How to limit data to users who own it without limiting admin users in CakePHP?

Question

Currently I am writing an application where I have multiple users. They have data that should only be visible to them and not the other authenticated users in the system. I also have administrators who manage the system and have access to all of the information. What is the best way to limit users to their data without limiting admin users?

Currently I am using a callback to limit the queries by user, but the admin will get the same limits. So I need to know a better way to do it. More importantly, the right way to do it.

For example, I want the standard user to be able to see their user information only and be limited to CRUD operations on their information only. The admin, however, should be able to see ALL users and CRUD ALL user data. Any ideas?

Answer 1

You can get the current user info this way: $this->Auth->user(). You can use the user group id in your callback to limit the query. Also take a loot at WhoDidIt Behavior.

Answer 2

You need:

• Information about the current user
• Information about the item in question

You combine them with something like this (simple example):

$user = $this->Auth->user();
$book = $this->Book->find(…);
if ($user['type'] != 'admin' && $user['id'] != $book['Book']['creator_id']) {
    $this->Session->setFlash("You're not allowed to view this item");
    $this->redirect('somewhere');
}

You could make a method in your model like

function userCanAccessItem($item, $user)

to centralize the logic for the access check and call it from your controller.

Better yet, if you're using Cake's admin routing, you can omit all checking in the admin_ actions and only apply normal user access privilege checking in the user accessible actions.

You may also want to look at ACLs for more fine-grained access control.

Answer 3

After not finding what I was looking for on the Internet, and not getting a solution posted here (most likely due to my inability to communicate what I was looking for), I spent the last few days writing a solution. I finally have the solution I am looking for. While some of the answers here were on the write track, they just were not complete enough for what I was looking for.

Since there is not enough room here to post the results, I added the content to my blog. You can ready it here at blogchuck.com. Please feel free to blast it to pieces, it will help us all in the long run.

Thanks to everyone who took the time to post.