Access Control: an empty $allowed_actions does not disable "index"
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 90/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- php
- Domain
- documentation
Research direction
Start with en/02_Developer_Guides/02_Controllers/03_Access_Control.md at line 73, then compare the wording with RequestHandler::checkAccessAction() and the ControllerTest assertion mentioned in the issue. Done means the documentation accurately explains index access with an empty allowed_actions array and the explicit restrictions that prevent it.
Written by the indexing model from the issue text.
Description
The Controllers "Access Control" page says (branches 5 and 6, en/02_Developer_Guides/02_Controllers/03_Access_Control.md, line 73):
An action named "index" is allowed by default, unless
allowed_actionsis defined as an empty array, or the action is specifically restricted.
Unless I'm misreading it, the framework does not behave that way. RequestHandler::checkAccessAction() allows index whenever it is not explicitly listed (if (!$isDefined && ($action == 'index' || empty($action))), framework 5 line 498, framework 6 line 505), and ControllerTest asserts exactly this: "Access granted on index with empty $allowed_actions on defining controller".
So with private static $allowed_actions = []; the index action is still reachable. Perhaps the sentence could say that index stays allowed unless it is restricted explicitly (for example 'index' => 'ADMIN' or 'index' => false)? Happy to open a PR if that wording is right.
- Dominant language
- No language data
- Stars
- 7
- Forks
- 74
- Avg merge
- 1d 14m
- Merged PRs (30d)
- 6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from silverstripe/developer-docs
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
silverstripe/developer-docs#911 ·
-
Read-only replicas: config key is rule_patterns_must_use_primary_db, not must_use_primary_db_rules Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
silverstripe/developer-docs#909 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
silverstripe/developer-docs#908 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
silverstripe/developer-docs#903 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
silverstripe/developer-docs#897 ·
All issues in silverstripe/developer-docs
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
user-reported
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Kong/developer.konghq.com#7316 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
infinispan/infinispan#18150 ·