Hey, I'm new to cake so i might be mistaken but i think we can solve this situation by keeping the acl system as is and having just 2 rules in the db.
So we can have 2 actions for the user controller: editProfile($profileID) - allows you to edit a generic profile AND editMyProfile() - allows to edit your own profile - basically the call of editProfile with your own profileID as parameter. In ACL, we declare 2 rules at controller action level (not per record). So: users might access the action editMyProfile and admins might access both actions. Further (per record) rules might be added without affecting this system. I haven't tested this and might be a break of cake's conventions but my logic tells me that this should do fine. What do you think? On Nov 8, 11:21 am, AD7six <[EMAIL PROTECTED]> wrote: > On Nov 8, 10:12 am, AD7six <[EMAIL PROTECTED]> wrote: > <snip> > PS. > if > the action to edit your own profile is coded to only act on the logged > in user and so the URL does not include an id (e.g. /my_account/ > edit_profile) > AND > Admin users have their own action to edit whatever profile they want > (e.g. /admin/profiles/edit/x) > Then > it removes entirely the complexity of the example. > > No help if the example was just and example of course :). Also note > that if you want to try and bulk find what a user has access to ($this- > > >Articles->findAllAllowed($userId)). You can't*. > > Cheers, > > AD > * Without doing individual acl checks for each item returned. Or with > some serious db work. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Cake PHP" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php?hl=en -~----------~----~----~----~------~----~------~--~---
