Permissions filter doesn't capture ajax requests

[Elvis254]

PHP Version

8.2.0

CodeIgniter4 Version

4.4.5

Shield Version

1.0.1

Which operating systems have you tested for this bug?

Windows

Which server did you use?

apache

Database

MariaDB 10.2

Did you customize Shield?

I customized the UserModel class to include a function to generate a full name of a user from their first and last name before insert and before update. I also customized the User entity class to include two functions to set the first and last name of a user after cleaning the string input and performing formatting on it like capitalization.

What happened?

I made an ajax request on a route protected by a permission expecting to get a 403 Forbidden response because the user I was testing the route on doesn't have the permission. The response should be JSON in nature but it sends the page a user is redirected to if they don't have the permission.

Steps to Reproduce

Edit the permission filter to capture ajax requests and instead of redirecting to the page specified in Auth config, it sends a JSON formatted 403 Forbidden response.

Expected Output

A JSON formatted 403 Forbidden response.

Anything else?

No response

[kenjis]

The filter is designed to redirect. If you need a different behavior, create your own filter.

Another possibility is to extend the filter to return a response without redirecting in the case of Ajax requests.

In any case, the current behavior is not a bug.

[Elvis254]

Hi,
I have written a magic login filter. Where a user should set a new password after login. Here is the filter:

namespace App\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

class MagicLoginFilter implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
        if (auth()->loggedIn()) {
            if (session('magicLogin')) {
                return redirect()->route('users/set/password');
            }
            return;
        }
        return;
    }

    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) {}

}

And here is the config:

public array $globals = [
        'before' => [
            'magic-login' => [
                'except' => [
                    'login*',
                    'auth/a/*'
                ],
            ],
        ],
    ];

Its not working it's giving out an error that localhost redirected you too many times. If I understand this one then I should be able to edit or extend the other one.

[kenjis]

The users/set/password is a route name?

return redirect()->route('users/set/password');

See https://codeigniter4.github.io/CodeIgniter4/outgoing/response.html#redirect-to-a-uri-path

[Elvis254]

Sorry I have inserted this line session()->removeTempdata('magicLogin'); in the code and it now works.

<?php

namespace App\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

class MagicLoginFilter implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
        if (auth()->loggedIn()) {
            if (session('magicLogin')) {
                session()->removeTempdata('magicLogin');
                return redirect()->route('users/set/password');
            }

            return;
        }

        return;
    }

    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) {}
}

Let me work on the other one I will update you accordingly.

[Elvis254]

I have edited the AbstractAuthFilter to make it capture ajax requests by adding a simple control statement on it. Here is the full code, it perfectly works.

namespace CodeIgniter\Shield\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RedirectResponse;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

/**
 * Group Authorization Filter.
 */
abstract class AbstractAuthFilter implements FilterInterface
{
    /**
     * Ensures the user is logged in and a member of one or
     * more groups as specified in the filter.
     *
     * @param array|null $arguments
     *
     * @return RedirectResponse|void
     */
    public function before(RequestInterface $request, $arguments = null)
    {
        if (empty($arguments)) {
            return;
        }

        if (! auth()->loggedIn()) {
            if ($request->isAJAX()) {
                return service('response')
                        ->setStatusCode(ResponseInterface::HTTP_UNAUTHORIZED)
                        ->setJson(['message' => lang('Auth.notLoggedIn')]);
            }

            // Set the entrance url to redirect a user after successful login
            if (uri_string() !== route_to('login')) {
                $session = session();
                $session->setTempdata('beforeLoginUrl', current_url(), 300);
            }

            return redirect()->route('login');
        }

        if ($this->isAuthorized($arguments)) {
            return;
        }

        if ($request->isAJAX()) {
            return service('response')
                    ->setStatusCode(ResponseInterface::HTTP_FORBIDDEN)
                    ->setJson(['message' => lang('Auth.notEnoughPrivilege')]);
        }

        return $this->redirectToDeniedUrl();
    }

    /**
     * We don't have anything to do here.
     *
     * @param array|null $arguments
     */
    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null): void
    {
        // Nothing required
    }

    /**
     * Ensures the user is logged in and has one or more
     * of the permissions as specified in the filter.
     */
    abstract protected function isAuthorized(array $arguments): bool;

    /**
     * Returns redirect response when the user does not have access authorizations.
     */
    abstract protected function redirectToDeniedUrl(): RedirectResponse;
}