Skip to content
Snippets Groups Projects
  1. Sep 11, 2017
  2. Sep 30, 2016
  3. Jul 31, 2016
  4. Dec 20, 2015
  5. Nov 11, 2015
  6. Sep 02, 2015
  7. Jul 10, 2015
  8. Jul 09, 2015
  9. Jun 24, 2015
  10. Jun 15, 2015
  11. Jun 14, 2015
  12. Jun 13, 2015
    • PavelBegunkov's avatar
    • xamgore's avatar
      Explicit user rights management · 248dfda3
      xamgore authored
      It may seem that this commit is rather big, but it's not. Don't be afraid, just read the message. Recently we have understood that it was a bad idea to store rights for pages in a database. So I decided to move the information to PHP layer and make it more clear.
      
      When you write a new controller in Admin/ Dean/ Student/ folder, you should explicitly extend one of Controller_Environment_* classes, and all specific checks will be done there. Additional advantage is manipulating $user variable, so you will have access to extended fields of user, ie User_Student contains StudentID, but User_Teacher does not.
      
      Also, prefer -> operator to []. The reason is simple: IDE shows hints and mismatches only with the first one.
      
      The second important statement is User::checkAccess(User::RIGHTS_*) — call it at the top of *every* function in the Handler/ classes. Exception will be thrown, if user doesn't have enough rights.
      
      NB. If you want to overload "before()" function while extending Environment_* controller, do it in the right way:
      
          public function before() {
              parent::before();   // always first
      
              // any magic you like most
          }
      248dfda3