Restricting Access to Menu Options

ward

Good morning everyone.

I'm building a very simple content management site that tracks
"tasks."

The options available are:
1. Add Task
2. Edit Task
3. View Task
4. Print Task

I need to restrict some users to only View and Print and I'm trying to
find a way to tell the page not to load the menu options (the text)
for those not having access to the Add and Edit functions.

IOW, they would only see View and Print.

I have three basic users:
1. System Admin
2. Subject Matter Expert (SME)
3. Viewers

Obviously the System Admin and SME will have full access so it's the
Viewers that are to have access to only View and Print.

I have a users table but haven't set it up for the distinction. What
I was thinking was creating a field labeled users_group and assign a
numeric value for each user using the numbering system above.

I have my page load the menu options:

<a href="home.php" class="navlink">Home</a><br />
<a href="view_tasks.php" class="navlink">View Tasks</a><br />
<a href="edit_task.php" class="navlink">Edit Task</a><br />
<a href="add_task.php" class="navlink">Add Task</a><br />

into here...

<BODY>

<table width="90%" border="1" cellspacing="10" cellpadding="0"
align="center">

<tr><td colspan="2"><h1 id="mainhead">ICAO Tasks —
WAFS</h1></td></tr>

<tr>
<td align= "center" valign="top" nowrap="nowrap" width="10%">
Menu<br />
<?php include ('./includes/menu.html'); ?>
</td>

<td valign="top" class="content">
How can I tell the system not to load the last two lines unless they
are a System Admin or SME?

I read a chapter on Cookies/Sessions...but it wasn't that helpful for
this case.

Can I setcookie('user_group', '3') and use that somehow???

Am I in the ballpark with this solution?

Thanks.

Ward

Mar 6 '06 #1

Subscribe Post Reply

1772

Gordon Burditt

>I'm building a very simple content management site that tracks

"tasks."

The options available are:
1. Add Task
2. Edit Task
3. View Task
4. Print Task

I need to restrict some users to only View and Print and I'm trying to
find a way to tell the page not to load the menu options (the text)
for those not having access to the Add and Edit functions.
For an application like this it is very important that you check
if the user is authorized when they try to EXECUTE that function,
not just when they bring up the menu. Hint: users are added and
deleted, and they sometimes change jobs. Browsers cache pages and
people can manually type in links.
IOW, they would only see View and Print.
Presumably, it is also important that they can only DO View and
Print.
I have three basic users:
1. System Admin
2. Subject Matter Expert (SME)
3. Viewers

Obviously the System Admin and SME will have full access so it's the
Viewers that are to have access to only View and Print.
Do you already have a way of telling which type of user is logged
in? I recommend using sessions to store that info after getting
it from the login page.
I have a users table but haven't set it up for the distinction. What
I was thinking was creating a field labeled users_group and assign a
numeric value for each user using the numbering system above.
Typically this sort of thing is done by an "access level" number.
It may be attached to individual users or groups of users. Each
function has an access level required to use it. This isn't suitable
for every setup (e.g. A needs privileges B doesn't have, and B needs
privileges A doesn't have), but it fits many situations.
I have my page load the menu options:

<a href="home.php" class="navlink">Home</a><br />
<a href="view_tasks.php" class="navlink">View Tasks</a><br />
<a href="edit_task.php" class="navlink">Edit Task</a><br />
<a href="add_task.php" class="navlink">Add Task</a><br />
Then you'd typically do something like this:

... fetch $access_level from database based on user here ...
if ($access_level >= 5) {
echo '<a href="edit_task.php" class="navlink">Edit Task</a><br />';
echo '<a href="add_task.php" class="navlink">Add Task</a><br />';
}
into here...

<BODY>

<table width="90%" border="1" cellspacing="10" cellpadding="0"
align="center">

<tr><td colspan="2"><h1 id="mainhead">ICAO Tasks —
WAFS</h1></td></tr>

<tr>
<td align= "center" valign="top" nowrap="nowrap" width="10%">
Menu<br />
<?php include ('./includes/menu.html'); ?>
</td>

<td valign="top" class="content">
How can I tell the system not to load the last two lines unless they
are a System Admin or SME?
Use conditional execution, probably within the included file.
I read a chapter on Cookies/Sessions...but it wasn't that helpful for
this case.
Yes, it can be. You can look up the access level at login and
set in a session value. Later you can look at $_SESSION['access_level']
and allow or not allow certain actions. Session variables are
not stored on the browser but cookies are (and can be fiddled with).
Can I setcookie('user_group', '3') and use that somehow???

