Own Module - Integrate ACL Check (in Ajax Call)

Question

I'm currently programming a module that contains several Ajax calls, some of them with Add / update & Delete requests in the DB. Now I am thinking about the fact that it will be necessary to check the ACL state in the functions called via Ajax in addition to the frontend check (not visible if not in the right group). Unfortunately I can't find an example how to realize this. It is supposed to be that the admin should be able to give user groups the possibility to make changes via Frontend GUI or to prevent them via the modules permissions.

But I can imagine that a simple "hide" of the options in the frontend is not enough if the function is slumbering in the background and can be called without any check by AJAX...

I've already passed the module title into the AJAX call and now I failed because the permissions don't seem to be available via

JModuleHelper::getModule('mod_modulename', $moduleTitle);

to the $module... the $user object is available via

Factory::getUser();

and waits to be compared with the information according to the ACL settings of the module instance...

So, how do I get to the permission settings of the module instance to check if the user who made the ajax call is allowed to do so?

Answer 1

Yes you do need to check the permissions in your Ajax-handling code.

The way you would do this would be to follow the pattern in the Joomla MVC FormController, where it uses the Joomla User authorise method, eg, to check if a user can create an article:

$user = Factory::getUser();
$user->authorise('core.create', 'com_content');  

authorise() returns true or false, depending upon whether the user may perform the operation or not.

Your first parameter to authorise() is the type of action you want to check eg 'core.create' for creating, 'core.delete' for deleting, etc.

The second parameter is the asset you want to check against, and Joomla will check up the asset hierarchy from the lowest level. So for example delete permission may be set at an individual article level so you should check

$user->authorise('core.delete', 'com_content.article.' . $id);  

where $id is the id of the article.

You mention about checking against the module permissions, and you can of course do

$user->authorise('core.delete', 'com_modules.module.' . $id);  

where $id is the id of your module. But that would be checking that the user has permission to delete your module, and I'm not sure that's what you really want to check. If you're talking about operations in the database then you want to check the permissions by passing the Joomla component which 'owns' that database table.

You also may want to check that the user is allowed to 'read' your module, by comparing the Access of the module with the list of access levels that the user may see, which is returned by getAuthorisedViewLevels().

There's good ACL tutorial information available at https://docs.joomla.org/J3.x:Access_Control_List_Tutorial and in this video (between 2 mins and 32 mins is the section to watch).