CakeDC Blog

TIPS, INSIGHTS AND THE LATEST FROM THE EXPERTS BEHIND CAKEPHP

CakeDC Users Plugin for CakePHP 3 - Update 3.1.5

Welcome to our updated tutorial covering the new CakeDC Users Plugin for CakePHP 3. In this tutorial we'll setup and configure the Plugin, introducing some of the available features.

Note this is the updated tutorial for the latest version of the plugin 3.1.5.

We'll assume you are starting a new CakePHP 3.2.x application, with some existing tables (blog site maybe?).

Setup

Easy thing, let's use composer to install the CakeDC Users Plugin

        composer require cakedc/users

Now ensure the Plugin is loaded from your bootstrap.php file

        Plugin::load('CakeDC/Users', ['routes' => true, 'bootstrap' => true]);

Create some tables to store the users in your database

        bin/cake migrations migrate -p CakeDC/Users

This migration will create 2 tables into your database, "users" where the users and credentials are stored, and "social_accounts" where the tokens for the social login feature will be stored and managed.

Now you can register a new user (ensure your CakePHP is able to send emails to get your validation link correctly), or you could use the provided shell to create new users from the command line

        bin/cake users addSuperuser

output for the shell command to generate new superuser

This new super user will be granted full administrative permissions (check the src/Auth/SuperuserAuthorize class for more details and configuration)

Configuration

Load the Component in your src/Controller/AppController.php

    public function initialize()
    {
        parent::initialize();
        //
        // ...
        //
        $this->loadComponent('CakeDC/Users.UsersAuth');
    }

login page output

Now you have the Plugin installed and a brand new superuser granted with full permissions, it's time to configure permissions for the rest of the roles you'll need.

Simple role based permission rules

By default, the CakeDC Users Plugin allow users to register, and all new users are assigned role = 'user' by default. Note you can change the default role name assigned to new users, but we'll keep the 'user' role for now. Let's assume you have some controller with a couple actions you want to allow, for example "/posts/view/*" We are going to configure SimpleRBAC to allow the role = 'user' accessing the 'view' action:

Create a new file "config/permissions.php" with the following contents

    return [
        'Users.SimpleRbac.permissions' => [
            [
                'role' => 'user',
                'controller' => 'Posts',
                'action' => ['view'],
            ],
        ]
    ];
    

Now you've defined your first permission rule, allowing users with role = 'user' to access the /posts/view action, note you can use wildcards '*', and arrays to cofigure your rules.

Cool, so now you have users in your application, allowing new users to register, validate their emails, login, change password, and use cookies to remember login. In our next short tutorial we'll cover Facebook login and Twitter login.

Ownership

What about ownership? We are talking about posts, and possibly you'll need to allow the post author to edit his own post, the good news: this is super easy with CakeDC Users Plugin.

We'll assume you have a user_id column in your posts table to support the association Posts belongsTo Users. Add a new rule to allow only the owner of a given post to edit it. Update your permissions.php file, adding this rule:

    use Cake\ORM\TableRegistry;
    use CakeDC\Users\Auth\Rules\Owner;    

    return [
        'Users.SimpleRbac.permissions' => [
            [
                'role' => 'user',
                'controller' => 'Posts',
                'action' => ['view'],
            ],
            [
                'role' => 'user',
                'controller' => 'Posts',
                'action' => ['edit', 'delete'],
                'allowed' => new Owner(),
            ],
        ]
    ];
    

And we're done, you've configured ownership permissions for your ['edit', 'delete'] actions.

Check other examples in the CakeDC Users Plugin Docs

Read more about CakeDC Users Plugin

Giving back to the community

This Plugin's development has been sponsored by the Cake Development Corporation. Contact us if you are interested in:

We'll continue working on our open source plugins (like this one) to give back to the amazing CakePHP Community!

 

Latest articles

Responsive Websites vs. Native Apps

Do you know what the difference is between responsive websites vs. native apps? With users more and more likely to be browsing your website on their mobiles, have you considered how they see and experience it across devices? A bad mobile experience may be likely to turn potential customers away, so it’s vital to ensuring that all touchpoints match your brand experience and draw customers in. But how do you go about that - what is the best solution for you - responsive website or a native app? Below we look at the differences between the two, however, the best solution for you will be highly dependent on your website and business/consumer needs, be sure to speak with your development team to get the best fit for you! Responsive vs native Responsive Web Design is the methodology that recommends the design and implementation of a website that responds to user behavior and environment based on the screen size, orientation and operating system of their device. While a native/mobile app, once the app has been downloaded, it’s stored directly on their device, so they will be able to access it in every context. Native apps can be used both online and offline. These two mobile solutions do not answer the same needs. In today’s world, all websites should be responsive to mobile devices, but not everyone needs a mobile app. Mobile or native app’s are expensive and time consuming to produce, they also can irritate users who do not see value in downloading them. However, should your product work well or need an app to work well in, you should investigate it. Generally the development time and cost of a native app can make this look like a poor option, however, if your product or need is one of the following, an app is definitely the way to go.

