Changes between Version 4 and Version 5 of iPeerSecurity

Timestamp:

2010-05-31T22:44:24Z (14 years ago)

Author:

Serge Okon

Comment:

--

iPeerSecurity

@@ -6 +6 @@
 === app_controller->checkAccess() ===
 The method will check the requested controller name against the database (specifically, the contents of `sysContainer->getActionList())`), and if any entry with this controller is found, it keep processing the page. Otherwise, it redirects the client to `loginlout/login`. Specifically which method will the client requests to be invoked, is, apparently, no concidered.
-
+{{{
+                        //check permission
+                        if (!$this->rdAuth->check($this->params['controller'], $this->sysContainer->getActionList()))
+                        {
+                                $this->Session->write('URL', $URL);
+                                $this->Session->write('AccessErr', 'NO_PERMISSION');
+                                $redirect = 'loginout/login';
+                                $this->redirect($redirect);
+                                exit;
+                        }
+}}}
 === Users_controller ===
 Each potentialy sensitive method in users_controller checks the user role agains 'S' (or Student). If a Student should not be able to access this function, they are re-directed away from the page. If any other user type is logged on, the requested action will proceed.