flexible ACL rules

[Jens Schwarz]

Hi *,

I have some difficulties in applying flexible rules [1] in my Catalyst app. Until now, I only used easy rules (mainly with deny_access_unless) like:

deny_access_unless(
  "/users/edit" ,
  sub{ shift->check_any_user_role(qw/admin user/) }
);

What I now want to achieve is, that 'admin' users can edit _every_ user, and 'user' users only themselves. So if 'user' user foo has p.ex. the id 5, he is allowed to /user/edit/5 but not /user/edit/4.

So I looked at the flexible rules documentation which I guess might do the job. I tried to apply the example mentioned there but I guess I don't understand these "die $ALLOWED"/"die $DENIED" lines (I am still Perl/Catalyst newbie): Although I added "Authorization::ACL::Engine" to my "use Catalyst" in myapp.pm, I get errors like "Global symbol '$ALLOWED/$DENIED' requires explicit package name at myapp.pm"

Any hints? Thanks in advance.

Jens

[1] http://tinyurl.com/c5eeml
--
Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

_______________________________________________
List: Catalyst@...
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@.../
Dev site: http://dev.catalyst.perl.org/

[Jason Kohles]

On Jan 23, 2009, at 2:09 AM, Jens Schwarz wrote:

> Hi *,
>
> I have some difficulties in applying flexible rules [1] in my  
> Catalyst app. Until now, I only used easy rules (mainly with  
> deny_access_unless) like:
>
> deny_access_unless(
>  "/users/edit" ,
>  sub{ shift->check_any_user_role(qw/admin user/) }
> );
>
> What I now want to achieve is, that 'admin' users can edit _every_  
> user, and 'user' users only themselves. So if 'user' user foo has  
> p.ex. the id 5, he is allowed to /user/edit/5 but not /user/edit/4.
>
> So I looked at the flexible rules documentation which I guess might  
> do the job. I tried to apply the example mentioned there but I guess  
> I don't understand these "die $ALLOWED"/"die $DENIED" lines (I am  
> still Perl/Catalyst newbie): Although I added  
> "Authorization::ACL::Engine" to my "use Catalyst" in myapp.pm, I get  
> errors like "Global symbol '$ALLOWED/$DENIED' requires explicit  
> package name at myapp.pm"
>

 From the docs:

"All access control is performed using exceptions  
$Catalyst::Plugin::Authorization::ACL::Engine::DENIED, and  
$Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED (these can be  
imported from the engine module)."

Which means you either need to start your module with:

use Catalyst::Plugin::Authorization::ACL::Engine qw( $ALLOWED $DENIED );

or fully qualify them by like so:

die $Catalyst::Plugin::Authorization::ACL::Engine::DENIED unless  
something();

--
Jason Kohles, RHCA RHCDS RHCE
email@... - http://www.jasonkohles.com/
"A witty saying proves nothing."  -- Voltaire



_______________________________________________
List: Catalyst@...
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@.../
Dev site: http://dev.catalyst.perl.org/

[Eric Wright-5]

I know this is an old thread but I recently moved my project from Fedora 10 to Mac OS 10.6 and find inexplicably that the Exporter no longer works.

So for instance if I:

use Catalyst::Plugin::Authorization::ACL::Engine qw($ALLOWED $DENIED);

And later reference the exceptions, the compiler complains:

Global symbol "$ALLOWED" requires explicit package name

However, if I fully qualify the variable with the package name, e.g.:

die $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED;

Then everything compiles fine.

Has something changed in the underlying code base or is this an issue with the Darwin flavor of UNIX on Mac? Anyone else run Catalyst on the Mac? Is the compile vs. run time out of sequence somehow?

-Eric

On Fri, Jan 23, 2009 at 9:18 PM, Jason Kohles <email@...> wrote:

On Jan 23, 2009, at 2:09 AM, Jens Schwarz wrote:

Hi *,

I have some difficulties in applying flexible rules [1] in my Catalyst app. Until now, I only used easy rules (mainly with deny_access_unless) like:

deny_access_unless(
 "/users/edit" ,
 sub{ shift->check_any_user_role(qw/admin user/) }
);

What I now want to achieve is, that 'admin' users can edit _every_ user, and 'user' users only themselves. So if 'user' user foo has p.ex. the id 5, he is allowed to /user/edit/5 but not /user/edit/4.

