ACL inheritance is broken in 1.2.X

[alexzaporozhets]

After update from version 1.1 ACL inheritance stop to work properly.

[niden]

@alexzaporozhets Could you please provide more information i.e. example of the code you are running or even better create a pull request with a failing test?

Thanks!

[alexzaporozhets]

It is about http://forum.phalconphp.com/discussion/103/acl-roles-inheritance

[alexzaporozhets]

Any news about the issue? We cannot update to 1.2 because of it.

[ghost]

Problem with the inheritance chain:

$acl = new AclEngine();

$acl->setDefaultAction(Acl::DENY);

$acl->addRole('user');
$acl->addRole('admin', 'user');
$acl->addRole('developer', 'admin');

$acl->addResource('tickets', ['list', 'open', 'close']);

$acl->allow('user', 'tickets', 'open');

var_dump($acl->isAllowed('user', 'tickets', 'open')); // returns 1
var_dump($acl->isAllowed('admin', 'tickets', 'open')); // returns 1
var_dump($acl->isAllowed('developer', 'tickets', 'open')); // returns 0 (!)

PHP 5.5.1
Phalcon 1.2.1

[alexzaporozhets]

@niden any news about this bug?

[niden]

Not yet buddy it is a high priority we need to check @alexzaporozhets

Stay tuned we will address this as soon as possible.

[abaranoff]

I have same issue with inheritance in 1.2.3

[alexzaporozhets]

Any news?

[ghost]

@alexzaporozhets I am working on this but it may take some time as I am not familiar at with how ACL in Phalcon works.

[alexzaporozhets]

That is a good news, try to compare code with version 1.1

http://docs.phalconphp.com/en/latest/reference/acl.html

[ghost]

Fix submitted, but I need more test cases (ideally from real world applications) — looks like we have no unit tests for ACL at all :-(

[alexzaporozhets]

Hi, I can add a simple unit-test for ACL.
Should I fork Phalcon and send pull-request? What is procedure for contributing?

[ghost]

Ideally yes, just make sure to submit the pull request against 1.3.0 branch.

Or just paste the code here and I will turn it into the test myself.

[phalcon]

This is fixed in the 1.2.4/1.3.0 branch

[alexzaporozhets]

Hi, we tried to do update - the problem is remains

[ghost]

@alexzaporozhets There should be a file, ext/tests/issue-905.phpt. If you run

php issue-905.phpt

what do you see?

The expected result should look like this:

--TEST--
ACL inheritance is broken in 1.2.X - https://github.com/phalcon/cphalcon/issues/905
--SKIPIF--
--FILE--
int(1)
int(1)
int(1)
--EXPECT--
int(1)
int(1)
int(1)

[alexzaporozhets]

I cannot build 1.3.0:
/usr/include/php5/ext/pcre/php_pcre.h:29:18: fatal error: pcre.h: No such file or directory
compilation terminated.
make: *** [phalcon.lo] Error 1

1.2.4:

vagrant@timedoctor:~/cphalcon/build$ php aclTest.php
--TEST--
ACL inheritance is broken in 1.2.X - #905
--SKIPIF--
--FILE--
Phalon\Version 1.2.4 RC 1
int(1)
int(1)
Segmentation fault

[ghost]

For 1.3.0, could you please run

apt-get build-dep php5-dev

and try to recompile again?

1.2.4 — looking

[alexzaporozhets]

This line produces segmentation fault:
var_dump((int)$acl->isAllowed('developer', 'tickets', 'open'));

[alexzaporozhets]

vagrant@timedoctor:~/cphalcon$ php /home/vagrant/cphalcon/build/aclTest.php
--TEST--
ACL inheritance is broken in 1.2.X - #905
--SKIPIF--
--FILE--
Phalon\Version 1.3.0 BETA 1
int(1)
int(1)
int(0)
--EXPECT--
int(1)
int(1)
int(1)

[ghost]

1.3.0 - did you build it from ext/ or from build/?

[alexzaporozhets]

from build

[alexzaporozhets]

At first I executed: apt-get build-dep php5-dev and after that build was successful

[ghost]

Please build it from ext/

build/ was not updated.

[alexzaporozhets]

Build 1.2.4? or 1.3.0?

[ghost]

1.3.0.

1.3.0 build from ext/ should pass all tests.

[alexzaporozhets]

Ok, I will do it. Is it possible to fix 1.2.4?

[ghost]

Sure

[alexzaporozhets]

Can you give a time estimate for fix? We are waiting to do the update.

[ghost]

For 1.2.4:

diff --git a/ext/acl/adapter/memory.c b/ext/acl/adapter/memory.c
index aa41c91..01be425 100644
--- a/ext/acl/adapter/memory.c
+++ b/ext/acl/adapter/memory.c
@@ -725,14 +725,13 @@ static int phalcon_role_adapter_memory_check_inheritance(zval *role, zval *resou
                if (phalcon_array_isset(access_list, access_key)) {
                        phalcon_array_fetch(&have_access, access_list, access_key, PH_NOISY);
                        found = Z_TYPE_P(have_access) != IS_NULL;
+                       zval_ptr_dtor(&have_access);
+                       have_access = NULL;
                }
                else {
                        found = 0;
                }

-               zval_ptr_dtor(&have_access);
-               have_access = NULL;
-
                zval_dtor(access_key);
                ZVAL_NULL(access_key);

I will submit the pull request later, as I need to fix several other bugs.

[alexzaporozhets]

Hi, did you submit a pull request to 1.2.4 branch?

[ghost]

Yes

[alexzaporozhets]

We did a test update yesterday (1.2.4) the problem remains.

[ghost]

Same — what does

php issue-905.phpt

display?