Record Level Security - Revision history

Samk at 18:43, 11 November 2008

2008-11-11T18:43:13Z

← Older revision		Revision as of 18:43, 11 November 2008
Line 5:		Line 5:
	To do so, you should override the allowed() action in your node. You may optionally also use setFilter() to hide the records users may not edit.		To do so, you should override the allowed() action in your node. You may optionally also use setFilter() to hide the records users may not edit.

	Notice that ~~jsut~~ using setFilter will hide the records, but not provide security in case a user hand-crafts a URL to edit a record. In order to provide security you MUST code the allowed() function.		Notice that just using setFilter will hide the records, but not provide security in case a user hand-crafts a URL to edit a record. In order to provide security you MUST code the allowed() function.

	==Per-record action security==		==Per-record action security==

Samk at 18:42, 11 November 2008

2008-11-11T18:42:58Z

@@ Line 1: / Line 1: @@
 {{Howto|Advanced|Sam Kapilivsky}}
-Sometimes you want to allow a user to edit certain records but not others from the same node.
+Sometimes you want to allow your users to edit certain records but not others from the same node.
-To do so, override the allowed() action in your node, and either (1) override recordActions() to hide the Edit link from records you may not edit, or (2) use setFilter() to completely hide records you may not edit.
+To do so, you should override the allowed() action in your node. You may optionally also use setFilter() to hide the records users may not edit.
 ==Per-record action security==
@@ Line 20: / Line 22: @@
      return parent::allowed($action, $record);
+}
 </syntaxhighlight>

Samk: /* Hiding the Edit Link */

2008-11-07T18:25:29Z

Hiding the Edit Link

← Older revision		Revision as of 18:25, 7 November 2008
Line 33:		Line 33:
	function recordActions($record, &$actions, &$mraactions)		function recordActions($record, &$actions, &$mraactions)
	{		{
	if( ! allowed("edit",$record)		if(!$this->allowed("edit",$record)
	{		{
	unset($actions["edit"]);		unset($actions["edit"]);

Samk at 18:21, 7 November 2008

2008-11-07T18:21:59Z

← Older revision		Revision as of 18:21, 7 November 2008
Line 3:		Line 3:
	Sometimes you want to allow a user to edit certain records but not others from the same node.		Sometimes you want to allow a user to edit certain records but not others from the same node.

	To do so, override the allowed() action in your node, and either (1) override recordActions() to hide the Edit link from records you may not edit, or (2) use ~~$this->~~setFilter() to completely hide records you may not edit.		To do so, override the allowed() action in your node, and either (1) override recordActions() to hide the Edit link from records you may not edit, or (2) use setFilter() to completely hide records you may not edit.

	==Per-record action security==		==Per-record action security==

Samk: /* Hiding the Edit Link */

2008-11-07T18:21:25Z

Hiding the Edit Link

← Older revision		Revision as of 18:21, 7 November 2008
Line 28:		Line 28:

	==Hiding the Edit Link==		==Hiding the Edit Link==
	~~To show~~ all records~~, but provide~~ an Edit icon ~~only for some~~ of them~~, use the folowing code~~. ~~It will hide~~ the Edit ~~icon from any record where~~ the user is not ~~allowed~~ to ~~perform this function:~~		If a filter is not set, all records will be shown with an Edit icon next to each of them. To remove the Edit icons for the records that the user is not authorized to edit, use the folowing code.

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">

Samk: /* Hiding the Records that should not be edited */

2008-11-07T18:19:43Z

Hiding the Records that should not be edited

← Older revision		Revision as of 18:19, 7 November 2008
Line 23:		Line 23:

	==Hiding the Records that should not be edited==		==Hiding the Records that should not be edited==
	~~Just set a filter on the node to~~ show only those records that the user can edit.		To show only those records that the user can edit just set a filter on the node:

			<syntaxhighlight lang="php">$this->setFilter(... </syntaxhighlight>

	==Hiding the Edit Link==		==Hiding the Edit Link==

Samk at 18:18, 7 November 2008

2008-11-07T18:18:12Z

← Older revision		Revision as of 18:18, 7 November 2008
Line 1:		Line 1:
			{{Howto\|Advanced\|Sam Kapilivsky}}

	Sometimes you want to allow a user to edit certain records but not others from the same node.		Sometimes you want to allow a user to edit certain records but not others from the same node.

Samk: New page: Sometimes you want to allow a user to edit certain records but not others from the same node. To do so, override the allowed() action in your node, and either (1) override recordActions()...

2008-11-07T18:16:38Z

New page: Sometimes you want to allow a user to edit certain records but not others from the same node. To do so, override the allowed() action in your node, and either (1) override recordActions()...

New page

Sometimes you want to allow a user to edit certain records but not others from the same node.

To do so, override the allowed() action in your node, and either (1) override recordActions() to hide the Edit link from records you may not edit, or (2) use $this->setFilter() to completely hide records you may not edit.

==Per-record action security==
The following code allows a user to edit only the records that belong to them:

<syntaxhighlight lang="php">
function allowed($action, $record="")
{
$user = getUser();
if($action=="edit" && $record['owner']['id'] <> $user['id'])
{
return false; // not allowed if not your own record
}
// call base class method to perform default authorization in all
// other cases.
return parent::allowed($action, $record);
}
</syntaxhighlight>

==Hiding the Records that should not be edited==
Just set a filter on the node to show only those records that the user can edit.

==Hiding the Edit Link==
To show all records, but provide an Edit icon only for some of them, use the folowing code. It will hide the Edit icon from any record where the user is not allowed to perform this function:

<syntaxhighlight lang="php">
function recordActions($record, &$actions, &$mraactions)
{
if( ! allowed("edit",$record)
{
unset($actions["edit"]);
}
}
</syntaxhighlight>