Making User rights with PHP and MYSQL for WebAdmin

[kumschick]

What I want to do, is every user has special rights.
If a user has the rights set to "1", then he must be able to see all links. (1 + 2 + 3)
If a user has the rights set to "2", then he must be able to see all links. (2 + 3)
If a user has the rights set to "3", then he must be able to see all links. (3 only)

My idear was it by doing a if as in the example, but it doesn't work!
Who could do it?

$userrights = "1";



if($userrights=="1")
  {
    $user_rights = "and rights='1' and rights='2' and rights='3'";
  }

elseif($userrights=="2")
  {
    $user_rights = "and rights='2' and rights='3'";
  }

elseif($userrights=="3")
  {
    $user_rights = "and rights='3'";
  }

else
  {
    $user_rights = "and rights='3'";
  }


$content_menu=mysql_query("select id,content,link,rights from $db_menu where language='$language' and title='$row[title]' $user_rights order by 'content'");

// Menu Table
// $db_menu -> "menu links"

id orderby language title content link rights
1 1 eng General Language /adm_language.mrm 3
2 1 eng General Version /adm_version.mrm 3
3 2 eng Settings Create User /adm_user_create.mrm 1
4 2 eng Settings Edit User /adm_user_change.mrm 1
5 3 eng Content Management /adm_management.mrm 2
6 1 eng General System Information /adm_sysinfo.mrm 3
7 2 eng Settings Change Password /adm_password.mrm 3

[Pig]

By using AND, you are requiring the articles to be ALL of the values specified. So if the user is '1', then the article has to be 1, 2, and 3 (which is impossible).

It would be easier to use a simple > evaluation, and just make sure the value is an integer before running the query.

for instance,

if( $userrights < 1 || !is_int($userrights) ) die("you have no rights.  get out.");

$sql = "
     select 
          id,
          content,
          link,
          rights 
     from 
          $db_menu 
     where 
          language='$language' and 
          title='$row[title]' and 
          rights <= $userrights order by 'content'
";

[kumschick]

the scipt works fine, but only it i do it this way:

$userrights=3;
if( $userrights < 1 || !is_int($userrights) ) die("you have no rights. get out.");

if i do it this way, I get always the error msg "you have no rights. get out."

while($row=mysql_fetch_array($...))
{
$user_rights=$row[user_rights];
}

$userrights=$user_rights;
if( $userrights < 1 || !is_int($userrights) ) die("you have no rights. get out.");

But I have to do it the 2nd way!

[Pig]

how is user rights set up? Is this a single field in a database? Why are you doing a mysql_fetch_array?

[kumschick]

I have disable this line, and now it works!

//if( $userrights < 1 || !is_int($userrights) ) die("you have no rights. get out.");

but I don't have the msg anymore. About the server rights, I'm the Server Administrator, I have full access and full rights.

I'm doing a fetch, because I have to get the userinformation out of the database, so that I know if the $user_rights are 1, 2 or 3.

Since every user have other rights.

[Pig]

If you are only retrieving one row of permissions (which is what it sounds like) then you want to use mysql_fetch_assoc(), not mysql_fetch_array().

If you comment out that line, then someone with no user rights at all will have the same access as someone with level 1 rights.

It is usually better to make higher number give higher access. Then you wouldn't have to do a check to see if the value != 0.