Restrict front-end component access

Question

I'm developing a Joomla component and would like admins to have the option to restrict access to a particular view in the front-end.

If a create a menu item for this view, then try and access it via the menu, the user login page appears. All good.

However, I can still go directly to that view by typing in the full URL (index.php?option=com_mycomponent&view=myRestrictedView)

I realise that I need to put some code in the controller to check the current user object against a permissions left, but I'm not sure where to start. I've looked at the Developing an MVC Component tutorial, but that focuses on the back end.

TLDR - What authorisation code do I need in my controller.php to check if the user is authorised for this view, and where can I 'set' this authorisation level (config.xml field type accesslevel?)

I think the simplest way is an accesslevel field in my config.xml and a call to JUser::getAuthorisedViewLevels but that seems a bit hacky...

Answer 1

First place to start is with Joomla, if Joomla does it then you can read the code to see how it's been implemented. The current ACL model was introduced way back in the start of the 2.5 line (aka 1.6)

Joomla breaks down it's ACL functionality into "viewing" and "doing", what you're asking about is viewing.

In com_content you can see that the Article view checks the view access in the view class file ContentViewArticle with the following criteria:

    // Check the view access to the article (the model has already computed the values).
    if ($item->params->get('access-view') == false && ($item->params->get('show_noauth', '0') == '0'))
    {
        JError::raiseWarning(403, JText::_('JERROR_ALERTNOAUTHOR'));
        return;
    }

You'll note the comment that "the model has already computed the values", in this case the model is ContentModelArticle found in /components/com_content/models/article.php. Towards the end of the getItem() method you will find:

// Compute view access permissions.
if ($access = $this->getState('filter.access'))
{
    // If the access filter has been set, we already know this user can view.
    $data->params->set('access-view', true);
}
else
{
    // If no access filter is set, the layout takes some responsibility for display of limited information.
    $user = JFactory::getUser();
    $groups = $user->getAuthorisedViewLevels();

    if ($data->catid == 0 || $data->category_access === null)
    {
        $data->params->set('access-view', in_array($data->access, $groups));
    }
    else
    {
        $data->params->set('access-view', in_array($data->access, $groups) && in_array($data->category_access, $groups));
    }
}

Of course, depending on your extension you may have other requirements you need to check against in addition to Joomla's ACL. There's also the very reasonable expectation you want to control what users are "doing".

To get a better idea of the ACL the recommended reading is probably "Access Control List" and "J25: Access Control List Tutorial" on Joomla's Doc's website.

Answer 2

@Craig answer is very good, but JERROR will deprecate in Joomla 4.0. You can use the code below instead, when wou want to notify the UI.

\Joomla\CMS\Factory::getApplication()->enqueueMessage($msg, 'warning')

Answer 3

I would use http://component-creator.com/, ACL for front-end views is built in on all generated components.