If you don't have a way to tell what user is logged in, work
on that first. Cookies are stored on the browser, and therefore
they are forgable. I recommend that you look at what user is
looked in, and check what access that user has *every* *single*
*page* where it matters. Don't forget that it's more important
to not let low-level users DO an update than it is to not let
low-level users see a menu item for an update.

Gordon L. Burditt

Mar 6 '06 #2

Similar topics

Restricting an open browser window

by: Dave Holmes | last post by:

Is there a way to keep an other application from opening a link in a browser where I am running an ASP application? For example, I have an ASP application open in a browser. If I click on a link...

ASP / Active Server Pages

Error Trapping In Access 2000

by: Peter Frost | last post by:

Please help I don't know if this is possible but what I would really like to do is to use On Error Goto to capture the code that is being executed when an error occurs. Any help would be much...

Microsoft Access / VBA

Access 2000 Menu customization

by: daniel.sumanth | last post by:

Hello, Have customized the menu options in Access 2000 in a computer. However, it seems that the customizations apply only when I'm logged in and not to other users. Is there any way to use the...

Microsoft Access / VBA

Create MDE causes Access to crash

by: badboybrown | last post by:

Hello, Is it possible to step through the "Create MDE" process and see what is causing Access to crash? I tried, unsuccessfully, many times to create an MDE from my database. But, randomly, I...

Microsoft Access / VBA

Conversion of an MS Access application

by: Oldie | last post by:

I have built an MS Access Application under MS Office XP (but I also own MS Office 2000). I have split the application in the pure database tables and all the queries, forms, reports and macro's. ...

Microsoft Access / VBA

Access 2007 Custom Menu Bars

by: Wayne | last post by:

I've been clicking around Access 2007 Beta 2 and can't see the custom menu bar designer. Is it in the beta? Maybe I'm blind. The question that comes to mind is: Will custom menu bars be the same...

Microsoft Access / VBA

Custom Context Sensitive Menus within MS Access

by: Keith Hutchison | last post by:

G'day Is it possible to do custom context sensitive menus within MS Access. If yes, does anyone have a sample example? Thanks in advance Keith

Microsoft Access / VBA

Populate Pull down menu from access database on selection of previous pull down menu

by: giandeo | last post by:

Hello Experts. Could you find a solution for this problem please! I have the following tables in Access Database Table Name: origin Fields Names: country, countrycode Table Name: make...

Javascript

Opening Access app from Explorer?

by: Salad | last post by:

I have 2 apps; one written in A97, the other in A2003. If I open an app in A97 then close it, then open Explorer and dbl-click on the A2003 mdb, I'm informed it's an unrecognized format. If I...

Microsoft Access / VBA

Cloud Servers without Credit Card and Email Registration: A Simpler Way to Get on the Cloud

by: CloudSolutions | last post by:

Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...

General

Wordpress or something else?

by: Faith0G | last post by:

I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...

Content Management Systems

One-click Importing Excel Data into a*Database

by: ryjfgjl | last post by:

In our work, we often need to import Excel data into databases (such as MySQL, SQL Server, Oracle) for data analysis and processing. Usually, we use database tools like Navicat or the Excel import...

Microsoft Excel

How to turn on java script in a villaon keypad mobile phone

by: Charles Arthur | last post by:

How do i turn on java script on a villaon, callus and itel keypad mobile phone

Java

Batch import of multiple excel files into the database

by: ryjfgjl | last post by:

If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...

Data Management

Merging data from multiple Excel files

by: ryjfgjl | last post by:

In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...

Data Management

Navigating the Data Structures and Algorithms (DSA)

by: BarryA | last post by:

What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...

Algorithms / Advanced Math

Looking to do Android software development, any suggestions? Is flutter better?

by: nemocccc | last post by:

hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?

General

Is that possible of reading the .csv file in column wise and the column have different lengths ?

by: Sonnysonu | last post by:

This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...

C / C++