Question

symfony 1.4 passing variables between templates and actions

I’ve got an index page which includes a call to a series of partials through a switch statement; and it works. I now need to restrict access to the partial dependent upon the user’s type; furthermore, I believe my switch statement should be in the actions class according to MVC, but I can’t get that to work either. This might be better explained through example:

Here’s my file structure for the dashboard module:

..dashboard
    ..actions
    ..config
    ..templates
        _admins.php
        _employers.php
        _employees.php
        _guest.php
        indexSuccess.php

Here is my current indexSuccess template (which currently works… but without restricting access if the logged user’s type doesn’t match the page type):

$type = sfContext::getInstance()->getUser()->getGuardUser()->getProfile()->getType()->getName();
switch($type)
{
case ('Employer'): 
    include_partial('dashboard/employers');
    $page_user_type = "employer";  //this example line currently does not exist, it's for example purpose below
    $break;
case ('Employee'):
    include_partial('dashboard/employees');
    break;
case ('Administrator'):
    include_partial('dashboard/admins');
    break;
default: include_partial('dashboard/guest');
    break;
}

Here’s my actions class (currently empty):

public function executeIndex(sfWebRequest $request)
{

}

Basically, what I need is the switch statement moved to the action (I think), and a forward404Unless() method added that does the following:

$logged_user = sfContext::getInstance()->getUser()->getGuardUser()->getId(); 
$this->forward404Unless($logged_user == $page_user_type);   //where the $page_user_type variable is retrieved by the switch statement in the example line above.  

I’ve tried using the getAttribute() and setAttribute() with no success… and I’d rather not share attempts due to embarrassment. Just a beginner here…

Any help would be appreciated. Thanks in advance.

UPDATE:

Here’s more information about the switch and the different partials:

The switch renders a different partial based upon the user’s type. What it doesn’t do is keep other logged-in users of a different type from accessing all the other partials… which in my design, is very bad. For example: logged-in users of type “employer” may not view the partial of type “employee”. Currently they can (by explicitly typing in the other url), even though they are being redirected to the appropriate page during the the index action.

The 404 page should be called when a user of the wrong type tries to access the other partial by explicitly typing in the url. That’s why I was attempting to add a variable to the switch statment when the appropriate partial is called and then passing that variable to the index action which would then evaluate it and either permit the partial to be rendered, or if the user_type and partial_type did not match -> forward to a 404 page. Make sense? I hope I explained that thouroughly enough. I’m sure there is an easier way… I’m just not schooled enough to know what that might be.

I sure do appreciate your response and attempt to resolve my issue.

Answer 1

You should play with the credential system to block not authorized user to access a ressource.
The ‘type’ of your user can become the name of a credential. Then you just have to create the security.yml to handle that.