Khaos :: KhACL

[eluser]Neophyte[/eluser]
hey bardelot, adding $axo as an arg when calling khacl->query() from khacl->check() was a bug in the code.

khacl->query() just retrieves a full access array (this means it doesnt need to know the axo as it retrieves all of the AXO permissions assigned to the aro->aco relationship). its then upto khacl->check() to determine if the user should be allowed access or not as such your code will result in some odd behaviour under certain circumstances.

Just to clarify this ive restructured the check method to

Code:

function check($aro, $aco, $axo = null)
{
    $result = $this->query($aro, $aco);
        
    // ARO lacks any access - DENY
    if ($result['access'] == 'N')
        return false;
    
    if ($axo === null)
    {
        /*
         * No AXO specified and we know the ARO has access to the ACO
         * from the above check. - ALLOW
         */
            
           return true;            
    }
    else
    {
        /*
         * AXO specified and we know the ARO has access to the ACO so now we just
         * have to make sure the user also has access to the AXO.
         */
            
        if ((isset($result['extensions'][$axo])) && ($result['extensions'][$axo] == 'Y'))
            return true;  
        else // AXO is set to deny - DENY
            return false;        
    }
        
    // DENY    
    return false;    
}

hopefuly this makes it a bit clearer