1

Recently I am facing a challenge. I have a view and two layouts. Say the view name is form and the layouts are edit, edit-frame.

Now I want to render the edit-frame layout into an iframe. This is the situation and I can do it easily by using iframe src-

<iframe src="<?php echo Uri::root() . '/administrator/index.php?option=com_component&view=edit&layout=edit-frame'; ?>"

Now the problem is, I want to render the edit-frame layout into a site template from the administrator panel. So, the view and the layout situated into the administrator and one layout of the view needs to render with site template.

Note: I don't want to move the view into site component because the view only accessible to the logged in user.

1 Answer 1

1

If I understood your use case correctly, you can achieve this using a site component and implementing what is called accesslevel in Joomla. Access level is what the user "see" and permissions (acl/actions) are what the user can "do". In your case, as you don't want a non logged in user to "see" your view you have to add an "access" column in the database table of your resource let's say its the books table. it would be somthing like:

id | access | title | alias | isbn | cover

But to be complete, you should also add asset_id column to handle permissions in order to have a more fine grained control on your resources in my example books

id | asset_id | access | title | alias | isbn | cover


By adding those two special columns, joomla provides you "see" and "do" out of the box with almost no code to add.

The only thing is that now, where you want prevent some user to edit something, you can use the core.edit and/or core.edit.own default joomla actions in your frontend component

SIDE NOTE: You kinda named your view in a possibly conflicting way."edit" is quite common. Use a more descriptive view name.

Anyway here is the sample code for permissions in the view-model of joomla ideally it should be in the models only so you can prevent access site wide rather than just for this component. If any module or plugin access your code directly without the permissions in view.html.php that's kinda bad. So by moving permissions in the model you can control who has access to the resource you want to protect.

in your view.html.php

// before assigning any vars to the view
$currentJoomlaUser = \JFactory::getUser();

// not having the correct permissions stop here
if ((!$currentJoomlaUser->check('core.edit', 'com_component')) 
|| (!$currentJoomlaUser->check('core.edit.own','com_component')))
 {
throw new RuntimeExpection('You are not allowed to access this resource',403);
}


Here is the link to the official Joomla documentation for accesslevels and permissions to your componentAcl in your component

1
  • Is there something that wasn't clear enough? Dec 22, 2021 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.