MVC Design – views with content for a usergroup
H0mebrewer’s Question:
I’m writing my first MVC application in PHP. I don’t want to use any framework.
Now I’m searching for a good solution or best practise to display elements for users in views, only if they are allowed to interact with the function that a specific element calls.
The app loads a template file in the view.
Within the template file I show the data from the model, which is passed from the controller to the view.
From controller
public function showUserList() {
$userList = $this->model->getUserList();
$this->view->loadTemplate($userList, 'user_list.php');
}
From view:
class user_view {
public function loadTemplate($data, $file, $buffer= false){
if($buffer === true){
ob_start();
include dirname(__FILE__).'/templates/'.$file;
$c = ob_get_contents();
ob_end_clean();
return $c;
}else{
include dirname(__FILE__).'/templates/'.$file;
}
}
}
Template:
<table class="table" id="data-table">
<thead>
<tr>
<th>Name</th>
<th>Username</th>
<th>E-Mail</th>
<th>Group</th>
<th>Action</th>
</tr>
</thead>
<tbody>
<?php
if(is_array($data)){
foreach($data as $key => $value){
?>
<tr>
<td><?php echo $data['name'].' '.$data['surname']; ?></td>
<td><?php echo $data['abbr']; ?></td>
<td><?php echo $data['email']; ?></td>
<td><?php echo $data['gr_name']; ?></td>
<td>
<div data-access="," onclick="$user_controller.showUserChangeView('<?php echo $data['id']; ?>')" class="btn btn-primary">edit</div>
<div data-access="checkAccess" onclick="$user_controller.deleteUser('<?php echo $data['id']; ?>')" class="btn btn-danger">delete</div>
</td>
</tr>
<?php
}
}
?>
</tbody>
</table>
</div>
I want to display buttons or menuitmes only, if a user is permitted to call the function of the button or the menuitem.
My first approach ist to create a template file with all elements which could be displayed. Elements which should not be accessible for all users get an data attribute.
The view loads the template, a DOM parser pareses the file, checks if the user is permitted to call that function with a data attribute.
If the user is not permitted to call that function, the element will be removed.
This is not yet implemented because I’m not sure if this is that a good solution or how I can do it even better?
My suggestion is to implement either ACL (Access Control List) or RBAC (Role Based Access Control) depending on what you find useful. I prefer RBAC so I will give a minimalistic example of one.
Create a list of all possible actions a user can make and define roles which might have acess to them.
// List of permissions (the actual term to define resources in RBAC) for the users
$actions = array(
'view' => array(ROLE_USER, ROLE_OWNER, ROLE_MANAGER, ROLE_ADMIN),
'edit' => array(ROLE_OWNER, ROLE_ADMIN),
'delete' => array(ROLE_OWNER, ROLE_ADMIN),
'change_pass' => array(ROLE_OWNER, ROLE_MANAGER, ROLE_ADMIN)
)
Now when you display the button for these actions, you can check if current user has any of the role which allows him to access the actions. If answer to that is “yes” then show them otherwise don’t show them at all.
$currentUserRole = '..'; //Retrieve however you want
foreach($actions as $allowed_roles) {
if(in_array($currentUserRole, $allowed_roels)) {
echo "<div ...>"; // Basically show the action
}
// If not carry on to next action with out showing
}
(Note: Not showing only might not be enough for it be secured, so we must also the check then when executing the action as well)
Update: You would the put the above code in the following part:
<table class="table" id="data-table">
<thead>
<tr>
<th>Name</th>
<th>Username</th>
<th>E-Mail</th>
<th>Group</th>
<th>Action</th>
</tr>
</thead>
<tbody>
<?php
if(is_array($data)){
foreach($data as $key => $value){
?>
<tr>
<td><?php echo $data['name'].' '.$data['surname']; ?></td>
<td><?php echo $data['abbr']; ?></td>
<td><?php echo $data['email']; ?></td>
<td><?php echo $data['gr_name']; ?></td>
<td>
$currentUserRole = '..'; //Retrieve however you want
foreach($actions as $allowed_roles) {
if(in_array($currentUserRole, $allowed_roels)) {
echo "<div ...>"; // Basically show the action
}
// If not carry on to next action with out showing
}
</td>
</tr>
<?php
}
}
?>
</tbody>
</table>
</div>
