TheCoreDev/sterivein
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Working on security

Browse Source
This commit is contained in:
franck
2013-07-08 13:22:11 +02:00
parent 5bec576b9b
commit 6890482101
6 changed files with 177 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
core/lib/Thelia/Admin/Controller/AdminController.php
View File

@@ -23,58 +23,10 @@
namespace Thelia\Admin\Controller;
use Symfony\Component\HttpFoundation\Response;
use Thelia\Form\AdminLogin;
class AdminController extends BaseAdminController {
public function loginAction()
{
$form = $this->getLoginForm();
$request = $this->getRequest();
if($request->isMethod("POST")) {
$form->bind($request);
if ($form->isValid()) {
$this->container->get('request')->authenticate(
$form->get('username')->getData(),
$form->get('password')->getData()
);
echo "valid"; exit;
}
}
return $this->render("login.html", array(
"form" => $form->createView()
));
}
public function indexAction()
{
$form = $this->getLoginForm();
return $this->render("login.html", array(
"form" => $form->createView()
));
}
protected function getLoginForm()
{
$adminLogin = new AdminLogin($this->getRequest());
return $adminLogin->getForm();
}
public function lostAction()
{
return new Response(
$this->renderRaw("404.html"),
404
);
return $this->render("home.html");
}
}

63
core/lib/Thelia/Admin/Controller/SessionController.php Normal file
View File

@@ -0,0 +1,63 @@
<?php
/*************************************************************************************/
/* */
/* Thelia */
/* */
/* Copyright (c) OpenStudio */
/* email : info@thelia.net */
/* web : http://www.thelia.net */
/* */
/* This program is free software; you can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 3 of the License */
/* */
/* This program is distributed in the hope that it will be useful, */
/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
/* GNU General Public License for more details. */
/* */
/* You should have received a copy of the GNU General Public License */
/* along with this program. If not, see <http://www.gnu.org/licenses/>. */
/* */
/*************************************************************************************/
namespace Thelia\Admin\Controller;
use Symfony\Component\HttpFoundation\Response;
use Thelia\Form\AdminLogin;
class SessionController extends BaseAdminController {
public function loginAction()
{
$form = $this->getLoginForm();
$request = $this->getRequest();
if($request->isMethod("POST")) {
$form->bind($request);
if ($form->isValid()) {
$this->container->get('request')->authenticate(
$form->get('username')->getData(),
$form->get('password')->getData()
);
echo "valid"; exit;
}
}
return $this->render("login.html", array(
"form" => $form->createView()
));
}
protected function getLoginForm()
{
$adminLogin = new AdminLogin($this->getRequest());
return $adminLogin->getForm();
}
}

6
core/lib/Thelia/Config/Resources/routing/admin.xml
View File

@@ -8,10 +8,10 @@
<default key="_controller">Thelia\Admin\Controller\AdminController::indexAction</default>
</route>
<route id="admin.login" path="/admin/login">
<default key="_controller">Thelia\Admin\Controller\AdminController::loginAction</default>
<default key="_controller">Thelia\Admin\Controller\SessionController::loginAction</default>
</route>
<route id="admin.lost" path="/admin/{everything}">
<default key="_controller">Thelia\Admin\Controller\AdminController::lostAction</default>
<route id="admin.notfound" path="/admin/{everything}">
<default key="_controller">Thelia\Admin\Controller\AdminController::notFoundAction</default>
<requirement key="everything">.*</requirement>
</route>
</routes>

13
core/lib/Thelia/Core/Security/SecurityManager.php
View File

@@ -32,21 +32,22 @@ use Thelia\Core\Security\Exception\AuthenticationTokenNotFoundException;
* @author Franck Allimant <franck@cqfdev.fr>
*/
class SecurityManager {
/*
protected $authProvider;
public function __construct(AuthenticationProviderInterface $authProvider) {
$this->authProvider = $authProvider;
}
*/
/**
* Checks if the current token is authenticated
*
* @throws AuthenticationCredentialsNotFoundException when the security context has no authentication token.
*
* @return Boolean
* @throws AuthenticationTokenNotFoundException if no thoken was found in context
*/
final public function isGranted()
final public function isGranted($roles, $permissions)
{
if (null === $this->token) {
throw new AuthenticationTokenNotFoundException('The security context contains no authentication token.');
@@ -56,7 +57,11 @@ class SecurityManager {
$this->token = $this->authProvider->authenticate($this->token);
}
return $this->token->isAuthenticated();
if ($this->token->isAuthenticated()) {
// Check user roles and permissions
}
return false;
}
/**

81
core/lib/Thelia/Core/Template/Smarty/Plugins/Security.php Normal file
View File

@@ -0,0 +1,81 @@
<?php
/*************************************************************************************/
/* */
/* Thelia */
/* */
/* Copyright (c) OpenStudio */
/* email : info@thelia.net */
/* web : http://www.thelia.net */
/* */
/* This program is free software; you can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 3 of the License */
/* */
/* This program is distributed in the hope that it will be useful, */
/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
/* GNU General Public License for more details. */
/* */
/* You should have received a copy of the GNU General Public License */
/* along with this program. If not, see <http://www.gnu.org/licenses/>. */
/* */
/*************************************************************************************/
namespace Thelia\Core\Template\Smarty\Plugins;
use Thelia\Core\Template\Smarty\SmartyPluginDescriptor;
use Thelia\Core\Template\Smarty\SmartyPluginInterface;
use Thelia\Core\Template\Smarty\Assets\SmartyAssetsManager;
use Thelia\Core\Security\SecurityManager;
class Security implements SmartyPluginInterface
{
private $securityManager;
public function __construct(SecurityManager $securityManager)
{
$this->securityManager = $securityManager;
}
private function _explode($commaSeparatedValues)
{
$array = explode(',', $commaSeparatedValues);
if (array_walk($array, function(&$item) {
$item = strtoupper(trim($item));
})) {
return $array;
}
return array();
}
/**
* Process security check function
*
* @param unknown $params
* @param unknown $smarty
* @return string
*/
public function checkAUth($params, &$smarty)
{
$roles = $this->_explode($params['role']);
$permissions = $this->_explode($params['role']);
$this->securityManager->isGranted($roles, $permissions);
}
/**
* Define the various smarty plugins hendled by this class
*
* @return an array of smarty plugin descriptors
*/
public function getPluginDescriptors()
{
return array(
new SmartyPluginDescriptor('function', 'check_auth', $this, 'checkAUth'),
);
}
}

20
templates/admin/default/home.html
View File

@@ -0,0 +1,20 @@
{check_auth roles="ADMIN"}
{$page_title={intl l='Home'}}
{include file='includes/header.inc.html'}
<div class="homepage">
<div class="brandbar container">
<a class="brand" href="index.php">{images file='assets/img/logo-thelia-34px.png'}<img src="{$asset_url}" alt="{intl l='Thelia, solution e-commerce libre'}" />{/images}</a>
</div>
<div id="wrapper" class="container">
{module_include location='index_top'}
welcome home !
{module_include location='home_bottom'}
</div>
</div>
{include file='includes/footer.inc.html'}