Changeset 155

Show
Ignore:
Timestamp:
11/29/05 03:40:12 (3 years ago)
Author:
lazyatom
Message:

Merged branch testing fixes from r154 into plugins trunk

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • plugins/user_engine/README

    r153 r155  
    11= UserEngine: Login + Roles 
    22 
    3 The UserEngine extends the LoginEngine with a very, *very* simple implementation of RBAC - role based access control. As well as the 'User' object, the UserEngine provides Permission objects, and Role objects. Each User can have many Roles, and each Role is associated with many Permissions. A Permission is simple a controller/action pair. A Role which is associated with some permission has access to that specific controller/action, i.e. and Role associated with the Permission object "user/home" will be allowed to call that action.  
     3The UserEngine extends the LoginEngine with a very, *very* simple implementation of RBAC - role based access control. As well as the 'User' object, the UserEngine provides Permission objects, and Role objects. Each User can have many Roles, and each Role is associated with many Permissions. A Permission is simple a controller/action pair. A Role which is associated with some permission has access to that specific controller/action, i.e. any Role associated with the Permission object "user/home" will be allowed to call that action.  
    44 
    55 
    66=== Not the One True RBAC system 
    77 
    8 We'll make this point at the beginning, so there can be no doubt - this is *not* a full permission system. The UserEngine only controls which users have the right to hit which controller/action pairs. It will not control access to data at all, so for instance you cannot use it to give users the ability to edit only a subset of your data object (unless that subset is controlled via different controller actions). 
     8I'll make this point at the beginning, so there can be no doubt - this is *not* a full permission system. The UserEngine only controls which users have the right to hit which controller/action pairs. It will not control access to data at all, so for instance you cannot use it to give users the ability to edit only a subset of your data object (unless that subset is controlled via different controller actions). 
    99 
    1010 
    …… 
    808010. The UserEngine provides a default stylesheet and a small javascript helper file (used in the Role#edit action), so you'll probably want to include the former and almost certainly the latter in your application's layout. Add the following lines: 
    8181 
    82     <%= engine_stylesheet "user" %> 
    83     <%= engine_javascript "user" %> 
     82      <%= engine_stylesheet "user" %> 
     83      <%= engine_javascript "user" %> 
    8484 
    858511. Remove any existing sessions (since they might interfere with the login process), and start the server and log using your administrator login and password (if you didn't set one explicitly in your configuration, the defaults are 'admin'/'testing' - make sure you change them!) and go to http://localhost:3000/user/list to see a list of all the users. From there you can create new users, view roles & permissions, and play around... 

  • plugins/user_engine/lib/user_engine/authorized_system.rb

    r153 r155  
    8080      # a security token (see LoginEngine for details).  
    8181      def authorize_action 
    82  
    8382        required_permission = "%s/%s" % [ params["controller"], params["action"] ] 
    84         logger.info "required_perm is #{required_permission}" 
     83        logger.debug "required_perm is #{required_permission}" 
    8584 
    8685        controller = params["controller"] 
    …… 
    126125            end 
    127126 
     127            # Otherwise, just send them back to where they were. If they clicked a link,  
     128            # we'll have the HTTP_REFERER information. Otherwise we'll use our 'prev_uri' 
     129            # information. If we have nothing, set it to be the root. 
     130            return_uri = request.env['HTTP_REFERER'] || session['prev_uri'] || "/" 
    128131            # The user wasn't allowed to perform this action. Try and redirect them somewhere 
    129132            # If they are no longer allowed to see the page they came here from,  
    130             # go back to square one. 
    131             if session["prev_uri"].nil? || session["prev_uri"].index("/#{required_permission}") == 0 
    132               redirect_to_path "/" 
    133               return false 
    134             end         
     133            # go back to square one. We need to match the URI against the required permission. 
     134            return_uri = "/" if return_uri =~ /\S*\:\/\/\S*\/#{required_permission}\S*/ 
    135135 
    136             # Otherwise, just send them back to where they were. 
    137             # TODO: for some reason, the request.env["HTTP_REFERER"] that redirect_to :back needs 
    138             # is nil here... 
    139             redirect_to_path session["prev_uri"] 
    140             #redirect_to :back 
     136            # redirect & return false to indicate that controller action processing should NOT continue. 
     137            redirect_to return_uri 
    141138            return false 
    142139          end 
    143140        else 
     141           
    144142          # noone is or can be logged in... 
    145143          unless User.guest_user_authorized?(controller, action)           

