[Flow] Content security

[Andreas Förthner]

Hi Peter,

unfortunately content security is not working yet in all use-cases. I've already worked a bit on it to fully support doctrine, however the topic is really complex and not finished yet. My plan is to work on it again on our next flow/neos code sprint in september, but I cannot promise to fully finish it there even though I hope so, of course. If you need this feature really urgent I can only offer you to work on it on a paid basis, as I won't have the time to do it for free before the code sprint.

Greets Andi

Von: Peter Beernink <p.beernink at drecomm.nl<mailto:p.beernink at drecomm.nl>>
Organisation: TYPO3 Association
Antworten an: TYPO3 Flow mailing list <flow at lists.typo3.org<mailto:flow at lists.typo3.org>>
Datum: Donnerstag, 15. August 2013 08:31
An: "flow at lists.typo3.org<mailto:flow at lists.typo3.org>" <flow at lists.typo3.org<mailto:flow at lists.typo3.org>>
Betreff: [Flow] Content security

Hi,

I'm currently working on a project which requires users to have access
to certain persisted items.
This entity can be public, meaning all users can access the item, or it
can be private.
When such an item is private, whether or not the user has access to it
depends on whether or not is has an involvement on the item.
For this I've setup an model Involvement which has a manyToOne relation
to the item in question and a manyToOne relation to the account object.

Now I'm struggling with how to setup the security configuration for this.
Checking for the private / public option is not a problem, that I can
resolve with 'this.private = TRUE' and add a GRANT or DENY for it.
However I'm not sure on how to extend it to use the relationships.
I was hoping for something like 'this = involvement.object &&
current.securityContext.account = involvement.account' but that doesn't
seem to work.
I've also tried the fully qualified class name, but when looking in the
compiled constraint this only keeps in the first part of the namespace.

Does anyone have an idea on how to make such a setup work?

Peter

Andreas Förthner
Leiter Web-Entwicklung

Telefon: +49 (911) 539909 - 0
E-Mail: andreas.foerthner at netlogix.de
Website: media.netlogix.de<http://media.netlogix.de>

--
netlogix GmbH & Co. KG
IT-Services | IT-Training | Media
Neuwieder Straße 10 | 90411 Nürnberg
Telefon: +49 (911) 539909 - 0 | Fax: +49 (911) 539909 - 99
E-Mail: info at netlogix.de<mailto:info at netlogix.de> | Internet: www.netlogix.de<http://www.netlogix.de/>

netlogix GmbH & Co. KG ist eingetragen am Amtsgericht Nürnberg (HRA 13338)
Persönlich haftende Gesellschafterin: netlogix Verwaltungs GmbH (HRB 20634)
Umsatzsteuer-Identifikationsnummer: DE 233472254
Geschäftsführer: Stefan Buchta, Matthias Schmidt

_______________________________________________
Flow mailing list
Flow at lists.typo3.org<mailto:Flow at lists.typo3.org>
http://lists.typo3.org/cgi-bin/mailman/listinfo/flow