Introduction to the Joomla ACL system. Given at: - Joomla World Conference 2015, Bangalore, India - JoomlaDay UK 2016, London, United Kingdom

1. Joomla ACL
Sander Potjer - @sanderpotjer
www.sanderpotjer.com
Joomla World Conference 2015

6. - Enjoy contributing to Joomla

7. - Enjoy contributing to Joomla
- Joomla Agency: Perfect Web Team

8. - Enjoy contributing to Joomla
- Joomla Agency: Perfect Web Team
- Joomla Extension: ACL Manager

9. Sander Potjer
- Enjoy contributing to Joomla
- Joomla Agency: Perfect Web Team
- Joomla Extension: ACL Manager
- sander@sanderpotjer.nl
- Slides: sanderpotjer.com

10. Photo by: Mark Fischer
Joomla ACL

11. ACL?!?!
ACL = Access Control List

12. ACL?!?!
ACL = Access Control List
1) Visibility of content

13. ACL?!?!
ACL = Access Control List
1) Visibility of content
2) Actions on objects

15. Photo by: Chris Smith
Overview

16. user

17. user permissions

18. user permissionspermissions
Site Login
Admin Login
Offline Access
Super Admin / Configure
Access Admin. Interface
Create
Delete
Edit
Edit State
Edit Own

19. user permissions
group

20. user permissions
access level
group

21. user permissions
access level
group

22. user permissions
access level
group

23. user permissions
access level
group

24. user permissions
access level
group

25. user permissions
access level
group

26. user permissions
access level
role

27. user permissions
Site Login
Admin Login
Offline Access
Super Admin / Configure
Access Admin. Interface
Create
Delete
Edit
Edit State
Edit Own
access level
group

28. ACL levels
Photo by: Ian Sane

29. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions

30. Photo by: Andreas
Inheritance

31. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions

32. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions

33. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
not set
inherited
inherited
inherited

34. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
allowed
inherited
inherited
inherited

35. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
allowed
inherited
denied
locked

36. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
not set
allowed
inherited
inherited

37. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
not set
inherited
allowed
inherited

38. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
denied
allowed
locked
locked

39. Global Configuration permissions
Component permissions
Category / Module permissions
Article permissions
denied
allowed
locked
locked
CONFLICT

40. Photo by: Andreas
Inheritance #2

42. Photo by: Andreas
Inheritance #1 + #2

43. Inheriting example for ‘Create’
Level 1
Level 2
Level 3
Level 4

44. Inheriting example for ‘Create’
Level 1
Level 2
Level 3
Level 4

45. Why?
Photo by: jon jordan

46. Why not!
Photo by: Peter Reed

47. Usability
Photo by: Rick Dolishny

48. Don’t
make
me
think
Photo by: Alper Çuğun

49. Users want it!

50. Users want it!

51. Photo by: Mark Fischer
ACL Demo

52. Basic ACL
implementation
Photo by: Daniel Kulinski

54. Configure
To configure the access settings via the 'Options'
toolbar button
Access Administration Interface
To define which group is able to access/manage the
component
2 actions required

55. 4 steps
18 lines of code
couple minutes

56. Add actions
1

57. File: administrator/components/com_foobar/config.xml

58. Access check
2

59. File: administrator/components/com_foobar/foobar.php

60. ‘Options’
toolbar button
3

61. File: administrator/components/com_foobar/views/foobars/view.html.php

62. File: administrator/components/com_foobar/views/foobars/view.html.php

63. Add language
string
4

64. File: administrator/language/en-GB/en-GB.com_foobar.ini

65. Done!

66. Basic ACL support is
not optional, it is a
requirement for any
Joomla extension!

67. Advanced ACL
implementationPhoto by: Patrick Lauke

68. Database

70. Rules - JSON encoded
{"core.login.site":{"6":1,"2":1}

71. com_content.article.24
[extension].[section].[object id]
Action name format (database)

73. JTable

75. Access.xml

76. File: administrator/components/com_foobar/config.xml

77. File: administrator/components/com_content/access.xml

78. File: administrator/components/com_content/access.xml

79. File: administrator/components/com_content/access.xml

80. File: administrator/components/com_content/access.xml

81. File: administrator/components/com_content/access.xml

82. File: administrator/components/com_content/access.xml
Component permissions
Category / Module permissions
Article permissions

