Attribute-level Security

ATK Howto: Attribute-level Security Complexity: Advanced Author: James Stewart

List of other Howto's

Some times you want some people to see something that another group cannot.

haslevel

A simple method is to wrap things around a haslevel check, e.g.

$securityMgr = &atkGetSecurityManager();
if ($securityMgr->haslevel(1) 
{
  //Do something
}

Using tabs

When I asked on the mailing list, Ivo gave this idea as well:

A good alternative might be to spread the attributes over multiple tabs, then add an access right that corresponds to the tabname, and setting it up like so in your constructor:

if ($this->allowed("advanced_tab")
{
  $this->add(....., "advanced");
  $this->add(....., "advanced");
}
if ($this->allowed("publication_tab")
{
  $this->add(....., "publication");
}

You will obviously want to have a look into the allowed function in the API documentation.

Using 'attrib level security' that is built into ATK

This one is something that needs a little research added here. Here is an subset of Ivo's comments on it:

There is a feature called 'attrib level security' in atkSecurityManager, but it's ages since I last used it so I'm not sure how it works. It involves an extra table where the rights per attribute are stored.

You should be able to find out the details by looking at atk/security/class.auth_db.inc. It has a method for retrieving the attribute privileges. It probably has some details about the table structure.