Question

I’m just wondering if there’s a quick/efficient way to do this in Cake rather than write the code logic myself (though it would not be difficult, it could be just a bit unclean).

Suppose you have a normal users table, then a posts table. Each user can have many posts and the user_id in posts links to the id in users.

The tutorial shows for editting a record as such:

function edit($id = null) {
    $this->Post->id = $id;
    if (empty($this->data)) {
        $this->data = $this->Post->read();
    } else {
        if ($this->Post->save($this->data)) {
            $this->Session->setFlash('Your post has been updated.');
            $this->redirect(array('action' => 'index'));
        }
    }
}

What is the best way to check that, effectively, user.id=post.user_id without doing an if check, then redirecting away. I effectively want to “bind”/”restrict” the page so that the $id passed to edit() is one such that they created the book (or, at least, are the current ‘owner’) in the posts table.

More concisely, my question is: what’s the cake version of:

$this->Post->read();
if ($this->Post->data['Post']['user_id'] != $my_current_user_id){
    // Redirect
}

(pseudo-code but I hope it gives the idea). I have trawled through the documentation but I can’t seem to see this (to me, it would just ‘make sense’ that it exists given how awesome the rest of the libraries are in what they do for you with minimal work).

Answer 1

Not really, no. You will always have to do record-level access checks explicitly, since they’re a lot more freeform than, say, Auth controller method permissions. Even using ACL, which is pretty automagic, you need to at least call the ACL access check. I usually do this:

public function edit($id) {
    $post = $this->Post->find('first', array('conditions' => array('Post.user_id' => $this->Auth->user('id'), 'Post.id' => $id));
    if (!$post) {
        $this->cakeError('error403');
    }

    if ($this->data) {
        ...
    } else {
        $this->data = $post;
    }
}