I would like to know what the correct, or recommended, or most common place is to check for expired session, authorization, ACL rights?

In short: do I check

!$session->isActive() 

In the controller display method or in view display or should I check in both?

what about the

$user->authorise('example.canDo','com_example')

EDIT: Additional example

I my view.html I include checks like this. (Why? because some examples had them) and I'm starting to get tired of doing this all the time.

if (!$user->authorise('myCom.myAdmin', 'com_myCom') || !$session->isActive()) {
  $app->redirect('/index.php?option=com_users&view=login&return=' .  
  urlencode(base64_encode($this->currPageUrl)));
}
up vote 3 down vote accepted

Session and ACL are two separate concepts, even though they are coupled, so it good to understand the distinction between them. I also assimilate the term permissions with ACL.

Session

Since you are using Joomla as your backbone, the platform is doing the heavy-lifting when it comes to session handling and authentication. The chances that you will need to interact with the session is rather slim (there are use cases, but not expired session). So, a simple answer is: Joomla handles the session for you. You don't have to do a thing.

What happens is that if you require (via ACL) a registered user to perform an action and somehow the session expired, you don't need to to extra checks.

ACL

ACL itself can be used in various ways, so there is no simple answer. Here are some basic ideas though.

  • If you want to do a plain check to see if the user is even allowed to access a component, the component main file (for com_example, example.php) would be the place to do it.
  • The more complex are your permissions, you will use them in controllers, views, templates (with a preference to this order, when possible).
  • thanks for the quick reply @Valentin Despa. I added an example into the original question. If I understand you correctly, I don't really need this? at least not the session part. – Andreas Dec 3 '14 at 19:59
  • No, you don't need the session part. Also consider redirecting from the controller. Anyway, DO test your app, debug, understand what is happening being the scenes. – Valentin Despa Dec 4 '14 at 6:31
  • Redirect in controller, will do, Thanx – Andreas Dec 5 '14 at 19:01

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.