The logic of checking 'PUBLIC' and 'EXCEPT' is right?

[aisuhua]

I check the code of "Phalcon\UserPlugin\Plugin\Security.php". And I find the logic code of checking authority is not right. Below are code fragments:

/**
 * Check for public resources.
 *
 * @param array  $resources
 * @param string $actionName
 * @param string $controllerName
 *
 * @return bool
 */
private function checkPublicResources($resources, $actionName, $controllerName)
{
    $resources = isset($resources['*']) ? $resources['*'] : $resources;
    foreach ($resources as $controller => $actions) {
        if ($controller == $controllerName) {
            if (isset($controller['*'])) {
                return true;
            } else {
                if (in_array($actionName, $actions) || $actions[0] == '*') {
                    return true;
                }
            }
        }
    }
    return false;
}

Above logic code can not reach the goal which the doc say:

In the exampe bellow, the ONLY PUBLIC resurces are the actions LOGIN and REGISTER from the USER controller:

'pup' => array(
    'redirect' => array(
        'success' => 'user/profile',
        'failure' => 'user/login'
    ),
    'resources' => array(
        'type' => 'public',
        'resources' => array(
            'user' => array('login', 'register')
        )
    )
)

Think ! So sorry my bad english.

[calinrada]

It is working because the "$resources" param assigned to checkPublicResources() method, it is $var['pup']['resources']['resources']

[aisuhua]

Yes, I know. But the checkPublicResources() return true is meaning "private resource". For example, if i visit the url http://domain/user/login, and the config is:

'pup' => array(
    'redirect' => array(
        'success' => 'user/profile',
        'failure' => 'user/forbidden'
    ),
    'resources' => array(
        'type' => 'public',
        'resources' => array(
            'user' => array('login', 'register')
        )
    )
)

Now, as the doc says, the action login is public. But it redirect to user/forbidden. Is it right ?