[Userlogin-users] Re: userlogin

[John K. <jk...@in...>]

Incidentally all, 0.6.2 is out with a bugfix in permissions checking.


On 06 Sep 2001 11:20:53 -0400, la...@lu... wrote:
> 
> Hello all. I recently ran into the UserLogin component(s) for mason, and
> have one question about it. I have it set up and working, but the
> documentation is a little sparse (non existant? :) ).
> 

Besides the comments in autohandler and the install guide, none.  Soon,
I promise :)

BTW, the proper place for this use...@so... ... I'd
like to pollute the Mason list as little as possible with my bugs.

You might want to grab the new version I just put up (0.6.2) which fixes
the $sys->finished thing and makes the example permissions stuff look
better.  Answers below.

> I'm unclear about one of the overrideable things in the autohandler. The
> permissions attribute has me confused.
> 
> First of all, the example attributes in the included autohandler in the
> sample application looks wrong. It has:
> 
> <%attr>
> $permissions=> { "Cannot Do Anything" => 0, "Super-User" => 1}
> </%attr>
> 
> Shouldn't that be "permissions=>" instead?
> 

Yeppers.

And the <%doc> around it needs to be removed.  In fact, you don't need
either of those statements--they are redundant.  The default
check_permissions checks those no matter what.  And you're right about
the ->finished thing, I apparently didn't retest permissions hash after
changing %cleanup.  The new version fixes the error.

For the situation you described, this boolean checking won't help you
anyway, so you don't need to grab it yet.  Read on.

> Does anyone have a good working example on what I need to do to specify in
> a component / page that it can only be accessed by someone at or above a
> specific user level using UserLogin?
> 

Since the default check_session only checks boolean, you'll have to
override check_permissions.  Search for %method check_permissions in
autohandler.  Remove the %doc around it.

For what you're looking for, check_permissions is your best bet.

Here's an example.  You can override this in different components to use
different levels.

<%method check_permissions>
<%perl>
my $user = $ARGS{-sys}{users}{$ARGS{-session}{_user_id}};
if($user->{UserLevel} < 5) {
        return 0;
}

return $m->call_method("session:check_permissions", %ARGS);
</%perl>
</%method>

You don't have to call session:check_permissions, but if you want to be
able to disable users using the "Cannot Do Anything" parameter it's a
good idea.

--John