我的cms中的用户权限

Question

I am developing a cms as my hobby and i got stuck on something....In my mysql db i have different classes of users:Admins, normal users, veterans, premium etc.....Is there a way to create a php file wich contains settings for each user class? And then to use a function or something to check if a certain user has the right to...create a page for example....

For the moment i am checking the users rights with sessions...

  If($_SESSION['user_type']=='Admin'||$_SESSION['user_type']=='premium'){
 //do stuff
 }else if()......... {
  // ..............
  }

but i want something like that

check_user_right(user_name);
if ($can_create_page) == true{
 do......}else{....}

Answer 1

First of all, you should know that you should be storing user information in the database. Then, when someone logs in and you verify the login, you can store his or her user ID in the session, and then to get all other user information, like user_type, you would query the database based on that ID. Not sure if you're doing that yet, but you should be if you aren't.

As far as user rights go, you have two options.

The OOP Way

This is the one I recommend. It entails creating a User class that encapsulates all of the logic for retrieving a user from the database and subsequently checking if that user has a specific right.

class User {
    protected static $_rights = array(
        'admin'=>array(
            'create_page','remove_page', etc...
        )
    );
    public static retrieve($id) {
        // Call to your database or persistent storage to retrieve user info based on id
        return new static($retrieved_user_data);
    }

    public function has_right($right) {
        return in_array($right, static::$_rights[$this->user_type]);
    }
}

The Non-OOP Way

This is much lower-level and may be better for you in the meantime. Basically you would create an array of rights per user level that you store in the same file as the function you use to check them. Then this function must in turn be included on every page you plan to use it.

E.g., say you put the function in a file called functions.php, and it looks like this:

$user_rights = array(
    'admin'=>array('create_page','remove_page','edit_user',...),
    'veteran'=>array('ban_user','edit_page'),
    // Other rights here
);
function has_right($user_id, $right) {
    global $user_rights;
    // Retrieve information from persistent storage about the user
    // which I'm assuming you will store in $user_info
    return in_array($right, $user_rights[$user_info['user_type']]);
}

Then you should include this file on any other file that you want to check user rights, and then all you need is the user ID (Stored in the session after log in) and the user type, which you can get from the database or other persistent storage.