Hi all!

I'm rewriting the security system of my project, and I extended the support of my secure controls to all standard controls of Lazarus, including TForm and TFrame classes.

The default behavior of all controls is if the user is not allowed to interact with it, the control is disabled, otherwise it's enabled.

But with TForm, I have two ways of allow/Deny:

** Enable/disable whole form (done).
** Allow show if user is allowed to show the form, or hide/close if the user log out of the system or not authorized to view the form.

My problem is: What's the best TForm method to override to abort form show via TForm.Show and TForm.ShowModal calls?

What you probably should do is create a function to show a form of any class for you, and put that security check in that one place.

Example:

function ShowForm(FormClass: TFormClass; Modal: Boolean = False): Boolean;
begin
  // your global function to check if a user can access a form class
  Result := UserSecurityCheck(FormClass);
  if Result then
    // make sure FormClass close action is caFree
    with FormClass.Create(Application) do
      if Modal then
        Result := ShowModal = mrOk
      else
        Show;
end;
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus-ide.org/pipermail/lazarus/attachments/20170215/dfe976a5/attachment.html>

I don't know if the solution that I implemented last night is the best one. I did the following:

//FIsEnabledBySecurity: the user can access the control? this variable is
changed via another call, when user login or logout, checking the
authorizations of the logged user.
//FAllowUnauthorizedShowForm: value of a property that sets if not allowed
users can show the form or not.
procedure TpSCADASecureForm.SetVisible(Value: boolean); override;
begin
  FIsPSCADAFormVisible:=Value;
  inherited SetVisible(FIsPSCADAFormVisible and (FIsEnabledBySecurity or
FAllowUnauthorizedShowForm));
end;

this do the job very well, showing and hiding the form across user login/logout changes, even if I call

TsomePSCADAFormInstance = class(TpSCADASecureForm);
somePSCADAFormInstance:TsomePSCADAFormInstance;
somePSCADAFormInstance.Visible := true;
somePSCADAFormInstance.Show;

but when I call

somePSCADAFormInstance.ShowModal;

I got a Exception that says that somePSCADAFormInstance is not enabled (that is true, because I have a access try of a not allowed user), but this exception is not the real cause of the problem, that is access of a not allowed user or a not logged user.

My solution at this point is override the ShowModal:

//FSecurityCode is a property with a string that describes the permission
that you will give or not for each user
//GetPascalSCADAControlSecurityManager: class instance that manages the
control interaction with users and their permissions, 44
//Each control that supports the interface ISecureControlInterface, should
register/unregister with this manager, to be notified about user
changes/permission changes.
function TpSCADASecureForm.ShowModal: Integer; override;
begin
  if GetPascalSCADAControlSecurityManager.CanAccess(FSecurityCode)=false
then
    raise ESecuritySystemAccessDenied.Create(FSecurityCode);
  Result:=inherited ShowModal;
end;

What is your opinion?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus-ide.org/pipermail/lazarus/attachments/20170215/f59b20ab/attachment.html>