Record Level Security: Difference between revisions
New page: Sometimes you want to allow a user to edit certain records but not others from the same node. To do so, override the allowed() action in your node, and either (1) override recordActions()... |
mNo edit summary |
||
| (6 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
{{Howto|Advanced|Sam Kapilivsky}} | |||
To do so, override the allowed() action in your node | Sometimes you want to allow your users to edit certain records but not others from the same node. | ||
To do so, you should override the allowed() action in your node. You may optionally also use setFilter() to hide the records users may not edit. | |||
Notice that just using setFilter will hide the records, but not provide security in case a user hand-crafts a URL to edit a record. In order to provide security you MUST code the allowed() function. | |||
==Per-record action security== | ==Per-record action security== | ||
| Line 18: | Line 22: | ||
return parent::allowed($action, $record); | return parent::allowed($action, $record); | ||
} | } | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Latest revision as of 18:43, 11 November 2008
|
ATK Howto: Record Level Security
|
Sometimes you want to allow your users to edit certain records but not others from the same node.
To do so, you should override the allowed() action in your node. You may optionally also use setFilter() to hide the records users may not edit.
Notice that just using setFilter will hide the records, but not provide security in case a user hand-crafts a URL to edit a record. In order to provide security you MUST code the allowed() function.
Per-record action security
The following code allows a user to edit only the records that belong to them:
function allowed($action, $record="")
{
$user = getUser();
if($action=="edit" && $record['owner']['id'] <> $user['id'])
{
return false; // not allowed if not your own record
}
// call base class method to perform default authorization in all
// other cases.
return parent::allowed($action, $record);
}