{"action":"closed","issue":{"url":"https://api.github.com/repos/emreakay/CodeIgniter-Aauth/issues/51","labels_url":"https://api.github.com/repos/emreakay/CodeIgniter-Aauth/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/emreakay/CodeIgniter-Aauth/issues/51/comments","events_url":"https://api.github.com/repos/emreakay/CodeIgniter-Aauth/issues/51/events","html_url":"https://github.com/emreakay/CodeIgniter-Aauth/issues/51","id":92838788,"number":51,"title":"is_allowed() bug","user":{"login":"neilsf","id":5172851,"avatar_url":"https://avatars.githubusercontent.com/u/5172851?v=3","gravatar_id":"","url":"https://api.github.com/users/neilsf","html_url":"https://github.com/neilsf","followers_url":"https://api.github.com/users/neilsf/followers","following_url":"https://api.github.com/users/neilsf/following{/other_user}","gists_url":"https://api.github.com/users/neilsf/gists{/gist_id}","starred_url":"https://api.github.com/users/neilsf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neilsf/subscriptions","organizations_url":"https://api.github.com/users/neilsf/orgs","repos_url":"https://api.github.com/users/neilsf/repos","events_url":"https://api.github.com/users/neilsf/events{/privacy}","received_events_url":"https://api.github.com/users/neilsf/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-07-03T09:47:13Z","updated_at":"2015-10-07T21:04:09Z","closed_at":"2015-10-07T21:04:09Z","body":"Say you wanna find out if a user (other than the currently logged in user) has a permission. You call `is_allowed($perm_par, $user_id)`.\r\n\r\nThen `is_allowed()` does the following:\r\n\r\n- Checks for matching rows in `perm_to_user` table. If found, returns true.\r\n- If not found, it will call `is_group_allowed($perm_id)` to see if the user's groups have the perm, without the second parameter.\r\n\r\nBut `is_group_allowed($perm_id, false)` checks for *the currently logged in user's permission*, this is not the expected behaviour.\r\n\r\nI suggest to perform a different check arround line 1366:\r\n\r\n    if( $query->num_rows() > 0){\r\n        return TRUE;\r\n           } else {\r\n\t\t\t\r\n\t\t\tif( $user_id===FALSE){\r\n\t\t\t\treturn $this->is_group_allowed($perm_id);\r\n\t\t\t} else {\r\n\t\t\t\t$g_allowed=FALSE;\r\n\t\t\t\tforeach( $this->get_user_groups($user_id) as $key=>$group ){\r\n\t\t\t\t\tif ( $this->is_group_allowed($perm_id, $group->id) ){\r\n\t\t\t\t\t\t$g_allowed=TRUE;\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t\t\r\n\t\t\t\treturn $g_allowed;\r\n\t\t\t}\r\n\t\t}\r\n\r\n"}}