Chapter 3 of zendframework Learning (Core Component-advanced ACL usage-fine-grained access control and removal control rules)

Ah! Ha! Cough! Continue Our ZF journey today. Today, we will show you the fine-grained access and removal control rules in advanced ACL usage. The last section describes the ACL settings for a specified user to access all resources, this setting does not necessarily meet the needs of practical applications. For example, a forum may have a special area where only fixed users are allowed to post. In this case, the issue of resource access control will be involved.

To allow or deny permissions for an operation on a specified resource for a specified user, you only need to use the second parameter of the allow () or deny () method. The second parameter of both methods indicates the corresponding resource type, which can be an instance, string, or array of the zend_acl_resource class.

Below is an example I have tested. The example is copied after the test. Assume that a Forum contains three regions: entertainment area, technical area, and management area, the following table lists the access rules of different users for each post:

User Role	Region	Browse	Post	Edit	Delete	Others	Inheritance relationship
Guest	Entertainment Area	Allow	Deny	Deny	Deny	Deny	None
	Technical Zone	Deny	Deny	Deny	Deny
	Management area	Deny	Deny	Deny	Deny
User	Entertainment Area	Allow	Allow	Allow	Deny	Deny	Inherit from guest
	Technical Zone	Allow	Allow	Allow	Deny
	Management area	Allow	Deny	Deny	Deny
Moder	Entertainment Area	Allow	Allow	Allow	Allow	Deny	Inherit from user
	Technical Zone	Allow	Allow	Allow	Allow
	Management area	Allow	Allow	Allow	Deny
Administrator	Entertainment Area	Allow	Allow	Allow	Allow	Allow	None
	Technical Zone
	Management area

Test code (written to the Controller Method ):

$ ACL = new zend_acl ();
// Create a resource
$ Resourelax = new zend_acl_resource ('relax '); // creates a resource for entertainment.
$ Resoutech = new zend_acl_resource ('tech '); // create resource Technology
$ Resouadmin = new zend_acl_resource ('admin'); // create Resource Management
$ ACL-> Add ($ resourelax); // Add the resource to the access control list
$ ACL-> Add ($ resoutech );
$ ACL-> Add ($ resouadmin );
$ Roleguest = new zend_acl_role ('guest '); // create a role guest
$ ACL-> addrole ($ roleguest); // Add the role guest to the access control list
$ ACL-> allow ($ roleguest, $ resourelax, 'view'); // Add the browsing permission for guest in the entertainment area
$ ACL-> addrole (New zend_acl_role ('user'), $ roleguest); // create a user and inherit the guest, add it to the user to access control list
$ ACL-> allow ('user', null, array ('view', 'create', 'edit ')); // Add the user role to all resources for browsing, posting, and editing.
$ ACL-> deny ('user', $ resouadmin, array ('create', 'edit'); // refuse to post or edit a user in the management area.
$ ACL-> addrole (New zend_acl_role ('moder'), 'user'); // create a Moder and inherit the user, add the Moder to the access control list
$ ACL-> allow ('moder', null, 'delete'); // allows the Moder to be deleted from all resources.
$ ACL-> deny ('moder', $ resouadmin, 'delete'); // rejects the Moder to delete the management resource content.
$ ACL-> addrole (New zend_acl_role ('admin'); // create an administrator role and add it to the access control list without any inheritance
$ ACL-> allow ('admin'); // allow all administrator permissions on all resources

$ ACL-> removedeny ($ roleguest, $ resoutech, 'view'); // remove the Guest user's permission to browse technical resources, that is, allow the Guest user to browse the technical zone.
$ ACL-> removeallow ('user', $ resoutech, 'edit'); // remove the edit permission of the user on the technology. The user has no edit permission on the technology zone.

If ($ ACL-> isallowed ($ roleguest, $ resourelax, 'view '));
{
Echo "guest has permission to browse the entertainment area! ";
}

You can also remove the control rules, that is, remove the role's permitted or prohibited permissions on the specified resource. In the above Code:

$ ACL-> removedeny ($ roleguest, $ resoutech, 'view'); // remove the Guest user's permission to browse technical resources, that is, allow the Guest user to browse the technical zone.
$ ACL-> removeallow ('user', $ resoutech, 'edit'); // remove the edit permission of the user on the technology. The user has no edit permission on the technology zone.

This is exactly what these two codes mean ~! It's easy to explain ~!