egalvez
Založený: 14.03.2005
Príspevky: 4
Zaslal: 2005-03-14 01:54
Návrat hore
Odpovedať s citátom
|
I've gone through the documentation and one thing is not clear to me. If the administrator of a database needs to be able to add, change, and delete records, but all other users should only be able to view records, is this possible? I realize that the
$opts['options']
parameter allows the setting of permissions, but are they not global? If I set them to read-only permissions like
$opts['options'] = 'VFL'
then isn't the administrator limited by these permissions also? I've searched the forums and seen questions about multiple users, but I don't understand the answers. Please advise.
|
michal
Založený: 17.06.2003
Príspevky: 537
Bydlisko: Slovakia
Zaslal: 2005-03-14 07:36
Návrat hore
Odpovedať s citátom
|
yes,
but if you make
| Kód: |
if($user == 'admin') $opts['options'] = 'ACDVFL'; else $opts['options'] = 'VFL';
|
...
($user is defined by your login scheme)
|
egalvez
Založený: 14.03.2005
Príspevky: 4
Zaslal: 2005-03-14 17:48
Návrat hore
Odpovedať s citátom
|
Thank you for your reply. However, I don't understand it. What are you referring to by "login scheme"? It's my understanding that phpMyEdit has no login scheme, nor does it have a variable called
$user
. It almost seems that phpMyEdit is great for an online database but only if you want everyone to be able to do everything to the database.
The only quick way I know of to limit access is via .htaccess and that's all-or-nothing access.
I'm completely lost regarding how restrict permissions for non-admin users. By
admin
, I mean the person who installed and set up phpMyEdit and the table in question.
|
michal
Založený: 17.06.2003
Príspevky: 537
Bydlisko: Slovakia
Zaslal: 2005-03-14 22:43
Návrat hore
Odpovedať s citátom
|
login scheme is an external php program that lets users to log in and thus have different priviledges that other users.
having different priviledges without any kind of login is not possible.
i think this a good candidate for hints-and-tips section of the documentation...
|
egalvez
Založený: 14.03.2005
Príspevky: 4
Zaslal: 2005-03-14 23:19
Návrat hore
Odpovedať s citátom
|
What about this idea: If I make a copy of the php file that phpMyEdit creates and give it a different filename, and I change the
$opts['options']
permissions to read-only in this file, then let other users only use this file, while the admin can use the first file which has all permissions not merely read-only ones? In other words, if users go to file1.php and have only read-only privileges, and the admin uses file2.php which has no limitations, would that work? They are accessing the same database and table. I could have both files in the same .htaccess-protected directory and the directory would have an index file so that no one can access both files. Does this make sense?
|
michal
Založený: 17.06.2003
Príspevky: 537
Bydlisko: Slovakia
Zaslal: 2005-03-14 23:27
Návrat hore
Odpovedať s citátom
|
not very secure, but it will serve the purpose... (as long as you believe that not many people/search engines will access the secret page).
|
egalvez
Založený: 14.03.2005
Príspevky: 4
Zaslal: 2005-03-14 23:52
Návrat hore
Odpovedať s citátom
|
Search engines cannot access .htaccess-protected pages so I'm not understanding your concern.
|
platon_helper
Založený: 12.05.2005
Príspevky: 3
Zaslal: 2005-06-08 18:08
Návrat hore
Odpovedať s citátom
|
I wrote a little something and it looks like this.
The method of authentication can be anything. MySQL, .htaccess or whatever. The user is defined in the variable $_SERVER['PHP_AUTH_USER']. Also if you don't have auhentication I believe that that PHP_AUTH_USER equals ''. I completley rewrote the calling php file to be a sort of template so that it can be modified easily. I simply need to uncomment a few lines for the fields I would like to have on the page, and of course I can always add some "custom" fields.
Note: This is a code snippet. There are several other users that I have defined. There is no other logic though.
function definePermission(&$opts) {
switch($_SERVER['PHP_AUTH_USER']) {
###################################################################################
case 'user1' :
$opts['options'] = 'FC'; //Dynamic Page General Permissions
/*** Uncomment and change the permissions as needed */
//$opts['fdd']['site']['options'] = 'CRL';
//$opts['fdd']['source']['options'] = 'CRL';
//$opts['fdd']['date']['options'] = 'CRL';
//$opts['fdd']['class']['options'] = 'CRL';
//$opts['fdd']['subject']['options'] = 'CRL';
//$opts['fdd']['comments']['options'] = 'CL';
break;
###################################################################################
case 'user2' :
$opts['options'] = 'FC'; //Dynamic Page General Permissions
/*** Uncomment and change the permissions as needed */
//$opts['fdd']['site']['options'] = 'CRL';
//$opts['fdd']['source']['options'] = 'CRL';
//$opts['fdd']['date']['options'] = 'CRL';
//$opts['fdd']['class']['options'] = 'CRL';
//$opts['fdd']['subject']['options'] = 'CRL';
//$opts['fdd']['comments']['options'] = 'CRL';
break;
|
platon_helper
Založený: 12.05.2005
Príspevky: 3
Zaslal: 2005-06-08 18:20
Návrat hore
Odpovedať s citátom
|
I also have this code snipet for you guys. I put all of the configuration stuff at the top of the page so that non-tech geek people at my company can make better sense. I define a list of fields that I would like to display in $fieldList. Then I extract the fields from $fieldList and run them through the defineField funtion. This adds them to the page in the order specified. After that I use the permissions code from the previous post. Essentially I just seperated the field definitions from the permissions. I defined the 'options' for the primary key and the first field that I would always like to display and as read only. After that the individual experience begins.
$fieldList = "priKey,item"; //Fields are listed on webpage in this order
/************************************************************/
/*************Field Definitions******************************/
/************* *****************************/
function defineField(&$opts, $inField) {
switch($inField) {
############################################
case 'priKey' : //** This field is generally ignored
$opts['fdd'][$inField] = array(
'name' => 'PriKey',
'select' => 'T',
'options' => 'HR',
'maxlen' => 11,
'default' => '0'
);
break;
############################################
case 'item' :
$opts['fdd'][$inField] = array(
'name' => 'Item',
'options' => 'LVCR',
'select' => 'T',
'maxlen' => 20,
'size|F' => 16,
'sort' => true,
'URLprefix' => 'files/',
'URL' => '$value',
'URLpostfix' => '.pdf'
);
break;
############################################
case 'site' :
$opts['fdd'][$inField] = array(
'name' => 'Site',
'select' => 'D',
'maxlen' => 45,
'size|F' => 7,
'sort' => true,
'values' => array()
);
break;
|
|
Odoslať novú tému
Odpovedať na tému
|
Prihlásiť
Registrácia
English
