Module permissions class error - php

Question

I have created a CheckModulePermission function in my user class which checks a module table to ensure the user has permissions to view the page. Below is the function
public function CheckModulePermissions($moduleId) {
if(isset($_SESSION['userId'])) {
// If the user is admin, allow regardless
if($this->IsAdmin()) {
return true;
}
$sql = "SELECT `userModuleId`
FROM `userModules`
WHERE `userId` = " . $_SESSION['userId'] . "
AND `moduleId` = " . $moduleId . ";";
mysql_select_db(DB_USER_DATABASE_NAME, $this->conn);
$result = mysql_query($sql, $this->conn);
$x = mysql_fetch_row($result);
if($x[0] == 1) {
return true;
} else {
return false;
}
} else {
return false;
}
}
}
This works fine in all my pages except one page where it fails . I have a dropdown box and a text box which will be updated depending on the users permission. The user i am logged on as has the permission but the dropdown boxes do not appear.
if(isset($_GET['orderNumber'])) {
// If post is set then update the prima reference and order status
// Only if user has sufficient privileges
if(isset($_POST['orderStatus'])) {
if($user->CheckModulePermissions(11)) {
$cid->UpdateOrderStatus($_GET['orderNumber'], $_POST['orderStatus']);
$cid->UpdateOrderReference($_GET['orderNumber'], $_POST['PReference']);
}
}
if($user->CheckModulePermissions(11)) {
$content .= "<select name='orderStatus'>
<option value='1'";
if($orderDetails['status'] == 1) $content .= " selected='selected'";
$content .= ">Incomplete</option>
<option value='2'";
if($orderDetails['status'] == 2) $content .= " selected='selected'";
$content .= ">Submitted</option>
<option value='3'";
if($orderDetails['status'] == 3) $content .= " selected='selected'";
$content .= ">Processed</option>
</select>";
} else {
if($orderDetails['status'] == 1) $content .= "Incomplete";
if($orderDetails['status'] == 2) $content .= "Submitted";
if($orderDetails['status'] == 3) $content .= "Processed";
}
$content .= "</td>
</tr>
<tr>
<th>Prima Order Number</th>
<td>";
if($user->CheckModulePermissions(11)) {
$content .= "<input type='text' name='pReference' value='" . $orderDetails['PReference'] . "' /></td>
</tr>
<tr>
<td colspan='2'><input type='submit' /></td>
</tr>";
} else {
$content .= $orderDetails['PrimaReference'] . "</td></tr>";
}
$content .= "</table>
</form>
</td>
Is it the logic for the dropdown box where it fails?

Answer 1

Here is a more efficient/readable version of your CheckModulePermissions() method...
public function CheckModulePermissions ($moduleId) {
// Deny immmediately if no userId is set
if (!isset($_SESSION['userId'])) return FALSE;
// If the user is admin, allow regardless
if ($this->IsAdmin()) return TRUE;
// Generate an SQL statement - does this need sanitising?
$sql = "SELECT `userModuleId`
FROM `userModules`
WHERE `userId` = '{$_SESSION['userId']}'
AND `moduleId` = '$moduleId'
LIMIT 1";
// Is this line really necessary? Are you actually working with more than one database?
// Even if you are, it's probably better to do it in the query, like this:
// SELECT whatever FROM DB_USER_DATABASE_NAME.tablename WHERE...
mysql_select_db(DB_USER_DATABASE_NAME, $this->conn);
// Since you only want one row, it's slightly more resource efficient
// to abandon the $result variable
$x = mysql_fetch_row(mysql_query($sql, $this->conn));
// This means the same thing as your if ... else
return $x[0] == 1;
}
...and here is a rewritten version of the HTML generation code.
// Get this once, at the beginning, to minimise SQL traffic
$hasPermissions = $user->CheckModulePermissions(11);
// Uncomment this line to make sure that $user->CheckModulePermissions is returning the value you expect
//var_dump($hasPermissions);
if (isset($_GET['orderNumber'])) {
// If post is set then update the prima reference and order status
// Only if user has sufficient privileges
if (isset($_POST['orderStatus']) && $hasPermissions) {
$cid->UpdateOrderStatus($_GET['orderNumber'], $_POST['orderStatus']);
$cid->UpdateOrderReference($_GET['orderNumber'], $_POST['PReference']);
}
// Map of status numbers to string descriptions
$statusStrs = array(1 => 'Incomplete','Submitted','Processed');
if ($hasPermissions) {
// Generate a <select>
$content .= "<select name='orderStatus'>";
foreach ($statusStrs as $val => $str) {
$content .= "\n<option value='$val'".(($orderDetails['status'] == $val) ? " selected='selected'" : '').">$str</option>";
}
$content .= "\n</select>";
} else {
// Print the current status string
$content .= $statusStrs[$orderDetails['status']];
}
// Close the table cell (layout tables are nasty nasty)
$content .= "</td>
</tr>
<tr>
<th>Prima Order Number</th>
<td>";
if ($hasPermissions) {
// add an input for changing the reference number
$content .= "<input type='text' name='pReference' value='{$orderDetails['PReference']}' /></td>
</tr>
<tr>
<td colspan='2'><input type='submit' /></td>
</tr>";
} else {
// Display the current reference number
$content .= $orderDetails['PrimaReference'] . "</td></tr>";
}
$content .= "</table>
</form>
</td>
I think the most likely cause of your problem is that CheckModulePermissions() is returning FALSE when you expect it to return TRUE. Uncomment the var_dump() line to verify this and we'll take it from there.