  • plugins/user_engine/test/functional/user_controller_test.rb

    r153 r155  
    5151  def test_unauthorized_access 
    5252    login(:normal_user) 
    53     @request.session['REQUEST_URI'] = "/" 
    54      
    55     get :edit_user, :id => 1 
    56     # we should be sent BACK 
    57     assert_match /Permission warning/, flash[:message] 
    58     assert_redirected_to "http://#{@request.host}/" 
    59      
     53 
    6054    # ensure that we get redirected back to an action we are authorized to access 
    61     get :home 
    62     assert_response :success 
     55    @request.env['HTTP_REFERER'] = "http://#{@request.host}/user/home" 
    6356    get :edit_user 
    6457    # we should be sent BACK 
    6558    assert_match /Permission warning/, flash[:message] 
    66     assert_redirected_to :action => 'home' 
     59    assert_redirected_to "http://#{@request.host}/user/home" 
    6760     
    6861    # ensure that if our previous URL is an action we are no longer authorized for 
    6962    # we get sent back to the root 
    70     login(:normal_user) 
    71     @request.session['REQUEST_URI'] = "/user/edit_user/3" 
    72      
     63    @request.env['HTTP_REFERER'] = "http://#{@request.host}/user/edit_user/3" 
    7364    get :edit_user, :id => 1 
    74     # we should be sent BACK to /, since he's not allowed to edit the user either. 
     65    # we should be sent BACK to /, since he's not allowed to edit_user at all. 
    7566    assert_match /Permission warning/, flash[:message] 
    7667    assert_redirected_to "http://#{@request.host}/"     
    …… 
    163154     
    164155    ActionMailer::Base.deliveries = [] 
    165     get :edit_user, :id => users(:normal_user).id 
    166      
     156 
     157    @request.env['HTTP_REFERER'] = "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"      
    167158    post :change_password_for_user, :id => users(:normal_user).id,  
    168159         :user => { :password => "changed_password", :password_confirmation => "changed_password" } 
    …… 
    173164    assert_match /login:\s+\w+\n/, mail.encoded 
    174165    assert_match /password:\s+\w+\n/, mail.encoded 
     166    assert_redirected_to "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"  
    175167 
    176168    post :login, :user => { :login => "normal_user", :password => "changed_password" } 
    …… 
    182174    LoginEngine::CONFIG[:use_email_notification] = false 
    183175     
    184     get :edit_user, :id => users(:normal_user).id 
    185      
     176    @request.env['HTTP_REFERER'] = "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"  
    186177    post :change_password_for_user, :id => users(:normal_user).id, 
    187178         :user => { :password => "changed_password", :password_confirmation => "changed_password" } 
    188179     
    189     assert_redirected_to :action => 'edit_user' 
     180    assert_redirected_to "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"  
    190181 
    191182    post :login, :user => { :login => "normal_user", :password => "changed_password" } 
    …… 
    198189    ActionMailer::Base.deliveries = [] 
    199190 
    200     get :edit_user, :id => users(:normal_user).id 
    201      
     191    @request.env['HTTP_REFERER'] = "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"  
    202192    post :change_password_for_user, :id => users(:normal_user).id,  
    203193         :user => { :password => "bad", :password_confirmation => "bad" } 
    204194          
    205195    assert_invalid_column_on_record "user", "password" 
    206     assert_redirected_to :action => 'edit_user' 
    207196    assert_equal 0, ActionMailer::Base.deliveries.size     
     197    assert_redirected_to "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"  
    208198 
    209199    post :login, :user => { :login => "normal_user", :password => "atest" } 
    …… 
    215205    LoginEngine::CONFIG[:use_email_notification] = false 
    216206 
    217     get :edit_user, :id => users(:normal_user).id 
    218      
     207    @request.env['HTTP_REFERER'] = "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"     
    219208    post :change_password_for_user, :id => users(:normal_user).id,  
    220209         :user => { :password => "bad", :password_confirmation => "bad" } 
     210          
    221211    assert_invalid_column_on_record "user", "password" 
    222      
    223     assert_redirected_to :action => 'edit_user' 
     212    assert_redirected_to "http://#{@request.host}/user/edit_user/#{users(:normal_user).id}"  
    224213 
    225214    post :login, :user => { :login => "normal_user", :password => "atest" } 

  • plugins/user_engine/test/test_helper.rb

    r153 r155  
    6262  @request.session[:user] = user.nil? ? nil : users(user) 
    6363end 
     64