Xataface Forums

hello everybody

I was wondering if it was possible to grant permissions to add/delete and edit records in a table on a role basis (maybe owner?), but only for the records he/she has added. To make it even more complicated i would like to show (view) only records which were added by this user , so that every user only can see his records.

did anybody of you ever try this? could you give me a hint towards the right direction?

cheers
martin

Hi Martin,

Good questions. I have been doing this sort of thing pretty regularly in my dataface apps. To have an "owner" role, you would likely need to have a column in your table called "owner" or something like it to keep track of who owns which record.

Then you could do something like:

Code: Select all

function getPermissions(&$record){
    $auth =& Dataface_AuthenticationTool::getInstance();
    $user =& $auth->getLoggedInUser();
    if ( !$user ) return Dataface_PermissionsTool::NO_ACCESS();
    if ( $user->val("username") == $record->val('owner') ){
        return Dataface_PermissionsTool::ALL();
    }
}


As far as making it so that the user can only see records created by himself, the most effective way, I have found is to sort of cut off the list view from your users, and use relationships instead.

Hence your users table would have relationships defined for all of the things that your users need to see.

-Steve

>hi steve and thanks for your fast reply..


I tried your code snippet but unfortunately it produces a fatal error after login

>

Fatal error: Call to a member function on a non-object in /data/mad/haschisch-online.de/www/html/df69/cdb/conf/ApplicationDelegate.php on line 32


>


>

I tried this on a windows machine and as well on a linux machine ...the result was the same

ApplicationDelegate.php  line 32 is this line:
Code: Select all
 if ( $user->val("username") == $record->val('owner') ){


>do you have any ideas?



cheers martin

Looks like you have to to a check to make sure that $record is not null (if there are no records found then it will be null).

Something like
if ( !isset($record) ) return Dataface_PermissionsTool::ALL();

hi steve
here is what i tried in my ApplicationDelegate.php:

Code: Select all

function getPermissions(&$record){
    $auth =& Dataface_AuthenticationTool::getInstance();
    $user =& $auth->getLoggedInUser();
   
   if ( !$user ) return Dataface_PermissionsTool::NO_ACCESS();
//////////////////////////////////////////////
// this works of course
// $owner = "dave";
// if ( $user->val('UserName') == $owner ){
//////////////////////////////////////////////
if ( !isset($record) ) {
    if ( $user->val('UserName') == $record->val('owner') ){
       return Dataface_PermissionsTool::ALL();
       }
   return Dataface_PermissionsTool::ALL();
   }
  }


at least I now get a nicely formattet Error message eg:
Errors
* Permission to perform action 'list' denied.
Requires permission 'view' but only granted ''



and on top of the site I find these lines:

-------------error msg.-------------------------------
On line 324 of file E:\schlumpp\htdocs\df6.11\Dataface\PermissionsTool.php in function printStackTrace()
On line 341 of file E:\schlumpp\htdocs\df6.11\Dataface\PermissionsTool.php in function namesAsArray()
On line 790 of file E:\schlumpp\htdocs\df6.11\Dataface\Application.php in function namesAsString()
On line 1152 of file E:\schlumpp\htdocs\df6.11\Dataface\Application.php in function handleRequest()
On line 19 of file E:\schlumpp\htdocs\df6.11\cdb\index.php in function display()

Warning: Invalid argument supplied for foreach() in E:\schlumpp\htdocs\df6.11\Dataface\PermissionsTool.php on line 326

Warning: implode() [function.implode]: Bad arguments. in E:\schlumpp\htdocs\df6.11\Dataface\Application.php on line 792
--------------end error msg.----------------------------

i only have 2 tables : 1. questions and 2. users
the users table is simply the users table from your FacultyOfWidgetry example
and the questions table has a field named "owner" .
the table questions only contains two records and the field "owner", in both cases is not empty.

thx in advance
martin

it looks like you want to have
if ( isset($record) )
rather than
if ( !isset($record) )

If (isset($record)) is leading to: Fatal error: Call to a member function val() on a non-object in E:\schlumpp\htdocs\df6.11\cdb\conf\ApplicationDelegate.php on line 39

What is on line 39?

isset($record) will not result in that error. That error results when you do something like:
$obj->func();
but $obj is actually null or not an object.

-Steve

line 39 says:
if ( $user->val('UserName') == $record->val('owner')){

the whole function looks like this:
[code]
class conf_ApplicationDelegate {
function getPermissions(&$record){
$auth =& Dataface_AuthenticationTool::getInstance();
$user =& $auth->getLoggedInUser();
if ( !$user ) return Dataface_PermissionsTool::NO_ACCESS();
if ( !isset($record) ) {
if ( $user->val('UserName') == $record->val('owner')){
return Dataface_PermissionsTool::ALL();
}
return Dataface_PermissionsTool::ALL();
}
}
}