CakePHP: using Security::allowedControllers and Security::allowedActions

I'm trying to use Security::allowedControllers and Security::allowedActions. So I have a controller which look more or less like this

class AppController extends Controller {
    var $components = array('Security'); //other components
    //other stuff
}

class BookController extends AppController {
    function beforeFilter() {
        parent::beforeFilter();
        $this->Security->allowedControllers = array('Users');
        $this->Security->allowedActions = array('view');
        $this->Security->RequireAuth = array('search', 'results');
    }
    //other stuff
}

The action 'search' displays a form, which then calls 'results' 开发者_运维技巧to show the results of the search. I am intentionally trying to be blackholed.

For what I understand of $this->Security->allowedControllers and $this->Security->allowedActions, I should be able to get POST data only from the action 'view' of the controller 'Users'. In particular the action 'results' should redirect me to a black hole, since it obtains POST data from the action 'search' of the controller 'Books'.

But this is not the case. I can even make cross controller requests, and never get blackholed, so I guess I'm not using correctly this variables. What is the right way to trigger cross-controller requests control?

Try this:

$this->Security->allowedFields = array('Model.fieldname', ...);

You need to add the fields that are not in the model to the allowedFields like I guess your Model.search field in the form.

This is a good and short tutorial for doing Auth with CakePHP 1.3: http://tv.cakephp.org/video/jasonwydro/2011/01/29/cakephp_1_3_auth_authentication_component_tutorial_-_administrator_login