2. PHPRunner General questions
  3. Master / detail security access
This topic is locked

Master / detail security access

 		10/20/2008 5:59:16 PM
PHPRunner General questions
F
 frphilip author

Hi,
I've master-detail relationship, say orders / details.
I gave on the order the 'User can see others data, edit only their own datas'.
And on detail table 'User can only see their own datas'
It does work well BUT : In such case, one user can see order (not edit), but can add some details to this order !
any solution ?
J
 		Jane 10/22/2008

Hi,
I'm not sure that I understand you correctly.

'User can only see their own datas' security method allows to add new record to the table. Is it what you want?
F
 		frphilip author 10/22/2008

Hi Jane,
You understand well. but that's to say that an other user can add products in an order that he doesn't own (and on which he can't edit)
And that's not good. <img src='https://asprunner.com/forums/file.php?topicimage=1&fieldname=reply&id=34248&image=1&table=forumreplies' class='bbc_emoticon' alt=':)' />
say I'm a foreign user, consulting the orders :

  • I'm not allowed to edit an order, only seeing it. and if I want to see the rows (products ordered) of the order, I'cant see, anything, as I'm not the owner for these rows (detail table). This is correct.
  • What is not correct, is that I can add new rows (products) to the order.
    But I understand that this is a special situation, and PHPR is right in it's way to proceed. My question was to know if there is a way to avoid this problem...
J
 		Jane 10/23/2008

Hi,
I see what you're saying.

You can check order number and user permissions on the details list page and remove add link in the List page: Before display event on the Events tab.

Here is a sample:

global $strTableName;

$rs = CustomQuery("select OwnerIDField from MasterTable where MasterID=".$_SESSION[$strTableName."_masterkey1"]);

$data = db_fetch_array($rs);

if ($data["OwnerIDField"]==$_SESSION["_MasterTableName_OwnerID"])

$xt->assign("newrecord_controls",true);

else

$xt->assign("newrecord_controls",false);
F
 		frphilip author 10/25/2008

Jane, just one word, PHPR is incredibly powerfull <img src='https://asprunner.com/forums/file.php?topicimage=1&fieldname=reply&id=34383&image=1&table=forumreplies' class='bbc_emoticon' alt=':)' />