best practice - access level

[omegared]

Hello Folks,
I am working on a project that may very well be over my head but oh well. Hopefully my explanation will make sense.
I have a a few functions that generates the HTML inputs types like submit buttons, drop down, textfields, etc.
So far this has been working well, however now i need it to do something a bit more complicated.

Some more back story
Users log into the site. Different users have different access levels denoted by a number between 0 - 99 which is stored in the ddb. Different pages require a level in order to be viewed. If a user's access level is 50, and the page requires the user access level of 60 that user will not be allowed to visit said page. If the page is at 40 then the user will be able to see that page.

I want to implement that mechanism for inputs. I now want each input to have two levels. The minimum required to read and the minimum required to write.
For example. Useraccess level is 50. Input requires 40 to read but 60 to write. The input and its contents would be visible but the user would not be able to alter them. The function would basically set the input to disabled.

I have been experimenting and I've got this so far but I am at a loss on how to implement it. Should I use this code in every input function or is there a more "reusable" way of accomplishing this?

<?php
function test_button($privs, $limit_display='5', $limit_write='2'){
echo($limit_display);
echo($limit_write);

if($privs >= $limit_display){
	echo('Nothing is displayed');
	return false;
}else{
	//code
	echo('something is displayed');

	if($privs >= $limit_write){
		echo(' disabled');
	}
}

}

test_button('9');

[johanafm]

Something like this perhaps

class Button {
	private static buttons = 
		array(
			'register' => array('read' => 0, 'write' => 0, 'value' => 'Submit'),
			'edit_post' => array('read' => 10, 'write' => 100, 'value' => 'Update')
			/* etc */
		);

public static isValid($name) {
	return in_array(self::$buttons);
}

public static canRead($name, $userPriv) {
	if (!isValid($name))
		return false;		// possibly throwing exception or error logging might be an idea.
	return self::$buttons[$name]['read'] <= $userPriv;
}
public static canWrite($name, $userPriv) {
	if (!isValid($name))
		return false;		// possibly throwing exception or error logging might be an idea.
	return self::$buttons[$name]['write'] <= $userPriv;
}

// if you're using XHTML close input with /> instead of >
public static display($name, $userPriv) {
	if (self::canWrite($name, $userPriv))
		echo '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'">';
	else if (self::canRead($name, $userPriv))
		echo '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'" disabled="disabled">';
	return true;
}

// if you're using XHTML close input with /> instead of >
public static fetch($name, $userPriv) {
	if (self::canWrite($name, $userPriv))
		return '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'">';
	else if (self::canRead($name, $userPriv))
		return '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'" disabled="disabled">';
}
}

But just because you disable a button, you shouldn't expect requests coming only from user with enough privs. Users can easily create their own requests. So when you are about to insert/update anything, you should always check Buttons::canWrite() again.

[omegared]

Thank you for the post. Give me a bit as I need to understand and assimilate. I see you are using OOP style coding. And although I have seen and get some of it I am still a newbie. I am especially unsure of the '::'. I know that is using the class without having to instantiate it.

[johanafm]

It's used to access any static content inside the class. From outside the class you need Class::$var or Class::func(). Inside the class you can use self:: and parent:: as well as static:: from PHP 5.3. The purpose of the latter is explained http://se2.php.net/lsb and has no relevance unless you are using inheritance.

[omegared]

So my brain of mine is not present enough to both read and understand what is said on http://se2.php.net/lsb. But I can assure that some late, restless night I will study that page into oblivion. Until then I have a questions about the code you posted.

I first want to figure out what the code is doing. I hope to pick at it until i am comfortable I understand what going on. Unfortunately the code does not execute. I have found a few errors but I am now stuck. Below is what I have found so far. The ode generates an error at line 16. Says that isValid is undefined. I cant figure out why.

function word was missing from the original code and so was the $ at line 3. private static $buttons

I also have a question, the code you posted. Is the read and write static? As in once it is set can I not change it as need be. Some buttons may require a lower accesslevel.

