fnakstad / angular-client-side-auth

One way to implement authentication/authorization in Angular applications
http://angular-client-side-auth.herokuapp.com/
MIT License
1.63k stars 346 forks source link

Prevent state access when toState.data == undefined #85

Closed Jakobovski closed 9 years ago

Jakobovski commented 10 years ago

An error is thrown in app.js on line 142 when toState.data is undefined.

Something like this would solve the problem:

if(!("data.access" in toState)){
    $rootScope.error = "Access undefined for this state";
    event.preventDefault();
}
else if (!Auth.authorize(toState.data.access)) {
    $rootScope.error = "Seems like you tried accessing a route you don't have access to...";
    event.preventDefault();

    if(fromState.url === '^') {
        if(Auth.isLoggedIn()) {
            $state.go('user.home');
        } else {
            $rootScope.error = null;
            $state.go('anon.login');
        }
    }
}

With approval I would be happy to make the changes and create a merge request.

fnakstad commented 9 years ago

Awesome! Thanks for taking the time to create a fix :) If you send me a pull request I'll accept it right away.

Jakobovski commented 9 years ago

Pull request created see https://github.com/fnakstad/angular-client-side-auth/pull/89

fnakstad commented 9 years ago

I just merged it. Thanks for taking the time to submit a PR :)

bremme commented 9 years ago

I just cloned the repro and no matter what I try I get the: "Oh no! Acces undefined for this state" error. I haven't fully mastered the code yet, so I can't give an explanation of the possible cause. But when I looked at the live demo (http://angular-client-side-auth.herokuapp.com/) I noticed that the following piece:

        if(!("data.access" in toState)){
            $rootScope.error = "Access undefined for this state";
            event.preventDefault();
        }

was missing from the app.js. When I removed this piece I was able to fiddle around with the page.

Probably not related, but another thing that I noticed when running the server:

body-parser deprecated urlencoded: explicitly specify "extended: true" for extended parsing server.js:19:20

screenshot from 2014-09-09 17 46 13

Jakobovski commented 9 years ago

@bremme see https://github.com/fnakstad/angular-client-side-auth/pull/95