CKFinder 2.x/Developers Guide/ColdFusion/Configuration/Access Control - Revision history

J.swiderski at 15:03, 7 March 2013

2013-03-07T15:03:59Z

J.swiderski at 15:00, 7 March 2013

2013-03-07T15:00:01Z

Anna: roleSessionVar var replaced

2011-03-31T09:40:40Z

roleSessionVar var replaced

Anna: Article content moved to a template

2011-03-31T09:15:51Z

Article content moved to a template

Anna: ACL section replaced with templates

2011-03-31T08:39:55Z

ACL section replaced with templates

Wiktor: Created page with 'TOC Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.cfm file gives permission to e…'

2010-05-14T19:22:40Z

Created page with '__TOC__ Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.cfm file gives permission to e…'

New page

__TOC__

Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.cfm file gives permission to every user and permits all the options. In order to change this configuration you must firstly know the basic of the '''config.accessControl''' structure placed in the config.cfm file. 

=== The syntax of the ACL Items ===
<pre>config.accessControl[1] = structNew();
config.accessControl[1].role = '*';
config.accessControl[1].resourceType = '*';
config.accessControl[1].folder = '/';

config.accessControl[1].folderView = true;
config.accessControl[1].folderCreate = true;
config.accessControl[1].folderRename = true;
config.accessControl[1].folderDelete = true;

config.accessControl[1].fileView = true;
config.accessControl[1].fileUpload = true;
config.accessControl[1].fileRename = true;
config.accessControl[1].fileDelete = true;</pre>
{{ckfinder_acl_explanation}}

==== Example 1 ====

If you want to restrict the upload, rename or delete of files in the "Logos" folder of the resource type "Images":
<pre>
config.accessControl[2] = structNew();
config.accessControl[2].role = '*';
config.accessControl[2].resourceType = 'Images';
config.accessControl[2].folder = '/Logos';

config.accessControl[2].folderView = true;
config.accessControl[2].folderCreate = true;
config.accessControl[2].folderRename = true;
config.accessControl[2].folderDelete = true;

config.accessControl[2].fileView = true;
config.accessControl[2].fileUpload = false;
config.accessControl[2].fileRename = false;
config.accessControl[2].fileDelete = false;
</pre>
The above example only refers to file operations in the folder '/Logos' itself. It doesn't restrict operations on the folder so the user can delete or rename the folder. In order to limit users ability to modify the folder (not its contents) you should change permissions in the parent folder.

==== Example 2 ====
<pre>config.accessControl[3] = structNew();
config.accessControl[3].role = '*';
config.accessControl[3].resourceType = 'Images';
config.accessControl[3].folder = '/';

config.accessControl[3].folderView = true;
config.accessControl[3].folderCreate = true;
config.accessControl[3].folderRename = false;
config.accessControl[3].folderDelete = false;

config.accessControl[3].fileView = true;
config.accessControl[3].fileUpload = true;
config.accessControl[3].fileRename = true;
config.accessControl[3].fileDelete = true;
</pre>
Now a user can view and create a folder, but he will be unable to rename or delete it. <br>

=== Sessions ===

The roleSessionVar is a session variable name that CKFinder must use to retrieve the "role" of the current user.
<pre>config.roleSessionVar = 'CKFinder_UserRole';
</pre>
To switch between different user roles, simply change the session variable:<br>
<pre><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#newrole#">
</CFLOCK>
</pre>
{{CKFinder_2.x Sessions|lang=ColdFusion}}
==== Example3 ====

