My RealEstate PHP Application have following user groups,
Admins,
Moderators
Agents
i want to specify following permission to the following users.
Admins - >
Can Create Moderators,
Can Create Agents,
Can Insert Properties,
Can Update Properties,
Can Delete Properties
Hence an Admin will have all the privileges in short an Admin here will be superAdmin
I want to assign limited privileges to the moderator and hence to the agents.
i am confused on how to Create a Database for this and also on how to implement it in my PHP Application.
thank you
It sounds like you are going to need a role-based access control system. Developing one is not
really a trivial task, so as already suggested, finding a framework or ready-made class that does
the job would be a worth while start.
Role Based Access Control
http://www.tonymarston.net/php-mysql/role-based-access-control.html
http://www.sqlrecipes.com/database_design/fine_grained_role_based_access_control_rbac_system-3/
http://www.sitepoint.com/forums/showthread.php?threadid=162027
You should create a table wher you have to define all type of role.
and one table for users
relate different roles to different user Via linking two tables.
and some thing like this ......
The way that I have done this in the past was to create a users table in the database that had an access level (Admin, Moderator, and agents).
Then if you have a menu system, implement a check to see what privileges are needed for what links... Admins will see all links, Moderator will only see links he/she is supposed to, and agents will only see what they are supposed to see.
Also on the pages that you may want to restrict users you will want to check for the users access level. If they pass, they will see the page, if not, they will be redirected or a javascript error will need to pop up.
Something like the access level may do you some good to store it in a cookie as you can cut down your calls to your database.
Hope this helps,
Mike
Related
I want to create user roles and permissions (Super Admin, Accountant, User) in my Php Mysql CRUD Application. I am wondering how to allow create, read, update and delete permissions to these users, for example, will it be done in create.php or should I create separate create.php files for each user.
Only the Super Admin will have all permissions. For accountant, it will be read (view) and update. And for normal user, it will be read only.
How can I achieve this?
Most commonly this is done with groups and Access Control Lists (ACLs).
You implement a "group" attribute of a user entity, and then define the group with a set of privileges. When the user logs in, load their privileges by looking up their group and then lookup the privileges assigned to that group.
In your create.php, check the privileges that have been loaded for that user, and if they don't have create privilege, return an informative error message.
Googling for "PHP ACL for CRUD application" I found a number of tutorials showing how to implement this in different PHP frameworks. One example:
https://book.cakephp.org/2/en/tutorials-and-examples/simple-acl-controlled-application/simple-acl-controlled-application.html
By using groups and ACLs, this makes it easier to define new group types in the future, or change the group membership of a given user, or change the privileges assigned to the groups.
I am trying to create roles and permissions functions in php. I have checked some tutorials
A Better Login System
RBAC in PHP
but it is not clear that the permissions are that of the ones granted by mysql or they are improvised in php.
For example if I have roles like admin and user and developer, so should I have to create different users in database and then use those to perform different operations or should I create one root user and then control the access in php. To me it seems like the database should restrict it by having different users.
First clear yourself on roles & permissions. In front end these are different things to provide access to certain pages & changes.
As per your question let me tell you the roles as Admin/User/Developer can be managed by MySQL user rights. MySQL user rights restrict user access on tables, creating tables,deletion and insertion etc. Now if you create different users in database with custom user rights you will have to include different connection credentials for each of the users.
Further in controlling PHP pages restrict user access with user pages assignment by php codes.
If you are really going for custom access management module. I would recommend you to create role table where roles will be placed
table:role
Columns:
id (pk, auto-increment)
role_name (Varchar)
keep 'role_id' in the user table.
you don't need to create a separate table for user_role since each use will have one role.
But if you are planning to have completely page level access.. You would need that table and a UI should be created where you would assign pages (access) to the user while creating a user.
If you are using any framework, do look for the available apis. YII has a very good security feature which access rules and filters are defined.
My tool uses:
PHP for scripting.
mySQL for DB.
Apache for host.
There will be 2 groups of users.
I want to give access to 1 group of users only for 2 webpages.
The other group of users will have the access for all the pages and links.
Is there a way I can hide certain links on a webpage from a certain group of users, too.
How can I achieve this.
Fairly new to programming.
Any help will be greatly appreciated.
Thank you.
Lets say, Admin & normal user.... in that case we will have a column in the user table which will store he/she is admin or not. When you do authentication, fetch this value & keep it in SESSION. So in every page you check this person is admin or not with that session value using if clause.
It's hard to give any fitting exmaples without code, but if you have a MySQL and know some PHP, the basic way of solving this problem would be connecting to the database, checking what group the currently logged in user is (check by ID or however you set things up) and wrapping if statements around the links you want to hide from certain people that check if they belong to the right group to see said pages. You can also hide the pages from them by just putting a check whether they can see the page content or not on top of the content and throwing some sort of no permission error when needed. For this basic example hard-coding the groups into the files should be sufficient. If you plan on expanding all this later on, I'd maybe make a seperate table in your database controlling page view permissions.
You can also include HTML code in your PHP if statements by just closing the PHP section after the if (?>) and put the closing bracket of the if at the end of your HTML menu for the secret group (<?php } ?>).