  • interactivity /Gaming is required: an App is the best choice if you require an immersive and interactive user experience.
  • Regular usage and personalization: Are you planning that your users use the app on a regular basis?
  • Complex calculations or reporting: Think banking or financial calculators.
  • Offline accessibility: Is your concept something that you want users to be able to use offline?
A key point to take into consideration when deciding what is the best fit for your business concept, is to keep your goals in  mind. If your goal is purely from a marketing and content distribution consideration, to ensure usability on mobile platforms, then a responsive website is what you need. However, if you are requiring a more immersive brand experience, a native app is required.

Importance of backing up data for small businesses - tips and tricks for you

Data is essential to any business - regardless of the size. And with the recent ransomware attacks, it is important to keep backups regularly. A loss of your business’s data, from a down server or a ransomware attack, can cost a company a lot of money. Types of backups You can either back up online to an out of network cloud server, to a physical storage location or to an offline drive. Either should have you secured from a network attack and will enable you to be up and running after-the-fact. Having a backup strategy cannot be stressed enough, here are some strategies that you could follow:

  1. Cloud backups - keeping data offsite is helpful should you experience a natural disaster.
  2. Encryption of data in transit.
  3. Multiple backups offsite - ensuring 2 or 3 backups are kept.
  4. Testing of backups - ensuring that all backups taken are viable for use should the need arise.
Regular backups can be a life saver - ransomware attacks, natural disasters, corrupt hardware can strike at any moment. Being prepared can save your business money in the long run. Some other tips that you can consider following include
  • Having a file organization standard. Develop a standard way of organizing your files so that you or your users will always know where data belongs.
  • Determine critical files or data. Organize and sort through the files to ensure critical data or files are kept secure and regularly backed-up.
  • Create a local backup solution.
  • Create an offsite backup.
  • Automate your backup procedures.
How do you get started? Its key to create a backup routine, which includes the following information
  • A checklist for the file or data that you need to backup;
  • A backup schedule for times that your backup system will run;
  • Verify the backup to ensure the data is intact.
Also remember, for your website and hosted applications, to check with your local hosting provider as they usually offer backups. For local development work, always use a repository for code and documents, like git, while for binaries, use cloud storage so all you lose, if your hard drive was to crash, is the work of the current day.

With the latest ransomware attack, here’s what you need to know

With the latest attack, Petya, fresh in our minds, we thought it would be a good time to discuss what exactly a ransomware attack is and how you, as a business, can protect yourselves from such. These cybersecurity attacks not only attack individuals and small to medium sized business, but also large multinational enterprises from around the world. What is clear is that the attack from the past week, Petya/GoldenEye while similar, is a lot more serious than the attack of the previous month - the WannaCry worm attack that struck hundreds of thousands of computers.   Have we gotten your attention? Good! The first real way to protect yourself, and your business, is to know what the attacks are and what they look like. And then to move onto how to set yourself up so that you are secured against such an attack. With the latest ransomware worm, the ransomware infects computers and locks down their hard drives. Then demanding $300 ransom in digital currency Bitcoin.
The email account associated with the ransomware will have been blocked, so even if victims pay, they won't get their files back. Many experts are calling for people to not pay the ransom. The virus or worm is spread by infecting multiple computers on a network, and is initially contracted via an outside source, commonly an email. Many companies were hit severely this time round, as they did not update their Microsoft packages, leaving them vulnerable to the attack.  Am I at risk you may be asking yourself? Well potentially. The great news is that if you have a Windows machine, and it is up to date with security updates, then you are fine. The bad news is that if you are on a network with a machine that is not up to date, then this will cause a problem for you should they get the virus. Top tips for keeping you and your network secure:

  1. Keep all servers and network connections up to date with the latest security updates;
  2. Be sure to backup your computer regularly and keeping a recent backup copy off-site.
  3. Brief all network users on what phishing emails look like, the importance of not on links;
  4. Make sure your antivirus software is up to date.

We Bake with CakePHP