Access Control Problem - php

Question

I am developing an access control library for my project and I am looking to the best solution to do this:
I am getting all my access list from database to an array. In result it looks like this:
$array = array(
'*' => array('administrator' => TRUE),
'frontend/*' => array(
'user' => TRUE,
'unregistered' => TRUE
),
'backend/*' => array(
'user' => FALSE,
'unregistered' => FALSE
),
'backend/user/*' => array(
'moderator' => FALSE,
'supermoderator' => TRUE,
),
'backend/article/*' => array(
'supermoderator' => TRUE
),
'backend/article/add/new' => array(
'moderator' => TRUE
)
);
The " * " means this user has access all of that related options backend/article/* means that group have access to all article options (article/add, article/remove, ...).
As you see the there is no item in backend/article/add for supermoderator but it has the master access to all article pages.
What is the best way to check this? I tried array_walk() but I guess it wont help me.
Thank you for advices...
I can share my whole code if you want.
* Edit *
Am I storing wrong? If you have the better solution to store it I will be happy to hear it.
Thank you for any advices

Answer 1

No matter what this is going to be a complex algorithm, a simple array_walk wont do. Unless someone is feeling particularly generous and will write one for you, I suggest you hire a programmer.
Am I storing wrong? If you have the better solution to store it I will be happy to hear it.
It totally depends on your algorithm. You can probably write one that uses your current data format. You can also probably write a simpler one if you change your data format. But what your data format should look like then, well, that's a job for a programmer.

Answer 2

I found the answer myself:
lets say the user trying to access backend/article/add/new and this user in the supermoderator group. So I need to look for backend/*, backend/article/*, backend/article/add/*. array_slice() and for() enough for this:
I am using CodeIgniter by the way. I modified it a little bit to seperate frontend and backend controllers. I am not using application/controller directory. I am using application/backend and application/frontend directories for controllers.
So an uri pattern is this: http://site.com/[backend]*/[directory]*/class/method
// This is the page that user trying to reach
$requested_page = "backend/article/add/new";
// pharsing...
$x = explode('/', $requested_page);
// this is needed to cut last 3, 2, 1 items of $x
$i = count($x) > 3 ? -4 : -count($x);
for (; $i < 0; $i++) {
$resource = implode('/', array_slice($x, 0, $i)) . '/*';
// echoing for debug
echo $resource;
}
// Outputs:
// backend/*
// backend/article/*
// backend/article/add/*

Answer 3

function userHasPermissions($permissionsArray, $user, $path) {
// Check exact
if(isset($permissionsArray[$path]) &&
isset($permissionsArray[$path][$user])) {
return $permissionsArray[$path][$user];
}
// Check lower and lower
$partArr = explode('/', $path);
for($i = substr_count($path, '/'); $i >= 0; $i--) {
if($i > 0) {
$choppedPartArr = array_slice($partArr, 0, $i);
$newPath = implode($choppedPartArr, '/') . '/*';
} else {
$newPath = '*';
}
if(isset($permissionsArray[$newPath]) &&
isset($permissionsArray[$newPath][$user])) {
return $permissionsArray[$newPath][$user];
}
}
return false;
}
echo "Result: " . (userHasPermissions($array, 'supermoderator', 'backend/article/add') ? "true" : "false");
Note that 'backend/article' will return false for 'supermoderator' since 'backend/article/*' does not match it. To change this, simply change $i = substr_count($path, '/'); to $i = substr_count($path, '/')+1;.