If you provide us with some code snippets, we can maybe help you a bit more with examples.
There are many ways you could achieve this.
How to 'hide' the page
A good way to really hide the pages would be to check the type of user before displaying anything. If the type of user has access to the requested page, display it. If the user does not have access, you could send a 404 page not found error.
This way, user which does not have access to the page wont even know the page exist even if they have the URL.
Authenticate the user
As mentioned by Akhil Sidharth, you can use a $_SESSION variable to keep the type of the user trying to view the pages.
Every application now a days is using group, permission and capabilities to restrict site/application users from accessing the page/content/link within the site/application. Sometime group might be refereed as role to organize users. Let me describe -
Group/Role - Role might be - Admin, Manager, Employee, Customer etc. Your application should have role management system where you can manage(add/edit/delete) the roles/user-groups. These roles should be stored in DB tables.
Permission - Permission might be Allow, Deny, Restrict etc.
Capabilities - Capabilities might define the list of works/actions/activities that a user can take on your site or on a particular page. Some examples are - a. Can View XY*Z link b. Can View X*B page c. Can create user d. Can assign permission e. Can change permission etc.
Apart from this, your application should have two addtional management page -:
Configure capabilities & permission for the said roles, where you can configure and set capabilities either 'Allow'/'Deny' for the roles.
Role to users - This is the page where you can put the users into a particular role.
In this way you have the idea, what a particular users have rights/permissions to do on the site & restrict the users over accessing the contents/pages/links accordingly.
Alternatively, the simplest way for you now is to add a 'type' field in your user DB table. Add a drop down of users types where you are creating/updating the user & save the user type in your user db table. Restrict the user on the basis of user type accordingly.
I am creating an web application and I at the point that i am starting to make backend choices. Now there are a lot of ways to go with this, so I am looking for some good points and back practices.
Some of the question i have involve:
Should i make a seperate table in the db for admin users
Should i extend make some classes to load the admin data and the normal data, or make seperate classes for the admin section
Where can i get some information on making different types of users
Just some best practices for a backend
My application is written in PHP with an MySQL database.
Keeping a separate table for admin users is nice, but only if those admin users aren't "regular" users as well - otherwise you'll step on your own toes trying to keep usernames/IDs unique but somewhat connected.
A couple things to consider:
Apache authentication (or Windows accounts on IIS) for admin users. Separate system entirely, but allows for overlap - a regular user can be a regular user, but they can't access any admin functionality until they authenticate through the browser. Works fine if you only have a couple specific kinds of user role (e.g. member & administrator only).
All users in one table, but with roles and permissions separate. This is the most flexible because you can get as granular as you need. For example, any user can "post comments," while an admin can "delete comments" and "ban users," but a moderator can only "suspend comments" and "mute users." As you add new features, it's simply a matter of implementing some new permissions & assigning them to the roles. Drupal's access control does this really well, worth a close look.
A good way to do it is to add a new field in the users table for 'rank' in order to differentiate between regular users and staff members, and possibly between the different staff member levels such as moderator, admin, etc. if you need it. Because an administrator should be able to perform all functions that a user can. Use
class Admin extends User { }
if you want to add additional functionality specific to staff members.
As for backend functions, that depends on how your site is set up. If you're using a framework, you can just add new functions to existing controllers and restrict access only to users with a certain rank.
For example, you might have a controller for ForumPost objects, but calling the ForumPost delete() function would require the user to be a forum moderator.
If you're not using a framework, you'll probably have to make your own pages for each backend function you need.
How can i manage user permission?
i need a fast method to manage users (accsess to a page or dont accsee to a page) when they login?
You may want a simple solution but it's not a simple question.
At one end you could have individual permissions for each page for each user. That gives you a lot of flexibility but it would be an administrative nightmare. At the other end you could give users access or not to the whole site. Not very flexible but very easy to administer and code for.
The first is fine-grained. The second is coarse-grained. The whole point of finding an authorization scheme is to define one that is as fine or coarse grained as you need to balance flexibility and administration/development.
Two common schemes that may be of interest to you:
Give each user a type in the database. When they log in put that type (eg User, Admin, Moderator) in the session and check that on each relevant page;
Give each user one or more roles (so someone could, say, be both an Admin and a Moderator or just one of them or neither). This requires a separate table (users and userroles) and putting probably an array in the session to indicate roles but is more flexible than (1). Role-based authorization is very common.
There are many, many variations upon these two and just as many alternatives. Various schemes can be combined.
This is why generic authorization libraries for me fall short because they have contrary needs of being broad enough to cover a large number of use cases and being coarse-grained enough to be useful for the individual user.
Implement an ACL system.
A group of users form a role
A user may belong to many roles
Privileges are defined in the application - example, create user, post article. etc
Add privileges to roles via admin interface
Before the page loads, check ACL. If user belongs to a role with the required privileges for the requested page, allow user to continue. Else redirect to access denied page.
It can be easily achieved using third party libraries like Zend_Acl
Choose a library you are comfortable working with. But the basic idea remains same.