Anyway, thank you for your patience.

<?php
class Button{
private static $buttons = array('register' => array('read' => 0, 'write' => 0, 'value' => 'Submit'),'edit_post' => array('read' => 10, 'write' => 100, 'value' => 'Update'));

public static function isValid($name){
	return in_array(self::$buttons); 
} 

public static function canRead($name, $userPriv) { 
    if(!isValid($name)) 
        return false;        // possibly throwing exception or error logging might be an idea. 
    return self::$buttons[$name]['read'] <= $userPriv; 
}

public static function canWrite($name, $userPriv) { 
    if(!isValid($name)) 
       return false;        // possibly throwing exception or error logging might be an idea. 
    return self::$buttons[$name]['write'] <= $userPriv; 
} 

// if you're using XHTML close input with /> instead of > 
public static function display($name, $userPriv) { 
    if(self::canWrite($name, $userPriv)) 
        echo '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'"/>'; 
    else if (self::canRead($name, $userPriv)) 
        echo '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'" disabled="disabled"/>'; 
    return true; 
} 

// if you're using XHTML close input with /> instead of > 
public static function fetch($name, $userPriv) { 
    if (self::canWrite($name, $userPriv)) 
        return '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'"/>'; 
    else if (self::canRead($name, $userPriv)) 
        return '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'" disabled="disabled"/>'; 
} 

}

Button::display('this_is_a_name',40);

[johanafm]

The reason it does not execute is that there is no button named "this_is_a_name".

// You call
Button::display('this_is_a_name', 400) // which calls
	self::canWrite(('this_is_a_name', 400),  // which calls
		isValid('this_is_a_name'), // which returns false, so nothing more happens
	self::canRead(('this_is_a_name', 400),  // which calls
		isValid('this_is_a_name'), // which returns false, so nothing more happens

You have to add your button to the buttons array first.

[omegared]

oh wow.
Yeah this works totally differently than what I expected. It can be said that the "buttons" are all within the class. If there were a button named Step1 it would have to be stipulated in the array. Ok then, but what if the Step1 button on PageA and the Step1 on PageB require different access levels? Could you override the preset values?
And where would you put the code that the button should execute?

[omegared]

What is the fetch function supposed to do in your example?

johanafm;10930307 wrote:

Something like this perhaps

class Button {
	private static buttons = 
		array(
			'register' => array('read' => 0, 'write' => 0, 'value' => 'Submit'),
			'edit_post' => array('read' => 10, 'write' => 100, 'value' => 'Update')
			/* etc */
		);

public static isValid($name) {
	return in_array(self::$buttons);
}

public static canRead($name, $userPriv) {
	if (!isValid($name))
		return false;		// possibly throwing exception or error logging might be an idea.
	return self::$buttons[$name]['read'] <= $userPriv;
}
public static canWrite($name, $userPriv) {
	if (!isValid($name))
		return false;		// possibly throwing exception or error logging might be an idea.
	return self::$buttons[$name]['write'] <= $userPriv;
}

// if you're using XHTML close input with /> instead of >
public static display($name, $userPriv) {
	if (self::canWrite($name, $userPriv))
		echo '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'">';
	else if (self::canRead($name, $userPriv))
		echo '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'" disabled="disabled">';
	return true;
}

// if you're using XHTML close input with /> instead of >
public static fetch($name, $userPriv) {
	if (self::canWrite($name, $userPriv))
		return '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'">';
	else if (self::canRead($name, $userPriv))
		return '<input type="button" name="'.$name.'" value="'.self::$buttons[$name]['value'].'" disabled="disabled">';
}
}

But just because you disable a button, you shouldn't expect requests coming only from user with enough privs. Users can easily create their own requests. So when you are about to insert/update anything, you should always check Buttons::canWrite() again.