Diem - Securing Front application

gistfile1.php

The trick:

- overload sfBasicSecurityFilter->execute() method to check if $request->hasParameter('bypass_security')
and if this parameter is set to true
- overload dmUser actions executeSignin() and add request parameter bypass_security and set it to true



//apps/front/config/filters.yml
rendering:    ~

remember_me:  ~

dm_init:      ~

security:     
  class: dmBasicSecurityFilter

cache:        ~

execution:    ~


//apps/front/lib/dmBasicSecurityFilter.class.php
<?php
class dmBasicSecurityFilter extends sfBasicSecurityFilter
{
  /**
   * Executes this filter.
   *
   * @param sfFilterChain $filterChain A sfFilterChain instance
   */
  public function execute($filterChain)
  {
    // disable security on login and secure actions
    if (
      (sfConfig::get('sf_login_module') == $this->context->getModuleName()) && (sfConfig::get('sf_login_action') == $this->context->getActionName())
      ||
      (sfConfig::get('sf_secure_module') == $this->context->getModuleName()) && (sfConfig::get('sf_secure_action') == $this->context->getActionName())
      ||
      ($this->context->getRequest()->hasAttribute('bypass_security') && $this->context->getRequest()->getAttribute('bypass_security')) //THIS IS PART OF THE TRICK
    )
    {
      $filterChain->execute();

      return;
    }

    // NOTE: the nice thing about the Action class is that getCredential()
    //       is vague enough to describe any level of security and can be
    //       used to retrieve such data and should never have to be altered
    if (!$this->context->getUser()->isAuthenticated())
    {
      if (sfConfig::get('sf_logging_enabled'))
      {
        $this->context->getEventDispatcher()->notify(new sfEvent($this, 'application.log', array(sprintf('Action "%s/%s" requires authentication, forwarding to "%s/%s"', $this->context->getModuleName(), $this->context->getActionName(), sfConfig::get('sf_login_module'), sfConfig::get('sf_login_action')))));
      }
     
      // the user is not authenticated
      $this->forwardToLoginAction();
    }

    // the user is authenticated
    $credential = $this->getUserCredential();
    if (null !== $credential && !$this->context->getUser()->hasCredential($credential))
    { 
      if (sfConfig::get('sf_logging_enabled'))
      {
        $this->context->getEventDispatcher()->notify(new sfEvent($this, 'application.log', array(sprintf('Action "%s/%s" requires credentials "%s", forwarding to "%s/%s"', $this->context->getModuleName(), $this->context->getActionName(), sfYaml::dump($credential, 0), sfConfig::get('sf_secure_module'), sfConfig::get('sf_secure_action')))));
      }
    
      // the user doesn't have access
      $this->forwardToSecureAction();
    }

    // the user has access, continue
    $filterChain->execute();
  }
}

//apps/front/modules/dmUser/actions/actions.class.php
<?php
require_once dmOs::join(sfConfig::get('sf_lib_dir'), 'vendor/diem/dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php');

class dmUserActions extends basedmUserActions
{
  public function executeSignin(dmWebRequest $request)
  {
    $request->setParameter('dm_page', dmDb::table('DmPage')->fetchSignin());

    $this->getResponse()->setStatusCode(401);

    $request->setAttribute('bypass_security', true); // THIS IS PART OF THE TRICK
    
    $this->forward('dmFront', 'page');
  }
}