Filter access for users

Hi,
Unfortunately PHPRunner do not support multiple OwnerID values.

You need to implement it manually using Before SQL query event on the Events tab.
To add where clause to the main SQL query use whereAdd function. Here is a sample:

$strWhereClause = whereAdd($strWhereClause,"FieldName=1 or FieldName='2' or FieldName='3'");

Hi,

Thanks Jane,

but in future it will be possible to handle this situation?
Or, to be able to manage this problem, I can edit the file login.php?
//-----------------------------------------------------------------

$rs=db_query($strSQL,$conn);

$data=db_fetch_array($rs);

if($data && @$data[$cUserNameField]==$sUsername && @$data[$cPasswordField]==$sPassword)

{

$_SESSION["UserID"] = $pUsername;

$_SESSION["AccessLevel"] = ACCESS_LEVEL_USER;
$_SESSION["GroupID"] = $data["Utente"];

if($_SESSION["GroupID"]=="admin")

$_SESSION["AccessLevel"] = ACCESS_LEVEL_ADMINGROUP;
$_SESSION["OwnerID"] =$data["Codice_Filtro"];

$_SESSION["_clienti_OwnerID"] = $data["Codice_Filtro"];

$_SESSION["_contatti_OwnerID"] = $data["Codice_Filtro"];

//-----------------------------------------------------------------
instead of using the string = $data["Codice_Filtro"];

according to your opinion, can I please use the command: IN SELECT
if this is possible, you can give me an example?
If the problem is not very clear, I can send you an example PHPRunner5 including a small mysql database?
Thanks for your valuable cooperation and quick ...

Hi,
to change where clause check SecuritySQL function in the generated include/commonfunctions.php file.

Hi,

Hello Jane,

I found the string of code that will carry over in a row, but you can suggest how to change it, or I can give an example of how the user can access using a subselects from another table, type IN (SELECT ZONE FROM TableName WHERE .. ..) if you are not an administrator.
Thanks as always for your help.
//--------------------------------------------------------------------------

// add security WHERE clause to SELECT SQL command

function SecuritySQL($strAction)

{

global $cAdvSecurityMethod,$strTableName;

$ownerid=@$SESSION["".$strTableName."_OwnerID"];

$ret="";

if(@$_SESSION["AccessLevel"]==ACCESS_LEVEL_ADMIN)

return "";

$ret="";
$strPerm = GetUserPermissions();
if(strpos($strPerm,"M")===false)

{

if($strTableName=="cde")

{

$ret=GetFullFieldName(GetTableOwnerID())."=".make_db_value(GetTableOwnerID(),$ownerid);

}

if($strTableName=="clienti")

{

$ret=GetFullFieldName(GetTableOwnerID())."=".make_db_value(GetTableOwnerID(),$ownerid);

}

//--------------------------------------------------------------------------

Hi,
Here is a sample:

$ret=GetFullFieldName(GetTableOwnerID())." in (".make_db_value(GetTableOwnerID(),$ownerid).")";

Hi,

Thanks Jane,

the method seems to work, but how can I not apply it to the Admin, but apply only to non-Admin?
Furthermore, I could use the IN (SELECT ...)

Example:

$ret=GetFullFieldName(GetTableOwnerID())." in ("select Zona from `abilitaz_filtro` where Codice='".db_addslashes($_SESSION["UserID"])."'";
But the system I report an error in the syntax

Hi Jane,

I understood that to solve the problem as you have suggested implement it manually using Before SQL query event on the Events tab.
We ask you to help me correct the following code:
global $conn;

$query = "SELECT Zona FROM Abilitaz_filtro WHERE utente='".$_SESSION["UserID"]."'";

$res = db_query($query, $conn);

$row = db_fetch_numarray($res);

$strWhereClause = "Zona=$query";
I have a table "Customers" and I want that every user who logs on to this table, I can filter only its customers, namely those of his own zone.

This information is provided on the tables "Abilitaz_Filtro"
id, utente, zona

1 Rossi 10

2 Rossi 13

3 Rossi 18

4 Pluto 10

5 Mario 13

6 Mario 20
At this point I would like each user can see only the customers of their areas as per the table above.
If you need you send the application to see if you can resolve this issue.
Thank you very much as always for your valuable help, I hope you can resolve this issue

Hi,
see my changes below:

$strwhere = "";

Hi,

Hi Jane,

Unfortunately the system I have a syntax error the following line:

$strwhere.=$row["Zona"],",";
You can help me solve?

Try $strwhere.=$row["Zona"].",";