| Subject: | Catalyst::Manual::Tutorial::Authorization (ACL Rules Error) |
I found this out accidentily. It is easily overlooked and may cause
people trouble later.
The section "Add ACL Rules to the Application Class" contains the following:
__PACKAGE__->deny_access_unless(
"/books/delete",
[qw/user admin/],
);
and describes it as such:
"allows both users and admins to delete books"
however, the Catalyst::Plugin::Authorization::ACL docs say this:
"if allow_access_if is used, the presence of all the roles will
immediately permit access, and if deny_access_unless is used the lack of
any of the roles will immediately deny access."
Which would mean the third rule should be written as this:
__PACKAGE__->deny_access_unless(
"/books/delete",
[qw/user/],
);
assuming any admins will also have regular user privs, this would be the
proper way to allow users and admins to use books/delete. Otherwise,
users won't be allowed this action because they don't satisfy both role
requirements.