Latest revision as of 16:03, 7 March 2013

Access Control List (ACL) is a method to grant your users different permissions for working with CKFinder folders and files. The default settings placed in the config.cfm file grant full permissions for all options to every user.

In order to change this configuration option you should learn the basics of the config.accessControl settings placed in the configuration file.

Access Control List Syntax

The syntax of the ACL entries is as follows:

config.accessControl[1] = structNew();
config.accessControl[1].role = '*';
config.accessControl[1].resourceType = '*';
config.accessControl[1].folder = '/';

config.accessControl[1].folderView = true;
config.accessControl[1].folderCreate = true;
config.accessControl[1].folderRename = true;
config.accessControl[1].folderDelete = true;

config.accessControl[1].fileView = true;
config.accessControl[1].fileUpload = true;
config.accessControl[1].fileRename = true;
config.accessControl[1].fileDelete = true;

Access Control List entries are defined using the following values:

• role – this attribute sets the type of the user. By default it is set to * which can be treated as "everybody". You may set this parameter to other name like user or limited_functions. The name of the user type will be directly related to the functions the user can make use of.

• resourceType – this setting defines the resources handled in CKFinder. A resource type is nothing more than a way to group files under different paths, each having different configuration settings (like Images, Flash, Files). By default it is set to * which means that all resources are available.

• folder – this setting determines where the restrictions will be used. By declaring a folder name you specify the place you want to put your restrictions on. By default it is set to /, so no folder is set.

• folder* and file* options – these variables are of Boolean type and can be set to true or false. The true setting enables an option, false disables it.

• It is possible to define numerous ACL entries. All attributes are optional. Subfolders inherit their default settings from their parents' definitions.

Access Control List Examples

Have a look at the following examples that present various permission configurations in order to learn more about using Access Control Lists in CKFinder.

Example 1

If you want to restrict the upload, renaming, or deletion of files in the Logos folder of the resource type Images, use the following ACL settings.

config.accessControl[2] = structNew();
config.accessControl[2].role = '*';
config.accessControl[2].resourceType = 'Images';
config.accessControl[2].folder = '/Logos';

config.accessControl[2].folderView = true;
config.accessControl[2].folderCreate = true;
config.accessControl[2].folderRename = true;
config.accessControl[2].folderDelete = true;

config.accessControl[2].fileView = true;
config.accessControl[2].fileUpload = false;
config.accessControl[2].fileRename = false;
config.accessControl[2].fileDelete = false;

This example only refers to file operations in the /Logos folder. It does not restrict operations on the folder, so the user can delete or rename it. In order to limit users' ability to modify the folder itself (not its contents), you should change permissions in the parent folder.

Example 2

The following settings restrict folder operations for the Images resource type.

config.accessControl[3] = structNew();
config.accessControl[3].role = '*';
config.accessControl[3].resourceType = 'Images';
config.accessControl[3].folder = '/';

config.accessControl[3].folderView = true;
config.accessControl[3].folderCreate = true;
config.accessControl[3].folderRename = false;
config.accessControl[3].folderDelete = false;

config.accessControl[3].fileView = true;
config.accessControl[3].fileUpload = true;
config.accessControl[3].fileRename = true;
config.accessControl[3].fileDelete = true;

Now a user can view and create a folder, but he will be unable to rename or delete it.

Explaining Folder Path for Example 1

In the first example above the /Logos path was used in ACL definition. It is rather obvious that this is not an absolute path to folder on the server.

Let us assume that the absolute path on server to the application folder is /sites/example.com/ and the path to userfiles folder is /sites/example.com/userfiles/.There is also "Images" resource type which in this case points to /sites/example.com/userfiles/images/.

Knowing the above let's define correct path for the Logos folder located in /sites/example.com/userfiles/images/Logos. The key is to define path relative to resource type (In this case resource type is "Images" pointing to /sites/example.com/userfiles/images/), thus the value that needs to be assigned to ACL folder property is /Logos/.

Please also note that:

• Folder path has to start from slash character.

• If you use a wildcard for resource type (config.accessControl[1].resourceType = '*'), CKFinder will look through all resource types and apply ACL to every folder that matches the rule, for example Files:/Logos, Flash:/Logos.

Sessions

The roleSessionVar is a session variable name that CKFinder must use to retrieve the role of the current user.

config.roleSessionVar = 'CKFinder_UserRole';

To switch between different user roles, change the session variable:

<CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#newrole#">
</CFLOCK>

For more information about using session variables refer to the Sessions article.

Example 3

In your config.cfm file you can create three different roles.

First role is assigned to every user (wildcard * is used):

config.accessControl[1] = structNew();
config.accessControl[1].role = '*';
config.accessControl[1].resourceType = '*';
config.accessControl[1].folder = '/';
config.accessControl[1].folderView = true;
config.accessControl[1].folderCreate = false;
config.accessControl[1].folderRename = false;
config.accessControl[1].folderDelete = false;
config.accessControl[1].fileView = true;
config.accessControl[1].fileUpload = false;
config.accessControl[1].fileRename = false;
config.accessControl[1].fileDelete = false;

Second role defines a registered user:

config.accessControl[2] = structNew();
config.accessControl[2].role = 'registered';
config.accessControl[2].resourceType = '*';
config.accessControl[2].folder = '/';
config.accessControl[2].folderView = true;
config.accessControl[2].folderCreate = true;
config.accessControl[2].folderRename = false;
config.accessControl[2].folderDelete = false;
config.accessControl[2].fileView = true;
config.accessControl[2].fileUpload = true;
config.accessControl[2].fileRename = false;
config.accessControl[2].fileDelete = false;

Third role defines the administrator:

config.accessControl[3] = structNew();
config.accessControl[3].role = 'admin';
config.accessControl[3].resourceType = '*';
config.accessControl[3].folder = '/';
config.accessControl[3].folderView = true;
config.accessControl[3].folderCreate = true;
config.accessControl[3].folderRename = true;
config.accessControl[3].folderDelete = true;
config.accessControl[3].fileView = true;
config.accessControl[3].fileUpload = true;
config.accessControl[3].fileRename = true;
config.accessControl[3].fileDelete = true;

With the above settings you have created three different user permission sets. The default user (everybody) is allowed to browse all files and folders. A registered user also has the ability to upload files and create folders. The administrator is granted full permissions.

Now suppose you have an authentication mechanism somewhere in your Web application. In this file, you assign one of the pre-defined roles to the user — using the admin role:

<CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#admin#">
</CFLOCK>

If you want to use the role assigned to registered users, use the following settings:

<CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#registered#">
</CFLOCK>

A guest does not have any specific permissions granted, so the default values, defined with the * wildcard), are used:

<CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#guest#">
</CFLOCK>

The same situation would happen here, where the default values would be used.

<CFLOCK TIMEOUT="30" NAME="#session.sessionID#" TYPE="Exclusive">
<CFSET session.CKFinder_UserRole="#any_other_value#">
</CFLOCK>