tmaiaroto/li3_access — Issue #21: Usage of Auth::check in AuthRbac makes signup forms log in user
Author: mariano
Created: 2012-02-27 13:00:02+00:00
State: open

Ok consider this scenario:

1. You build a signup form where you allow users to specify email and password:

```php

Signup

form->create(isset($user) ? $user : null); ?>
form->field('email'); ?>
form->field('password', array('type' => 'password')); ?>
form->field('name'); ?>
form->submit('Signup'); ?>
form->end(); ?>
```

2. You configure Auth so `fields` is `array('email', 'password'), and set it to use the `Form` adapter:

```php
Auth::config(array('default' => array(
'adapter' => 'Form',
'model' => 'app\models\User',
'fields' => array('email', 'password')
)));
```

3. You add an `AuthRbac` rule so that the signup form is only accessible by non-logged-in users (this step is not really necessary to make the point this ticket is making, but just for illustration purposes):

```php
Access::config(array('default' => array(
array(
'requesters' => '*',
'match' => 'Users::signup',
'allow' => function() {
return !Auth::check('default');
}
)
)));
```

Now access the signup form, and enter an existing email & password into the corresponding fields. If you have proper validation in place, you'd get your validation fields (because of duplicated email). However, you may notice that you are now logged in.

This is because in `AuthRbac::_getRolesByAuth()`, when calling `Auth::check()` the actual request object is being passed on to `Auth`. When you pass the request object to `Auth`, then the `Form` adapter can check for the submitted fields and look for a valid record, thus logging you in right from a signup form. We obviously don't want that.

A way to avoid this is to "emptying" the data array from the `Request` before doing the access check. So when filtering `Dispatcher::_callable` you can do:

```php
$_data = $params['request']->data;
$params['request']->data = array();
$access = Access::check('default', null, $params);
$params['request']->data = $_data;
```

But obviously this is not so clean. I could easily make a pull request to avoid passing the `Request` instance to `Auth::check()` from the `AuthRbac` adapter, but I wanted to double check with you before doing so, because you may have had a purpose for passing it which I might be missing.

Also, is there any reason why the `$requester` argument to `AuthRbac::check()` is not being used?