In your config.cfm file you create three different roles: First role, '''every user''' (wildcard "*" is used):
<pre>config.accessControl[1] = structNew();
config.accessControl[1].role = '*';
config.accessControl[1].resourceType = '*';
config.accessControl[1].folder = '/';
config.accessControl[1].folderView = true;
config.accessControl[1].folderCreate = false;
config.accessControl[1].folderRename = false;
config.accessControl[1].folderDelete = false;
config.accessControl[1].fileView = true;
config.accessControl[1].fileUpload = false;
config.accessControl[1].fileRename = false;
config.accessControl[1].fileDelete = false;</pre>
Second role, '''registered''' user:
<pre>config.accessControl[2] = structNew();
config.accessControl[2].role = 'registered';
config.accessControl[2].resourceType = '*';
config.accessControl[2].folder = '/';
config.accessControl[2].folderView = true;
config.accessControl[2].folderCreate = true;
config.accessControl[2].folderRename = false;
config.accessControl[2].folderDelete = false;
config.accessControl[2].fileView = true;
config.accessControl[2].fileUpload = true;
config.accessControl[2].fileRename = false;
config.accessControl[2].fileDelete = false;</pre>
Third role, '''admin''':
<pre>config.accessControl[3] = structNew();
config.accessControl[3].role = 'admin';
config.accessControl[3].resourceType = '*';
config.accessControl[3].folder = '/';
config.accessControl[3].folderView = true;
config.accessControl[3].folderCreate = true;
config.accessControl[3].folderRename = true;
config.accessControl[3].folderDelete = true;
config.accessControl[3].fileView = true;
config.accessControl[3].fileUpload = true;
config.accessControl[3].fileRename = true;
config.accessControl[3].fileDelete = true;</pre>
You've created three different users permissions. The default user (guest) is allowed to browse all files and folders. Registered user has also the ability to upload files and create folders. The administrator has full permissions.

Now let's say you have an authentication mechanism somewhere in your web application. In this file, you assign one of the pre-defined roles to the user:
<pre><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#admin#">
</CFLOCK>
</pre>
if you want to use the admin role.
<pre><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#registered#">
</CFLOCK>
</pre>
if you want to use the role assigned to registered users.
<pre><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#guest#">
</CFLOCK>
</pre>
''guest'' doesn't have assigned any specific permissions, so the default values are used (defined with "*")
<pre><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#any_other_value#">
</CFLOCK>
</pre>
same situation, default values are used.

@@ Line 51: / Line 51: @@
 config.accessControl[3].fileRename = true;
 config.accessControl[3].fileDelete = true;
-</source>|wildcard_resource=config.accessControl[1].resourceType = '*'}}
+</source>|wildcard_resource=(config.accessControl[1].resourceType = '*')}}
 {{CKFinder_2.x Sessions|lang=ColdFusion|roleSessionVar=roleSessionVar|file=<code>config.cfm</code>|code1=<source lang="cfm">config.roleSessionVar = 'CKFinder_UserRole';</source>|code2=

@@ Line 51: / Line 51: @@
 config.accessControl[3].fileRename = true;
 config.accessControl[3].fileDelete = true;
-</source>}}
+</source>|wildcard_resource=config.accessControl[1].resourceType = '*'}}
 {{CKFinder_2.x Sessions|lang=ColdFusion|roleSessionVar=roleSessionVar|file=<code>config.cfm</code>|code1=<source lang="cfm">config.roleSessionVar = 'CKFinder_UserRole';</source>|code2=

@@ Line 53: / Line 53: @@
 </source>}}
-{{CKFinder_2.x Sessions|lang=ColdFusion|file=<code>config.cfm</code>|code1=<source lang="cfm">config.roleSessionVar = 'CKFinder_UserRole';</source>|code2=
+{{CKFinder_2.x Sessions|lang=ColdFusion|roleSessionVar=roleSessionVar|file=<code>config.cfm</code>|code1=<source lang="cfm">config.roleSessionVar = 'CKFinder_UserRole';</source>|code2=
 <source lang="cfm"><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
 <CFSET session.CKFinder_UserRole="#newrole#">

