Kohana Forums

Crawling around I found the unofficial wiki/documentation that I assume you all must know, at http://kerkness.ca/

Well, the thing is there were some tips to work with the Auth Module, about protecting the controllers... you can find it here:
http://kerkness.ca/wiki/doku.php?id=using_the_auth_module_in_your_controllers

When I was trying out into my controllers the following statement:

public $auth_required = array('login','admin');

My controller avoided me, if I wasn't an admin... I should be login and admin in order to login, when I wanted to be able to login, whether I was an admin or login.

The issue were in MODPATH/auth/classes/kohana/auth/orm.php

The logged_in function was the problem. It breaks the foreach in the array when you don't have any role listed in the array you pass it as a parameter.

You'll understand better if I show you some code

ORIGINAL logged_in FUNCTION:


public function logged_in($role = NULL)
{
$status = FALSE;

// Get the user from the session
$user = $this->get_user();

if (is_object($user) AND $user instanceof Model_User AND $user->loaded())
{
// Everything is okay so far
$status = TRUE;

if ( ! empty($role))
{
// Multiple roles to check
if (is_array($role))
{
// Check each role
foreach ($role as $_role)
{
if ( ! is_object($_role))
{
$_role = ORM::factory('role', array('name' => $_role));
}

// If the user doesn't have the role
if ( ! $user->has('roles', $_role))
{
$status = FALSE;
break;
}
}
}
// Single role to check
else
{
if ( ! is_object($role))
{
// Load the role
$role = ORM::factory('role', array('name' => $role));
}

// Check that the user has the given role
$status = $user->has('roles', $role);
}
}
}

return $status;
}


WITH MY MODIFICATIONS:


public function logged_in($role = NULL)
{
$status = FALSE;

// Get the user from the session
$user = $this->get_user();

if (is_object($user) AND $user instanceof Model_User AND $user->loaded())
{
// Everything is okay so far
$status = TRUE;

if ( ! empty($role))
{
// Multiple roles to check
if (is_array($role))
{
// THE PROBLEM BEGINS HERE, WE HAVE TO SAY THE STATUS IS FALSE
// REMEMBER, IT WILL ONLY HAPPEN WHEN WE'RE CHECKING THE ROLE. IT WON'T
// DISTURB IN CASE WE JUST WANT TO KNOW WHETER THE USER IS LOGGED IN OR NOT
$status = FALSE;

// Check each role
foreach ($role as $_role)
{
if ( ! is_object($_role))
{
$_role = ORM::factory('role', array('name' => $_role));
}

// If the user doesn't have the role
if ( ! $user->has('roles', $_role))
{
// IF WE DON'T GET THE ROLE, WE REMAIN $status AS FALSE
$status = FALSE;
//break;
}else{
// JUST WHEN WE FOUND ONE ADMITTED ROLE, WE SAY
// EVERYTHING IS OKAY, AND WE BREAK THE FOREACH
$status = TRUE;
break;
}
}
}
// Single role to check
else
{
if ( ! is_object($role))
{
// Load the role
$role = ORM::factory('role', array('name' => $role));
}

// Check that the user has the given role
$status = $user->has('roles', $role);
}
}
}

return $status;
}


as you can see, it was just a logic problem... we first have to set $status as FALSE, and in case we found one match in the array against the roles, well, we can guarantee the successful login...

that's all... hope you can take advantage of my little modification :)