Record Level Security

ATK Howto: Record Level Security Complexity: Advanced Author: Sam Kapilivsky

List of other Howto's

Sometimes you want to allow a user to edit certain records but not others from the same node.

To do so, override the allowed() action in your node, and either (1) override recordActions() to hide the Edit link from records you may not edit, or (2) use $this->setFilter() to completely hide records you may not edit.

Per-record action security

The following code allows a user to edit only the records that belong to them:

function allowed($action, $record="") 
{ 
    $user = getUser(); 
    if($action=="edit" && $record['owner']['id'] <> $user['id']) 
    { 
        return false; // not allowed if not your own record 
    } 
    // call base class method to perform default authorization in all 
    // other cases. 
    return parent::allowed($action, $record); 
}

Hiding the Records that should not be edited

To show only those records that the user can edit just set a filter on the node:

$this->setFilter(...

Hiding the Edit Link

To show all records, but provide an Edit icon only for some of them, use the folowing code. It will hide the Edit icon from any record where the user is not allowed to perform this function:

function recordActions($record, &$actions, &$mraactions) 
{ 
    if( ! allowed("edit",$record)
    { 
        unset($actions["edit"]); 
    } 
}