Question

I am checking an ACL in the pre-dispatch method of an ACL Action Helper. If the action is-allowed, the controller/action should continue as per normal. (No problems there). If it’s NOT allowed, however, I would like to:

• leave the requsted URI in the browser
• skip executing the requested action method
• generate an ‘access denied’ message

At first I thought I would just call _forward() in the Action Helper, but I can’t since it’s a protected method. The View Renderer Action Helper says that gotoSimple is like _forward, however it still performs the full http redirect (and thus changes the URI in the browser).

I could try calling setScriptPath() on View, then Render(), however this would not prevent the requested controller/action from firing. I think there’s probably a straightforward answer to this, but it’s beyond my level of experience!

Any assistance appreciated!

Answer 1

This is most easily solved by simply throwing a Zend_Controller_Action_Exception, preferably with code 401 (Unauthorized).

This will be caught by the error handler plugin and forwarded to the Error controller.

You can then check for this error code and handle it appropriately. This is in my error controller

if ($errors->exception->getCode() == 401) {
    $this->getResponse()->setHttpResponseCode(401);
    return $this->_forward('unauthorized');
}

The “unauthorized” action just displays a view but you could do more with it (log an error for example)