Cake/Model/Permission.php
View file

@ -162,9 +162,10 @@ class Permission extends AppModel {
*
* @param string $aro ARO The requesting object identifier.
* @param string $aco ACO The controlled object identifier.
* @param string $actions Action (defaults to *)
* @param string $actions Action (defaults to *) Invalid permissions will result in an exception
* @param integer $value Value to indicate access type (1 to give access, -1 to deny, 0 to inherit)
* @return boolean Success
* @throws AclException on Invalid permission key.
*/
public function allow($aro, $aco, $actions = "*", $value = 1) {
$perms = $this->getAclLink($aro, $aco);
@ -185,17 +186,16 @@ class Permission extends AppModel {
if (!is_array($actions)) {
$actions = array('_' . $actions);
}
if (is_array($actions)) {
foreach ($actions as $action) {
if ($action{0} !== '_') {
$action = '_' . $action;
}
if (in_array($action, $permKeys)) {
if (!in_array($action, $permKeys, true)) {
throw new AclException(__d('cake_dev', 'Invalid permission key "%s"', $action));
}
$save[$action] = $value;
}
}
}
}
list($save['aro_id'], $save['aco_id']) = array($perms['aro'], $perms['aco']);
if ($perms['link'] && !empty($perms['link'])) {

10
lib/Cake/Test/Case/Controller/Component/Acl/DbAclTest.php
View file

@ -293,6 +293,16 @@ class DbAclTest extends CakeTestCase {
$this->assertFalse($this->Acl->allow('Lumbergh', 'ROOT/tpsReports/DoesNotExist', 'create'));
}
/**
* Test that allow() with an invalid permission name triggers an error.
*
* @expectedException CakeException
* @return void
*/
public function testAllowInvalidPermission() {
$this->Acl->allow('Micheal', 'tpsReports', 'derp');
}
/**
* testAllowInvalidNode method
*