83. File: administrator/components/com_content/access.xml

84. Site Login: core.login.site
Admin Login: core.login.admin
Offline Access: core.login.offline
Super Admin / Configure: core.admin
Access Administration Interface: core.manager
Create: core.create
Delete: core.delete
Edit: core.edit
Edit State: core.edit.state
Edit Own: core.edit.own
Title vs Name

85. File: administrator/components/com_content/access.xml

86. File: administrator/components/com_content/access.xml
Component permissions
Category / Module permissions
Article permissions
allowed
inherited
inherited

88. Custom Actions

90. File: administrator/components/com_akeeba/access.xml

91. File: administrator/components/com_akeeba/access.xml

92. File: administrator/components/com_akeeba/access.xml

93. File: administrator/components/com_akeeba/access.xml

94. File: administrator/components/com_akeeba/access.xml

95. Action name format (xml)
akeeba.backup
[name extension].[name action]

96. Keep it structured

98. Interface

100. File: administrator/components/com_foobar/views/foobar/tmpl/edit.php

101. getActions helper

102. File: libraries/cms/helper/content.php

103. File: can be used anywhere

104. File: can be used anywhere

105. addToolbar

106. File: administrator/components/com_foobar/views/foobars/view.html.php

107. File: administrator/components/com_foobar/views/foobars/view.html.php

108. Photo by: Chris Smith
Overview?????

109. Action: Edit State
• Global configuration
– default permissions for each action and group
• Component options (permissions)
– can override the default permissions for a component
• Category
– can override the default permissions and component options
– applies to components with categories (Articles, Banners, etc...)
• Object
– can override all permissions above for an object
– only applies to articles in Joomla 1.6 core

110. Many permission screens....
• Global configuration
– default permissions for each action and group
• Component options (permissions)
– can override the default permissions for a component
• Category
– can override the default permissions and component options
– applies to components with categories (Articles, Banners, etc...)
• Object
– can override all permissions above for an object
– only applies to articles in Joomla 1.6 core

111. Many permission screens....
• Global configuration
– default permissions for each action and group
• Component options (permissions)
– can override the default permissions for a component
• Category
– can override the default permissions and component options
– applies to components with categories (Articles, Banners, etc...)
• Object
– can override all permissions above for an object
– only applies to articles in Joomla 1.6 core

112. Many permission screens....
• Global configuration
– default permissions for each action and group
• Component options (permissions)
– can override the default permissions for a component
• Category
– can override the default permissions and component options
– applies to components with categories (Articles, Banners, etc...)
• Object
– can override all permissions above for an object
– only applies to articles in Joomla 1.6 core

113. Many permission screens....
• Global configuration
– default permissions for each action and group
• Component options (permissions)
– can override the default permissions for a component
• Category
– can override the default permissions and component options
– applies to components with categories (Articles, Banners, etc...)
• Object
– can override all permissions above for an object
– only applies to articles in Joomla 1.6 core

114. Idea?!

115. Action: Edit State
• Global configuration
– default permissions for each action and group
• Component options (permissions)
– can override the default permissions for a component
• Category
– can override the default permissions and component options
– applies to components with categories (Articles, Banners, etc...)
• Object
– can override all permissions above for an object
– only applies to articles in Joomla 1.6 core
ACL Manager for Joomla! 1.6

121. ACL Manager for Joomla! 1.6
• USA group
– Allow on edit ‘USA’ category
– Deny on edit ‘Europe’ category
• Europe group
– Allow on edit ‘Europe’ category
– Deny on edit ‘USA’ category
• User in USA & Europe group
– Deny on edit ‘Europe’ category
– Deny on edit ‘USA’ category
– Deny always win
www.aclmanager.net

122. Resources
Photo by: Schub@

123. Is your extension really Joomla 1.7 ready?
http://www.aclmanager.net/news/general/28-is-your-extension-really-joomla-17-ready
How to add basic ACL support to your extension
http://www.aclmanager.net/news/general/31-how-to-add-basic-acl-support-to-your-
extension
Developing a MVC Component/Adding ACL
http://docs.joomla.org/J2.5:Developing_a_MVC_Component/Adding_ACL
Adding ACL rules to your component
http://docs.joomla.org/Adding_ACL_rules_to_your_component
Access Control List Tutorial
http://docs.joomla.org/J2.5:Access_Control_List_Tutorial
Support for ACL permissions per module in com_modules
https://github.com/joomla/joomla-cms/pull/1930/files
JHelperContent::getActions() improvements
https://github.com/joomla/joomla-cms/pull/2728
This presentation
http://slideshare.net/sanderpotjer/