So I looked at the flexible rules documentation which I guess might do the job. I tried to apply the example mentioned there but I guess I don't understand these "die $ALLOWED"/"die $DENIED" lines (I am still Perl/Catalyst newbie): Although I added "Authorization::ACL::Engine" to my "use Catalyst" in myapp.pm, I get errors like "Global symbol '$ALLOWED/$DENIED' requires explicit package name at myapp.pm"

>From the docs:

"All access control is performed using exceptions  $Catalyst::Plugin::Authorization::ACL::Engine::DENIED, and $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED (these can be imported from the engine module)."

Which means you either need to start your module with:

use Catalyst::Plugin::Authorization::ACL::Engine qw( $ALLOWED $DENIED );

or fully qualify them by like so:

die $Catalyst::Plugin::Authorization::ACL::Engine::DENIED unless something();

--
Jason Kohles, RHCA RHCDS RHCE
email@... - http://www.jasonkohles.com/
"A witty saying proves nothing."  -- Voltaire

_______________________________________________
List: Catalyst@...
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@.../
Dev site: http://dev.catalyst.perl.org/

_______________________________________________
List: Catalyst@...
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@.../
Dev site: http://dev.catalyst.perl.org/

[Eric Wright-5]

I should clarify that a simple Exporter test works fine. It just seems to be happening with Authorization::ACL.

e.g.

This works just fine:

#MyModule.pm
package MyModule;
use base 'Exporter';

use strict;
use warnings;

our $var1 = 'foo';
our $var2 = 'bar';

our @EXPORT_OK = qw($var1 $var2);

#my_module.pl

#!/usr/local/bin/perl -w
use strict;
use MyModule qw($var1 $var2);

print "\$var1 = $var1\n";
print "\$var2 = $var2\n";

#Output
galadriel:perl eric$ ./my_module.pl
$var1 = foo
$var2 = bar

On Fri, Sep 18, 2009 at 11:23 AM, Eric Wright <info@...> wrote:

I know this is an old thread but I recently moved my project from Fedora 10 to Mac OS 10.6 and find inexplicably that the Exporter no longer works.

So for instance if I:

use Catalyst::Plugin::Authorization::ACL::Engine qw($ALLOWED $DENIED);

And later reference the exceptions, the compiler complains:

Global symbol "$ALLOWED" requires explicit package name

However, if I fully qualify the variable with the package name, e.g.:

die $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED;

Then everything compiles fine.

Has something changed in the underlying code base or is this an issue with the Darwin flavor of UNIX on Mac? Anyone else run Catalyst on the Mac? Is the compile vs. run time out of sequence somehow?

-Eric

On Fri, Jan 23, 2009 at 9:18 PM, Jason Kohles <email@...> wrote:

On Jan 23, 2009, at 2:09 AM, Jens Schwarz wrote:

Hi *,

I have some difficulties in applying flexible rules [1] in my Catalyst app. Until now, I only used easy rules (mainly with deny_access_unless) like:

deny_access_unless(
 "/users/edit" ,
 sub{ shift->check_any_user_role(qw/admin user/) }
);

What I now want to achieve is, that 'admin' users can edit _every_ user, and 'user' users only themselves. So if 'user' user foo has p.ex. the id 5, he is allowed to /user/edit/5 but not /user/edit/4.

So I looked at the flexible rules documentation which I guess might do the job. I tried to apply the example mentioned there but I guess I don't understand these "die $ALLOWED"/"die $DENIED" lines (I am still Perl/Catalyst newbie): Although I added "Authorization::ACL::Engine" to my "use Catalyst" in myapp.pm, I get errors like "Global symbol '$ALLOWED/$DENIED' requires explicit package name at myapp.pm"

>From the docs:

"All access control is performed using exceptions  $Catalyst::Plugin::Authorization::ACL::Engine::DENIED, and $Catalyst::Plugin::Authorization::ACL::Engine::ALLOWED (these can be imported from the engine module)."

Which means you either need to start your module with:

use Catalyst::Plugin::Authorization::ACL::Engine qw( $ALLOWED $DENIED );

or fully qualify them by like so:

die $Catalyst::Plugin::Authorization::ACL::Engine::DENIED unless something();

--
Jason Kohles, RHCA RHCDS RHCE
email@... - http://www.jasonkohles.com/
"A witty saying proves nothing."  -- Voltaire

_______________________________________________
List: Catalyst@...
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@.../
Dev site: http://dev.catalyst.perl.org/

_______________________________________________
List: Catalyst@...
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@.../
Dev site: http://dev.catalyst.perl.org/