Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Catalyst: Users

flexible ACL rules

 

 

Catalyst users RSS feed   Index | Next | Previous | View Threaded


blacky6767 at gmx

Jan 22, 2009, 11:09 PM

Post #1 of 4 (1138 views)
Permalink
flexible ACL rules

Hi *,

I have some difficulties in applying flexible rules [1] in my Catalyst app. Until now, I only used easy rules (mainly with deny_access_unless) like:

deny_access_unless(
"/users/edit" ,
sub{ shift->check_any_user_role(qw/admin user/) }
);

What I now want to achieve is, that 'admin' users can edit _every_ user, and 'user' users only themselves. So if 'user' user foo has p.ex. the id 5, he is allowed to /user/edit/5 but not /user/edit/4.

So I looked at the flexible rules documentation which I guess might do the job. I tried to apply the example mentioned there but I guess I don't understand these "die $ALLOWED"/"die $DENIED" lines (I am still Perl/Catalyst newbie): Although I added "Authorization::ACL::Engine" to my "use Catalyst" in myapp.pm, I get errors like "Global symbol '$ALLOWED/$DENIED' requires explicit package name at myapp.pm"

Any hints? Thanks in advance.

Jens

[1] http://tinyurl.com/c5eeml
--
Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

_______________________________________________
List: Catalyst [at] lists
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst [at] lists/
Dev site: http://dev.catalyst.perl.org/


email at jasonkohles

Jan 23, 2009, 5:18 PM

Post #2 of 4 (1033 views)
Permalink
Re: flexible ACL rules [In reply to]

On Jan 23, 2009, at 2:09 AM, Jens Schwarz wrote:

> Hi *,
>
> I have some difficulties in applying flexible rules [1] in my
> Catalyst app. Until now, I only used easy rules (mainly with
> deny_access_unless) like:
>
> deny_access_unless(
> "/users/edit" ,
> sub{ shift->check_any_user_role(qw/admin user/) }
> );
>
> What I now want to achieve is, that 'admin' users can edit _every_
> user, and 'user' users only themselves. So if 'user' user foo has
> p.ex. the id 5, he is allowed to /user/edit/5 but not /user/edit/4.
>
> So I looked at the flexible rules documentation which I guess might
> do the job. I tried to apply the example mentioned there but I guess
> I don't understand these "die $ALLOWED"/"die $DENIED" lines (I am
> still Perl/Catalyst newbie): Although I added
> "Authorization::ACL::Engine" to my "use Catalyst" in myapp.pm, I get
> errors like "Global symbol '$ALLOWED/$DENIED' requires explicit
> package name at myapp.pm"
>
From the docs:

"All access control is performed using exceptions
$Catalyst::Plugin::Authorization::ACL::Engine::DENIED, and
$Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED (these can be
imported from the engine module)."

Which means you either need to start your module with:

use Catalyst::Plugin::Authorization::ACL::Engine qw( $ALLOWED $DENIED );

or fully qualify them by like so:

die $Catalyst::Plugin::Authorization::ACL::Engine::DENIED unless
something();

--
Jason Kohles, RHCA RHCDS RHCE
email [at] jasonkohles - http://www.jasonkohles.com/
"A witty saying proves nothing." -- Voltaire



_______________________________________________
List: Catalyst [at] lists
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst [at] lists/
Dev site: http://dev.catalyst.perl.org/


info at rapidsynergy

Sep 18, 2009, 8:23 AM

Post #3 of 4 (778 views)
Permalink
Re: flexible ACL rules [In reply to]

I know this is an old thread but I recently moved my project from Fedora 10
to Mac OS 10.6 and find inexplicably that the Exporter no longer works.

So for instance if I:

use Catalyst::Plugin::Authorization::ACL::Engine qw($ALLOWED $DENIED);

And later reference the exceptions, the compiler complains:

Global symbol "$ALLOWED" requires explicit package name

However, if I fully qualify the variable with the package name, e.g.:

die $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED;

Then everything compiles fine.

Has something changed in the underlying code base or is this an issue with
the Darwin flavor of UNIX on Mac? Anyone else run Catalyst on the Mac? Is
the compile vs. run time out of sequence somehow?

-Eric
On Fri, Jan 23, 2009 at 9:18 PM, Jason Kohles <email [at] jasonkohles> wrote:

