问题
As soon as I set sonata_admin.security.handler
to sonata.admin.security.handler.acl
the only user who has access is the one with ROLE_SUPER_ADMIN.
I think I configured everything right, obviously not.
I tried:
- to give the user the real role
ROLE_VIP_CONTACT_ADMIN
instead of assigning by a fos_group, no success. - all options for
security.access_decision_manager.strategy
: affirmative, consensus and unanimous - to delete all acl tables, acl:init, sonata:admin:setup-acl, with and without sonata:admin:generate-object-acl and cleared the cache every time.
With no success.
# Acme\MyBundle\Controller\CRUDController.php
$securityContext->getAdminPermissions();
# -> ["CREATE", "LIST", "DELETE", "UNDELETE", "EXPORT", "OPERATOR", "MASTER"]
dump($this->admin->getSecurityInformation());
/* -> array:3 [▼
"GUEST" => array:2 [▼
0 => "VIEW"
1 => "LIST"
]
"STAFF" => array:3 [▼
0 => "EDIT"
1 => "LIST"
2 => "CREATE"
]
"ADMIN" => array:3 [▼
0 => "MASTER"
1 => "OPERATOR"
2 => "EXPORT"
]
] */
dump($this->getUser()->getRoles());
/* -> array:15 [▼
0 => "ROLE_ADMIN"
1 => "ROLE_VIP_CONTACT_GUEST"
2 => "ROLE_VIP_CONTACT_STAFF"
3 => "ROLE_VIP_CONTACT_ADMIN" # <--- I gave him everything!
[...]
9 => "ROLE_ALLOWED_TO_SWITCH"
[...]
16 => "ROLE_USER"
] */
Now I open my browser and go to app_dev.php/my-path-to/vip/contact/list
, resulting in an AccessDeniedException.
/edit: It's the same problem as here ACL + SonataAdminBundle + SonataUserBundle.
回答1:
On Symphony >3.1 you should use this:
services:
security.acl.permission.map:
class: Sonata\AdminBundle\Security\Acl\Permission\AdminPermissionMap
instead
parameters: security.acl.permission.map.class: Sonata\AdminBundle\Security\Acl\Permission\AdminPermissionMap
回答2:
After hours of debugging, the result is to let ACL know about the LIST
permission by using Sonata's AdminPermissionMap.
See SonataAdminBundle 5. Security and Documentation » Admin (Ctrl+F: security.acl.permission.map.class)
parameters:
security.acl.permission.map.class: Sonata\AdminBundle\Security\Acl\Permission\AdminPermissionMap
You might already know this.
To make a long story short: Configuration is not only done by writing some config files, but also to import the right ones.
来源:https://stackoverflow.com/questions/40462980/aclvoter-denies-access-to-list