// remove all the actions.
$this->Auth->deny();
// remove a group of actions.
$this->Auth->deny(’add’, ’edit’);
$this->Auth->deny(array(’add’, ’edit’));
You can provide as many action names as you need to deny(). You can also supply an array containing all
the action names.
Mapping actions when using CrudAuthorize When using CrudAuthorize or any other authorize objects
that use action mappings, it might be necessary to map additional methods. You can map actions -> CRUD
permissions using mapAction(). Calling this on AuthComponent will delegate to all the of the configured
authorize objects, so you can be sure the settings were applied every where:
$this->Auth->mapActions(array(
’create’ => array(’register’),
’view’ => array(’show’, ’display’)
));
The keys for mapActions should be the CRUD permissions you want to set, while the values should be an
array of all the actions that are mapped to the CRUD permission.
Using ControllerAuthorize ControllerAuthorize allows you to handle authorization checks in a controller
callback. This is ideal when you have very simple authorization, or you need to use a combination of models
+ components to do your authorization, and don’t want to create a custom authorize object.
The callback is always called isAuthorized() and it should return a boolean as to whether or not the
user is allowed to access resources in the request. The callback is passed the active user, so it can be checked:
class AppController extends Controller {
public $components = array(
’Auth’ => array(’authorize’ => ’Controller’),
);
public function isAuthorized($user = null) {
// Any registered user can access public functions
if (empty($this->request->params[’admin’])) {
return true;
}
// Only admins can access admin functions
if (isset($this->request->params[’admin’])) {
return (bool)($user[’role’] === ’admin’);
}
// Default deny
return false;
}
}