> On Jan 23, 2009, at 2:09 AM, Jens Schwarz wrote:
>
> Hi *,
>>
>> I have some difficulties in applying flexible rules [1] in my Catalyst
>> app. Until now, I only used easy rules (mainly with deny_access_unless)
>> like:
>>
>> deny_access_unless(
>> "/users/edit" ,
>> sub{ shift->check_any_user_role(qw/admin user/) }
>> );
>>
>> What I now want to achieve is, that 'admin' users can edit _every_ user,
>> and 'user' users only themselves. So if 'user' user foo has p.ex. the id 5,
>> he is allowed to /user/edit/5 but not /user/edit/4.
>>
>> So I looked at the flexible rules documentation which I guess might do the
>> job. I tried to apply the example mentioned there but I guess I don't
>> understand these "die $ALLOWED"/"die $DENIED" lines (I am still
>> Perl/Catalyst newbie): Although I added "Authorization::ACL::Engine" to my
>> "use Catalyst" in myapp.pm, I get errors like "Global symbol
>> '$ALLOWED/$DENIED' requires explicit package name at myapp.pm"
>>
>> From the docs:
>
> "All access control is performed using exceptions
> $Catalyst::Plugin::Authorization::ACL::Engine::DENIED, and
> $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED (these can be
> imported from the engine module)."
>
> Which means you either need to start your module with:
>
> use Catalyst::Plugin::Authorization::ACL::Engine qw( $ALLOWED $DENIED );
>
> or fully qualify them by like so:
>
> die $Catalyst::Plugin::Authorization::ACL::Engine::DENIED unless
> something();
>
> --
> Jason Kohles, RHCA RHCDS RHCE
> email [at] jasonkohles - http://www.jasonkohles.com/
> "A witty saying proves nothing." -- Voltaire
>
>
>
>
> _______________________________________________
> List: Catalyst [at] lists
> Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
> Searchable archive:
> http://www.mail-archive.com/catalyst [at] lists/
> Dev site: http://dev.catalyst.perl.org/
>


info at rapidsynergy

Sep 18, 2009, 8:26 AM

Post #4 of 4 (768 views)
Permalink
Re: flexible ACL rules [In reply to]

I should clarify that a simple Exporter test works fine. It just seems to be
happening with Authorization::ACL.

e.g.

This works just fine:

#MyModule.pm
package MyModule;
use base 'Exporter';

use strict;
use warnings;

our $var1 = 'foo';
our $var2 = 'bar';

our @EXPORT_OK = qw($var1 $var2);

#my_module.pl

#!/usr/local/bin/perl -w
use strict;
use MyModule qw($var1 $var2);

print "\$var1 = $var1\n";
print "\$var2 = $var2\n";

#Output
galadriel:perl eric$ ./my_module.pl
$var1 = foo
$var2 = bar

On Fri, Sep 18, 2009 at 11:23 AM, Eric Wright <info [at] rapidsynergy> wrote:

> I know this is an old thread but I recently moved my project from Fedora 10
> to Mac OS 10.6 and find inexplicably that the Exporter no longer works.
>
> So for instance if I:
>
> use Catalyst::Plugin::Authorization::ACL::Engine qw($ALLOWED $DENIED);
>
> And later reference the exceptions, the compiler complains:
>
> Global symbol "$ALLOWED" requires explicit package name
>
> However, if I fully qualify the variable with the package name, e.g.:
>
> die $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED;
>
> Then everything compiles fine.
>
> Has something changed in the underlying code base or is this an issue with
> the Darwin flavor of UNIX on Mac? Anyone else run Catalyst on the Mac? Is
> the compile vs. run time out of sequence somehow?
>
> -Eric
>
> On Fri, Jan 23, 2009 at 9:18 PM, Jason Kohles <email [at] jasonkohles>wrote:
>
>> On Jan 23, 2009, at 2:09 AM, Jens Schwarz wrote:
>>
>> Hi *,
>>>
>>> I have some difficulties in applying flexible rules [1] in my Catalyst
>>> app. Until now, I only used easy rules (mainly with deny_access_unless)
>>> like:
>>>
>>> deny_access_unless(
>>> "/users/edit" ,
>>> sub{ shift->check_any_user_role(qw/admin user/) }
>>> );
>>>
>>> What I now want to achieve is, that 'admin' users can edit _every_ user,
>>> and 'user' users only themselves. So if 'user' user foo has p.ex. the id 5,
>>> he is allowed to /user/edit/5 but not /user/edit/4.
>>>
>>> So I looked at the flexible rules documentation which I guess might do
>>> the job. I tried to apply the example mentioned there but I guess I don't
>>> understand these "die $ALLOWED"/"die $DENIED" lines (I am still
>>> Perl/Catalyst newbie): Although I added "Authorization::ACL::Engine" to my
>>> "use Catalyst" in myapp.pm, I get errors like "Global symbol
>>> '$ALLOWED/$DENIED' requires explicit package name at myapp.pm"
>>>
>>> From the docs:
>>
>> "All access control is performed using exceptions
>> $Catalyst::Plugin::Authorization::ACL::Engine::DENIED, and
>> $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED (these can be
>> imported from the engine module)."
>>
>> Which means you either need to start your module with:
>>
>> use Catalyst::Plugin::Authorization::ACL::Engine qw( $ALLOWED $DENIED );
>>
>> or fully qualify them by like so:
>>
>> die $Catalyst::Plugin::Authorization::ACL::Engine::DENIED unless
>> something();
>>
>> --
>> Jason Kohles, RHCA RHCDS RHCE
>> email [at] jasonkohles - http://www.jasonkohles.com/
>> "A witty saying proves nothing." -- Voltaire
>>
>>
>>
>>
>> _______________________________________________
>> List: Catalyst [at] lists
>> Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
>> Searchable archive:
>> http://www.mail-archive.com/catalyst [at] lists/
>> Dev site: http://dev.catalyst.perl.org/
>>
>
>
>
>
>
>

Catalyst users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.