Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not enforce logged user in Acl::getRules #92

Closed
wants to merge 3 commits into from

Conversation

mkrecek234
Copy link
Contributor

See issue #90

@mvorisek mvorisek changed the title Delete forced user check in GetRules Do not enforce logged user in Acl::getRules Feb 25, 2022
@@ -30,12 +30,6 @@ public function getRules(Model $model)
/** @var \Atk4\Login\Model\User */
$user = $this->auth->user;

if (!$user->isLoaded()) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what do you expect from l38:

$res = $user->ref('AccessRules')->addCondition('model', 'in', $modelClasses);

returned then?

Copy link
Member

@mvorisek mvorisek Feb 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here is a comparison of query issued by the l38 for logged & un-logged user:

image

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

related with atk4/data#969

Copy link
Member

@mvorisek mvorisek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can have ACL rules for unlogged/anonymous user, but removing check as proposed is wrong as $res = $user->ref('AccessRules') will return unexpected result then.

@mvorisek
Copy link
Member

mvorisek commented May 9, 2022

As this change is wrong and should even throw when traversing unloaded entity, I am closing it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants