Record Level Security
|
ATK Howto: Record Level Security
|
Sometimes you want to allow a user to edit certain records but not others from the same node.
To do so, override the allowed() action in your node, and either (1) override recordActions() to hide the Edit link from records you may not edit, or (2) use setFilter() to completely hide records you may not edit.
Per-record action security
The following code allows a user to edit only the records that belong to them:
function allowed($action, $record="")
{
$user = getUser();
if($action=="edit" && $record['owner']['id'] <> $user['id'])
{
return false; // not allowed if not your own record
}
// call base class method to perform default authorization in all
// other cases.
return parent::allowed($action, $record);
}
Hiding the Records that should not be edited
To show only those records that the user can edit just set a filter on the node:
$this->setFilter(...
Hiding the Edit Link
If a filter is not set, all records will be shown with an Edit icon next to each of them. To remove the Edit icons for the records that the user is not authorized to edit, use the folowing code.
function recordActions($record, &$actions, &$mraactions)
{
if(!$this->allowed("edit",$record)
{
unset($actions["edit"]);
}
}