CODEWITHSUNDEEP
phpcakephp-3.0
Daniel Faria
Daniel Faria

Reputation: 1484

Blog tutorial docs isAuthorized missing return false?

// src/Controller/ArticlesController.php

public function isAuthorized($user)
{
    // All registered users can add articles
    if ($this->request->action === 'add') {
        return true;
    }

    // The owner of an article can edit and delete it
    if (in_array($this->request->action, ['edit', 'delete'])) {
        $articleId = (int)$this->request->params['pass'][0];
        if ($this->Articles->isOwnedBy($articleId, $user['id'])) {
            return true;
        }
    }

    return parent::isAuthorized($user);
}

Need I return false if the isOwnedBy() test fail? like this:

// src/Controller/ArticlesController.php

public function isAuthorized($user)
{
    // All registered users can add articles
    if ($this->request->action === 'add') {
        return true;
    }

    // The owner of an article can edit and delete it
    if (in_array($this->request->action, ['edit', 'delete'])) {
        $articleId = (int)$this->request->params['pass'][0];
        if ($this->Articles->isOwnedBy($articleId, $user['id'])) {
            return true;
        }
        return false;
    }

    return parent::isAuthorized($user);
}

I found this code at: http://book.cakephp.org/3.0/en/tutorials-and-examples/blog-auth-example/auth.html#authorization-who-s-allowed-to-access-what

Upvotes: 0

Views: 43

Answers (1)

ndm
ndm

Reputation: 60463

If you look closely, the parent isAuthorized() method will return false for all non-admins

public function isAuthorized($user)
{
    // Admin can access every action
    if (isset($user['role']) && $user['role'] === 'admin') {
        return true;
    }

    // Default deny
    return false;
}

So in that specific case, no, you don't have to, to be exact, you must not, as this would cause only owners being able to edit anything at all, since the admin role would not get checked anymore.

ps. this type of question is probably better suited on IRC or the Google group.

Upvotes: 1

Related Questions