storing permissions into multi dimensional array php

Question

OK, I am just trying to get better at making more loosely coupled classes etc in PHP just to improve my skills. I have a local test database on my computer and for the user table I have a column named "role". I am trying to build a function that is a general function for getting permissions for a user so it doesn't depend on a specific task they are trying to do.

When a user tries to do something such as create a new forum topic etc, I want to query the database and if "role" is a certain value, store permissions in a multidimensional array like the following:

$permissions = array(
    'forums' => array("create", "delete", "edit", "lock"),
    'users' => array("edit", "lock")
);

Then I want to be able to search that array for a specific permission without typing the following at the top of every PHP file after a user posts a form by checking isset($var). So if the user is trying to edit a user I want to be able to do something like the following via a class method if possible

if (Class::get_permissions($userID),array($permissionType=>$permission))) {
   // do query
} else {
   // return error message
}

How would be a good way to have a loosely coupled permission checking function that will be able to do something like this? It doesn't have to be laid out exactly like this but just be loosely coupled so it can be reused and not be bound to a certain task. But I want to be able to have an array of permissions instead of just "admin","user", etc for reusability and so it doesn't restrict my options down the road. Because I have a bunch of code that is like this right now in the top of my php script files.

if (Class::get_permissions($userID) == "admin") {
   // allow query
} else {
   // return error
}

Thanks for any input to help me get this to where I don't keep writing the same stuff over and over.

Zend's ACL section has on ok introduction into how their acl's work: http://framework.zend.com/manual/en/zend.acl.introduction.html — James Butler, Dec 04 '11 at 20:25

Yes Barry · Accepted Answer · 2011-12-04T20:29:16.253

Your question is a little vague, but I will do my best. You said you're storing their permissions in an array $permissions.

public static $permissions = array();

public static function setPermissions($perms)
{
    if (!is_array($perms)) {
        throw new Exception('$perms must be an array.');
    }
    self::$permissions = $perms;
}

public static function hasPermission($section, $action)
{
    if (array_key_exists($section, self::$permissions)
        && in_array($action, self::$permissions[$section])
    ) {
        return true;
    }

    return false;
}

Using that logic, when you read a user's permissions from the DB, then set the Class::$permissions static var like so:

Class::setPermissions($permissions);
// ...
if (Class::hasPermissions($page, $action)) {
    // user has permission
}

Note, my code is pretty generic and will have to remain that way until I have more information. For now, I'm assuming your permissions array is using a page section as the index and the array is a list of actions within that page section that the user has access to. So, assuming $page has been set to something like "forums" and the user is currently trying to perform an edit (so $action = 'edit'), the Class::hasPermission() function would return true.

Thanks for the input. Have one question though. This way seems like I need to possibly store the array in a $_SESSION[] variable. Is this the way I should do it? Im just confused on what I should and shouldn't put in $_SESSION variables. Thanks! — vt-cwalker, Dec 04 '11 at 22:55

score 2 · Answer 2 · edited May 23 '17 at 12:19

2

I ran out of characters in the comments... But this is to your comment.

@corey instead of having a static object, I include a function that sets my permissions in the user's session. It as part of my LoginCommand class that gets called whenever the user logs in, obviously.

The permissions are then stored from view to view and I don't have to keep querying. The permissions check for most things only happen when the user logs in. However, certain sensitive things I'll run another query to double check. This has the disadvantage that, if the user's permissions change while the user has an active session, these changes won't be pushed to the user.

Remember to exercise good session security. PHP Session Security

The only reason you wouldn't store data in your session size is because your session got too big. But unless you sessions are megabyte's, you probably don't need to worry about this.

edited May 23 '17 at 12:19

Community

1
1

answered Dec 05 '11 at 00:11

phpmeh

1,752
2
22
41

so as long as EACH user's session variable is less than a megabyte you mean? So if I actually wanted to store about 6 fields of the users data such as first name, last name, username, userid, and email in a $_SESSION variable as a User object, that would be perfectly ok as far as scalability is concerned? – vt-cwalker Dec 05 '11 at 00:32
Yes. To get an approximation of session size, use: $size_of_session_estimate = strlen( serialize( $_SESSION ) ); At the point your sessions get too big, there are ways to dynamically set your session save path, etc. I've never seen someone's session get too big, but i've never worked at facebook, Amazon, etc... Also, vote my answer up. :) – phpmeh Dec 05 '11 at 00:40

storing permissions into multi dimensional array php

2 Answers2