Remove Export XML and RSS

[msergent]

Is there a way to remove the Export XML and RSS buttons? I have searched and have not found an easy way to hide them.

Also I set the show_actions_menu=0 flag but the actions still show.

_Mark

[shannah]

If you want to just remove the icons from the interface but aren't concerned with preventing the use of these actions altogether you can simply override the actions in your actions.ini file and set condition=0.

E.g.

Code: Select all

[export_xml > export_xml]
    condition=0

[view_xml > view_xml]
    condition=0

[rss > rss]
    condition=0

[record_rss > record_rss]
    condition=0

[related_rss > related_rss]
    condition=0

[related_xml > related_xml]
    condition=0

[feed > feed]
    condition=0

[xml_list > xml_list]
    condition=0


This will effectively hide the actions from the interface but users will still be able to access them by entering their URL directly. If you are concerned about this, it is probably better to use permissions instead to limit access to these.

The easiest way to see which permissions you want to block is to check out the READ ONLY role in the xataface permissions.ini file and take note of the ones that pertain to xml and rss. You can then make sure that the custom roles that you assign to your users don't include those permissions (or explicitly exclude them).

-Steve

[msergent]

Thank you Steve, I think hiding them for the moment will workout just fine. I will explore the other option as well. I am still trying to learn the permissions and stuff.

By the way I loved the dashboard article. I was able to setup a dashboard for my application. Took a while to get the permissions worked out. I ended up with the following in my ApplicationDelegate.php file:

Code: Select all

function beforeHandleRequest(){
      $auth =& Dataface_AuthenticationTool::getInstance();
            $user =& $auth->getLoggedInUser();
      if ( !isset($user) ) return Dataface_PermissionsTool::NO_ACCESS();
           $app =& Dataface_Application::getInstance();
           $query =& $app->getQuery();
           if ( $query['-table'] == 'dashboard' ){
               $query['-action'] = 'dashboard';
           }


With the original you could never login. Now the dashboard is hidden until the user logs into the site.

And the other question concerning the show_actions_menu=0 preference not working. Any ideas on why it does not hide the menu items?

[shannah]

Glad to know you got it working. Just a note, you don't need to return any permissions from the beforeHandleRequest() method. You could just as easily replace the line

Code: Select all

if ( !isset($user) ) return Dataface_PermissionsTool::NO_ACCESS();


with

Code: Select all

if ( !isset($user) ) return ;


[msergent]

Thank you Steve for that tip. I have used xataface for two projects now, one is a central repository for our 400+ sites in the US which holds information such as network devices, voice systems, circuit id's, site diagrams and other site documentation, reports for port counts, etc.

So far it is looking really nice, I have our server and desktop departments interested in adding their information to the repository as well.

The other project is for a small startup company's user/client database. Do you have a method/example for adding an account approve/disapprove view for new accounts/records? I am looking into adding that feature as a simpler method for a third party account approver with limited rights.

When I finish I hope to post the applications as examples that others might be able to adjust and reuse.

[shannah]

Do you have a method/example for adding an account approve/disapprove view for new accounts/records? I am looking into adding that feature as a simpler method for a third party account approver with limited rights.

I imagine you just have a field called "approved" or "status" as part of the table to indicate whether the record has been approved or not?
Did you look at the "Selected Records Actions" article that I posted yesterday in the newsletter? It does something very similar.

http://xataface.com/wiki/Selected_Records_Actions

-Steve

[silma]

Hello,

I'm sorry to "dig" this topic, but i try to disable or at least hide the export & rss actions, without success.

I've tried with the action code above, and with the permissions; I even searched in the templates files

I'm running out of ideas, and my rss & xml export buttons are still there.

Thanks a lot for the help!

[TBriggs]

I'm no expert at this, but I have the following in my actions.ini file and it seems to hide these options:

[export_xml]

[view_xml]

[rss]

[record_rss > rss]

[related_rss]

[related_xml > export_xml]

[feed]

[xml_list]

[silma]

It works !
Thanks a lot

[dgoadby]

Yes, this works a treat except I would like to find out why it worked. I guess I created new (empty) actions that override the existing ones.

I am a Xataface newbie and it seems that there is a lot of power and flexibility here if only it were documented. The sections on .ini files didn't help much either.

It's an excellent piece of work so I will stick with it and doubtless start to look inside the code for it's secrets. If I get time then, who knows, I might start updating the documentation.

David Goadby, North Wales UK

[shannah]

The strategy suggested here is actually not the preferred approach. Adding these sections to your actions.ini file essentially overrides the existing actions of the same names with empty actions (no category/url/icon/permissions etc.. attached). The problem is that this strips the permission attribute from these actions so that they are wide open. They action disappears because they no longer have "category" attributes to specify where the action should appear in the UI. But the action still exists and can be accessed by entering the correct URL directly. And because the permissions have been stripped, the action is wide open.

It would be better to use permissions to disable these actions. That way they action is not only hidden. It is disabled.

Check the permissions.ini file for a list of the permissions that are available. There are generally permissions corresponding to each action. Denying users these permissions will securely achieve what you want.

[dgoadby]

Thanks for a very detailed replay - much appreciated.

I did have a look at the permissions.ini file and I now need to find out exactly how it works before I start changing it Some of the comments help but I would like more information so can you point me to some documentation or code to help me?

Thanks

David Goadby, North Wales UK.

[shannah]

There's quite a bit of documentation in the wiki. E.g. the permissions.ini file wiki page:
http://xataface.com/wiki/permissions.ini_file

Or just check out the security section on the main page of the wiki for a list of articles related to authentication and permissions.

[dgoadby]

Thanks for the pointers. I am just starting to find my way around and I now have all I need to get my configuration sorted out. I may even get brave and change the site style next!

Thanks for your support. This really is a great product!

Regards

David