@@ Line 53: / Line 53: @@
 </source>}}
-=== Sessions ===
+{{CKFinder_2.x Sessions|lang=ColdFusion|file=<code>config.cfm</code>|code1=<source lang="cfm">config.roleSessionVar = 'CKFinder_UserRole';</source>|code2=
+<source lang="cfm"><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
-The roleSessionVar is a session variable name that CKFinder must use to retrieve the "role" of the current user.
+<CFSET session.CKFinder_UserRole="#newrole#">
-<pre>config.roleSessionVar = 'CKFinder_UserRole';
+</CFLOCK></source>|code3=
-</pre>
+<source lang="cfm">config.accessControl[1] = structNew();
 config.accessControl[1].role = '*';
 config.accessControl[1].resourceType = '*';
@@ Line 78: / Line 68: @@
 config.accessControl[1].fileUpload = false;
 config.accessControl[1].fileRename = false;
-config.accessControl[1].fileDelete = false;</pre>
+config.accessControl[1].fileDelete = false;</source>|code4=
-Second role, '''registered''' user:
+<source lang="cfm">config.accessControl[2] = structNew();
 config.accessControl[2].role = 'registered';
 config.accessControl[2].resourceType = '*';
@@ Line 91: / Line 80: @@
 config.accessControl[2].fileUpload = true;
 config.accessControl[2].fileRename = false;
-config.accessControl[2].fileDelete = false;</pre>
+config.accessControl[2].fileDelete = false;</source>|code5=
-Third role, '''admin''':
+<source lang="cfm">config.accessControl[3] = structNew();
 config.accessControl[3].role = 'admin';
 config.accessControl[3].resourceType = '*';
@@ Line 104: / Line 92: @@
 config.accessControl[3].fileUpload = true;
 config.accessControl[3].fileRename = true;
-config.accessControl[3].fileDelete = true;</pre>
+config.accessControl[3].fileDelete = true;</source>}} In this file, you assign one of the pre-defined roles to the user &mdash; using the admin role:
-You've created three different users permissions. The default user (guest) is allowed to browse all files and folders. Registered user has also the ability to upload files and create folders. The administrator has full permissions.
+{{CKFinder_2.x Sessions_Details|code1=
+<source lang="cfm"><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
-Now let's say you have an authentication mechanism somewhere in your web application. In this file, you assign one of the pre-defined roles to the user:
+<CFSET session.CKFinder_UserRole="#admin#">
-<pre>&lt;CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive"&gt;
+</CFLOCK></source>|code2=
-&lt;CFSET session.CKFinder_UserRole="#admin#"&gt;
+<source lang="cfm"><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
-&lt;/CFLOCK&gt;
+<CFSET session.CKFinder_UserRole="#registered#">
-</pre>
+</CFLOCK></source>|code3=
-if you want to use the admin role.
+<source lang="cfm"><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
-<pre>&lt;CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive"&gt;
+<CFSET session.CKFinder_UserRole="#guest#">
-&lt;CFSET session.CKFinder_UserRole="#registered#"&gt;
+</CFLOCK></source>|code4=
-&lt;/CFLOCK&gt;
+<source lang="cfm"><CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
-</pre>
+<CFSET session.CKFinder_UserRole="#any_other_value#">
-if you want to use the role assigned to registered users.
+</CFLOCK></source>}}

@@ Line 1: / Line 1: @@
-__TOC__
+{{Ckfinder_2.x_Access_Control_Description|file=<code>config.cfm</code>|AccessControl=config.accessControl}}
-Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.cfm file gives permission to every user and permits all the options. In order to change this configuration you must firstly know the basic of the '''config.accessControl''' structure placed in the config.cfm file.&nbsp;
+<source lang="cfm">
 config.accessControl[1] = structNew();
 config.accessControl[1].role = '*';
 config.accessControl[1].resourceType = '*';
@@ Line 17: / Line 15: @@
 config.accessControl[1].fileUpload = true;
 config.accessControl[1].fileRename = true;
-config.accessControl[1].fileDelete = true;</pre>
+config.accessControl[1].fileDelete = true;
 {{ckfinder_acl_explanation}}
-==== Example 1 ====
+{{Ckfinder_2.x_ACL_Examples|example1=
+<source lang="cfm">
 config.accessControl[2] = structNew();
 config.accessControl[2].role = '*';
@@ Line 38: / Line 36: @@
 config.accessControl[2].fileRename = false;
 config.accessControl[2].fileDelete = false;
-</pre>
+</source>|example2=
-The above example only refers to file operations in the folder '/Logos' itself. It doesn't restrict operations on the folder so the user can delete or rename the folder. In order to limit users ability to modify the folder (not its contents) you should change permissions in the parent folder.
+<source lang="cfm">config.accessControl[3] = structNew();
 config.accessControl[3].role = '*';
 config.accessControl[3].resourceType = 'Images';
@@ Line 56: / Line 51: @@
 config.accessControl[3].fileRename = true;
 config.accessControl[3].fileDelete = true;
-</pre>
+</source>}}
 === Sessions ===