This topic is locked
[SOLVED]

 Hide or disable "Edit" button based on another field value

1/7/2020 11:39:57 AM
PHPRunner General questions
M
mhollibush author

I am trying to come up with a solution, maybe someone has a easy idea
On the site ( pedigree of dogs ) I want the ability to "lock" users from editing a dog if the checkbox is selected
Example - admin can click on the "certified" checkbox ( admin page custom view ) and that will disable / hide the "edit" button from users ( even the one that created the entry ).
Have a snippet that displays a "Record Is Locked" if the checkbox value is > 0
I am concerned that someone can just modify the url to edit if they are the record "owner" ( can see other users data, but can edit their own data only )
any guidance or suggestions would be appreciated

HJB 1/7/2020

https://www.youtube.com/watch?v=FuFqigYLv_w
... for inspiration purposes only ...

A
acpan 1/7/2020

Check out this tutorial -
hide edit buttons conditionally based on the field data
And also highly recommend to watch Corrie's Youtube Tutorials, it is not specific to solving this problem but provides very good fundamentals with using PHPRunner.
ACP

M
mhollibush author 1/8/2020

Based on the Youtube video and also the example, I was able to get it to work


///Before Display

if ($values["certified"] == 1)

{

$pageObject->hideItem("view_edit1");

$pageObject->hideItem("view_edit");

}


Tested with Admin account and user account

M
mhollibush author 1/8/2020

there is a issue with this method!
If the user is logged in and has access to edit records, all they have to do is change the url
table_view.php?edit1id=
to
table_edit.php?edit1id=
this is not what I wanted to accomplish. It needs to prevent users from access the edit page....
Back to the drawing board...

W
WilliamBDevClub member 1/8/2020



there is a issue with this method!
If the user is logged in and has access to edit records, all they have to do is change the url
table_view.php?edit1id=
to
table_edit.php?edit1id=
this is not what I wanted to accomplish. It needs to prevent users from access the edit page....
Back to the drawing board...


Try using the Security API based on the field value.

A
acpan 1/9/2020

Glad you solved your problem yourself!
Care to share a bit how you solve it to benefit other people here?
Not sure if i need to say the obvious, click solved button and not sharing how you solve after asking for help may make people not responding to your question in future.
ACP

M
mhollibush author 1/9/2020



Glad you solved your problem yourself!
Care to share a bit how you solve it to benefit other people here?
Not sure if i need to say the obvious, click solved button and not sharing how you solve after asking for help may make people not responding to your question in future.
ACP


It actually wasn't solved... everything worked as thought until I checked the ability to just change the URL to edit and the user is allowed in to the edit page..

So I am looking up security in API and seeing how I can over come this...

A
acpan 1/10/2020

it is actually quite simple, many ways to achieve that, eg. at edit page events:
if ( !(Security::isAdmin()) )
do a redirect to main page or echo "Not Allowed" and return false;
Good luck!



It actually wasn't solved... everything worked as thought until I checked the ability to just change the URL to edit and the user is allowed in to the edit page..

So I am looking up security in API and seeing how I can over come this...

M
mhollibush author 1/10/2020



https://xlinesoft.com/phprunner/docs/disable_record_editing.htm
... now it's SOLVED!


"Hiding" the object doesn't stop the user from changing the url to the edit page...

This is a security issue

I am able to hide the edit button with no issues... the issue becomes that anyone that is logged in can simply change the url and they can access the edit page.

M
mhollibush author 1/10/2020



it is actually quite simple, many ways to achieve that, eg. at edit page events:
if ( !(Security::isAdmin()) )
do a redirect to main page or echo "Not Allowed" and return false;
Good luck!


Reading up on this... the security has to be based on whether the "certified = 1"

If certified = 0 then editing is allowed

if certified = 1 then only the Admin can edit
pushing through... trying to get a grasp...

HJB 1/10/2020



Reading up on this... the security has to be based on whether the "certified = 1"

If certified = 0 then editing is allowed

if certified = 1 then only the Admin can edit
pushing through... trying to get a grasp...


https://xlinesoft.com/phprunner/docs/makereadonly.htm
... for inspirations purposes only, say, HIDING is one thing, READ ONLY status of your URL field the other.

A
acpan 1/10/2020

OK,
Please read the updated tip here.
What it does:

  1. Using "Is Record Editable" event to test for conditions of user_id AND each row's specific field data, in this case, "record_locked" field, in your case "Certified" field.
    Replace the user id with your admin user id in your database. You can also use other field that is unique (eg. email) as a check condition.
  2. "Is Record Editable" event will automatically hide edit buttons and prevents direct access to the Edit page URL when conditions (user_id == 1 AND record_locked == 1) are met.
  3. You can replace record_locked field with Certified field for your purpose.
    I believe this will do what you want.
    ACP
    >Reading up on this... the security has to be based on whether the "certified = 1"

    >If certified = 0 then editing is allowed

    >if certified = 1 then only the Admin can edit

M
mhollibush author 1/11/2020

This is exactly what I was trying to accomplish!

thank you for the post and the walk through...

Works Like A Charm.
http://bullyregistry.com/dog_view.php?editid1=71013

A
acpan 1/11/2020

Glad it helps and thanks for sharing how it looks like. Very Nice!



This is exactly what I was trying to accomplish!

thank you for the post and the walk through...

Works Like A Charm.
http://bullyregistry.com/dog_view.php?editid1=71013