Congegni
/
sintonia
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Backport ACL REST permission fix

This commit is contained in:
Albert Santoni 2015-02-06 16:05:51 -05:00
parent 4b6e5671c3
commit 2a9790adf3
2 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
airtime_mvc/application/configs/ACL.php
View File

@ -48,7 +48,8 @@ $ccAcl->allow('G', 'index')
->allow('G', 'locale')
->allow('G', 'upgrade')
->allow('G', 'downgrade')
->allow('G', 'rest:media')
->allow('G', 'rest:media', 'get')
->allow('H', 'rest:media')
->allow('H', 'preference', 'is-import-in-progress')
->allow('H', 'usersettings')
->allow('H', 'plupload')

38
airtime_mvc/application/controllers/plugins/Acl_plugin.php
View File

@ -123,28 +123,32 @@ class Zend_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract
die();
}
}
else //Non-REST, regular Airtime web app requests
{
//Redirect you to the login screen since you have no session.
if ($controller !== 'login') {
if ($controller !== 'login') {
if ($request->isXmlHttpRequest()) {
if ($request->isXmlHttpRequest()) {
$url = 'http://'.$request->getHttpHost().'/login';
$json = Zend_Json::encode(array('auth' => false, 'url' => $url));
$url = 'http://'.$request->getHttpHost().'/login';
$json = Zend_Json::encode(array('auth' => false, 'url' => $url));
// Prepare response
$this->getResponse()
->setHttpResponseCode(401)
->setBody($json)
->sendResponse();
// Prepare response
$this->getResponse()
->setHttpResponseCode(401)
->setBody($json)
->sendResponse();
//redirectAndExit() cleans up, sends the headers and stops the script
Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->redirectAndExit();
} else {
$r = Zend_Controller_Action_HelperBroker::getStaticHelper('redirector');
$r->gotoSimpleAndExit('index', 'login', $request->getModuleName());
}
//redirectAndExit() cleans up, sends the headers and stops the script
Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->redirectAndExit();
} else {
$r = Zend_Controller_Action_HelperBroker::getStaticHelper('redirector');
$r->gotoSimpleAndExit('index', 'login', $request->getModuleName());
}
}
}
} else {
} else { //We have a session/identity.
// If we have an identity and we're making a RESTful request,
// we need to check the CSRF token
if ($request->_action != "get" && $request->getModuleName() == "rest") {