eZContentObject::checkAccess strangeness

Tuesday 23 November 2010 11:16:32 pm

Hi all

I'm working on some code that needs to identify if a particular user has edit access to a eZContentObject and have been running some tests using eZContentObject::checkAccess.

I found some strange code at the end of this method that modifies the result after the polices have been checked:

if ( $access == 'denied' )
{
    if ( $functionName == 'edit' )
    {
     // Check if we have 'create' access under the main parent
         if ( $this->attribute( 'current_version' ) == 1 && !$this->attribute( 'status' ) )
        {
             $mainNode = eZNodeAssignment::fetchForObject($this->attribute( 'id' ), $this->attribute( 'current_version' ) );
             $parentObj = $mainNode[0]->attribute('parent_contentobject' );
             $result = $parentObj->checkAccess( 'create',$this->attribute( 'contentclass_id' ),
                                                $parentObj->attribute( 'contentclass_id' ), false, $originalLanguage );
              if ( $result )              {
                 $access = 'allowed';
             }
              return $result;
         }
    }
}

This is my interpretation:

If a user doesn't have edit access to the object and the current version = 1 and the object has a status of draft then
If the user can create an object of the same type under the same node then user can edit that object.

Can anyone let me know why/if this code is required?

Cheers
Bruce

P.S. It would also be great if the method could take a additional parameter $user that defaulted to false. The method could check if it was a eZUser type and use it or get the current user if not. This would make is a lot more flexible :)

My Blog: http://www.stuffandcontent.com/
Follow me on twitter: http://twitter.com/brucemorrison
Consolidated eZ Publish Feed : http://friendfeed.com/rooms/ez-publish

Wednesday 24 November 2010 3:40:13 pm

Hi Nicolas

Thanks for the input. The issue is that you can get a false positive from this code. If you have 2 policies

1. Create Article
2. Edit Article if you are owner

and there is an article, version 1 and in draft mode. Then checking if the user can edit will return true even in the user is not the owner of the object. (Policy 1 overrides 2)

This isn't an issue with the normal operation of eZ as editing via the admin interface uses eZContentObjectVersion::checkAccess which checks status & ownership before the policies.

The issue I have is that you can't rely on eZContentObject::checkAccess or eZContentObject::canEdit to determine if a user can edit an object.

It seems this is a "hack" to get around having to have both a create & edit policy to allow object creation. (i.e. create = create + edit version 1).

I can't decide if this is a feature or a bug. Given the situation where the false positive can occur I'm starting to think this is a bug. Any one else want to weigh in?

Cheers
Bruce

My Blog: http://www.stuffandcontent.com/
Follow me on twitter: http://twitter.com/brucemorrison
Consolidated eZ Publish Feed : http://friendfeed.com/rooms/ez-publish