A small question

[MattehCarter]

At the moment I am working on a large project with my friend, and I am currently creating a 'user rank' system, which determines what actions a user can take when they are logged in, for example a moderator will be able to delete and manage posts, whereas a user hasn't.

Earlier today, I created the following basic system

		public static function get_rank($id) {
			
			$rank = array (
			
				'0' => 'banned',
				'1' => 'user',
				'2' => 'moderator',
				'3' => 'administrator',
				'4' => 'owner'
			
			);
			
			$qry = mysql_query("SELECT * FROM `users` WHERE `ID`='$id'");
			$ass = mysql_fetch_assoc($qry);
			
			$rank = $rank[ $ass['rank'] ];
			
			return $rank;
			
		}

Which seemed to work quite well.

What I am wanting to do now, is advance the system a little bit. I would like to make it so if a users rank is an administrator, the $rank variable will be set to have all the ranks.

For example...

if($rank=4) {
$rank = user,moderator,administrator,owner;
}

I was wondering if there is a better way to set the ranks, instead of having several different if methods to set the ranking.

Hopefully I've explained it well,
Thanks!

Oh, I forgot to say that I was also looking to store the data in an array, so for an owner, the rank array would look like the following

$rank = array("user","moderator","administrator","owner");

I will then set permissions like the following

if(in_array("user",$rank)) echo 'Welcome'

 

[holthelper]

i would say keep it numeric and use < or > for the checks. as for the user rank just have it point to that function.

 

[MattehCarter]

I'm sorry, but that comment did not help at all.

 

[Negata]

In general, I think I'd rather set privileges as true/false flags. So you might have flags for "banned", "moderator", "admin", "owner". Flag by abilities, not by roles. This will leave your code more maintainable, for example we used to have "advisors" here on RZ, which were basically above moderators, but had no moderating tools. An enumerable system would not allow for this. Also I think it makes more sense in code to check against abilities rather than roles when you need to make a decision whether to render some UI element or something (which I see you do already).

However I admit there are probably some cases where it might make sense to have an enumerable rank, but if you don't need it now, you may as well put it aside for now as you can easily migrate your data and create an enumerable rank by the side later.

I know this isn't quite what you asked for, but in the long run I think it makes things less complicated.

 

[s-p-n]

Don't set numbers as strings. You should just store the ranks in the database, anyway.

You really should implement something like Negeta was talking about.

Basically, have a database of abilities. You can assign abilities to either ranks or users.

In my CMS, abilities are automatically created with each module, group, page, or piece of content created. There are view rights and change rights. Much like read/write/execute.

For example, there's a module called "Edit Content." If you have "view" rights for that page, you can see all of the content you have rights to change. From there you can edit that content. If you're a typical user, you can only edit the content you published, or someone gave you permission to edit. If you're a moderator, you can edit whatever content moderators are allowed to edit, and if you're any type rank with the "super-admin" ability, you can view/change everything.

One road block I ran into, was having the ability for users to grant permission to other users. What I had to do was make ranks themselves configurable based on permissions. By default, Administrators can configure all ranks except administrator. A rank can not configure it's own rank by default, so admins can't edit the admin rank. A user with super-admin ability can of course change this, but that's not a rank, it's an ability for users. Only super-admin can grant permission for super-admin, and by default, the only user who can configure "admin" rank.

We want moderators to be above users, but we don't necessarily want moderators to have the power to give users the "moderator" rank, or have the ability to grant "change" permissions for any given piece of content they have permission to change.

With that said, If you are author of a piece of content, admin, or a user with "super-admin" (by default) you can grant permission to other users to view/change content. An author cannot hide their content from moderators or administrators by default. I made it that way so that moderators can more efficiently do their jobs. If a malicious user can lock the cops out while they're terrorizing victims inside, the system is flawed.

I always make it possible for owners to flaw their own system, or change it to a way they like, but I tried to make a pretty intelligent default for what I call a pretty configurable permissions system.


I know I'm not directly answering your question, but by exploring the way I've done this, maybe you can get some ideas

 

[MattehCarter]

Thanks for the replies guys, it's opened my mind to new methods in which I could manage the issue.

At the moment, I am wanting to create set ranks/permissions for users, and then list them as either 'administrator', 'moderator' etc.

So, if I was going via your methods would it be best to create a range of values in the user table, for example 'banned' 'moderator' 'administrator' and base the privalages of those values?

And if I was to carry on with the system that I have implemented, how would I go about creating the array?

 

[Negata]

...I know I'm not directly answering your question, but by exploring the way I've done this, maybe you can get some ideas

Hey man, you stole and expanded on my response! Even the last line!

A better answer basing on your own CMS, definitely.

 

[s-p-n]

a table in SQL is like an array. Every time you need an array functionality in SQL, just make a separate table.

If I wanted to grab all users with rank admin, I might use a MySQL query like this:

SELECT users.username FROM users
JOIN user_ranks.name ON(user_ranks.user_id = users.id)
WHERE user_ranks.name = "admin"

That should return all the users who contain the "admin" rank

The users table has a key field "id" and a field "username"
The ranks table has a field "user_id" and a field "name"
We wouldn't really need a key field for user_ranks, as there will be multiple occurrences of user_id, just make it a normal integer.

Hey man, you stole and expanded on my response! Even the last line!

A better answer basing on your own CMS, definitely.

Well I had it on my mind before I read your response, but I read your response even more directly before posting so... my bad, I didn't realize it lol :/:

Well I kind of did,

You really should implement something like Negeta was talking about.

 

[MattehCarter]

Ah okay, thank you!