CKFinder 2.x/Developers Guide/PHP/Configuration/Access Control - Revision history

J.swiderski at 15:02, 7 March 2013

2013-03-07T15:02:37Z

J.swiderski at 14:58, 7 March 2013

2013-03-07T14:58:20Z

Anna: roleSessionVar var replaced

2011-03-31T09:39:47Z

roleSessionVar var replaced

Anna: Sessions section moved to a template

2011-03-31T09:06:14Z

Sessions section moved to a template

Anna: ACL section moved to templates

2011-03-31T08:33:41Z

ACL section moved to templates

Wiktor: /* Sessions */

2010-05-17T07:27:19Z

‎Sessions

Wiktor: Created page with 'TOC Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.php file gives permission to e…'

2010-05-14T19:37:44Z

Created page with '__TOC__ Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.php file gives permission to e…'

New page

__TOC__

Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.php file gives permission to every user and permits all the options. In order to change this configuration you must firstly know the basic of the '''$config['AccessControl']''' settings placed in the config.php file. 

=== The syntax of the ACL Items ===

The syntax of the ACL entries is as followed:
<source lang="php">$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => '*',
'folder' => '/',

'folderView' => true,
'folderCreate' => true,
'folderRename' => true,
'folderDelete' => true,

'fileView' => true,
'fileUpload' => true,
'fileRename' => true,
'fileDelete' => true);</source>
{{ckfinder_acl_explanation}}

 

==== Example 1 ====

If you want to restrict the upload, rename or delete of files in the "Logos" folder of the resource type "Images":
<source lang="php">$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => 'Images',
'folder' => '/Logos',

'folderView' => true,
'folderCreate' => true,
'folderRename' => true,
'folderDelete' => true,

'fileView' => true,
'fileUpload' => false,
'fileRename' => false,
'fileDelete' => false);
</source>
The above example only refers to file operations in the folder '/Logos' itself. It doesn't restrict operations on the folder so the user can delete or rename the folder. In order to limit users ability to modify the folder (not its contents) you should change permissions in the parent folder.

==== Example 2 ====
<source lang="php">$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => 'Images',
'folder' => '/',

'folderView' => true,
'folderCreate' => true,
'folderRename' => false,
'folderDelete' => false

'fileView' => true,
'fileUpload' => true,
'fileRename' => true,
'fileDelete' => true);</source>
Now a user can view and create a folder, but he will be unable to rename or delete it.  

=== Sessions ===

The roleSessionVar is a session variable name that CKFinder must use to retrieve the "role" of the current user.
<source lang="php">$config['RoleSessionVar'] = 'CKFinder_UserRole';</source>
To switch between different user roles, simply change the session variable:
<source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";
</source>
{{CKFinder Sessions|lang=PHP}}
==== Example 3 ====

In your config.php file you can create three different roles:

First role, '''every user''' (wildcard "*" is used):
<source lang="php">$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => '*',
'folder' => '/',

'folderView' => true,
'folderCreate' => false,
'folderRename' => false,
'folderDelete' => false,

'fileView' => true,
'fileUpload' => false,
'fileRename' => false,
'fileDelete' => false);</source>
Second role, '''registered user''':
<source lang="php">$config['AccessControl'][] = Array(
'role' => 'registered',
'resourceType' => '*',
'folder' => '/',

'folderView' => true,
'folderCreate' => true,
'folderRename' => false,
'folderDelete' => false,

'fileView' => true,
'fileUpload' => true,
'fileRename' => false,
'fileDelete' => false);</source>
Third role, '''admin''':
<source lang="php">$config['AccessControl'][] = Array(
'role' => 'admin',
'resourceType' => '*',
'folder' => '/',

'folderView' => true,
'folderCreate' => true,
'folderRename' => true,
'folderDelete' => true,

'fileView' => true,
'fileUpload' => true,
'fileRename' => true,
'fileDelete' => true);</source>
You've created three different users permissions. The default user (everybody) is allowed to browse all files and folders. Registered user has also the ability to upload files and create folders. The administrator has full permissions. 

''''' '''''

Now let's say you have an authentication mechanism somewhere in your web application. In this file you initialize the session with '''session_start();''' command and assign one of the pre-defined roles to the user: 
<source lang="php">$_SESSION['CKFinder_UserRole'] ='admin';</source>
if you want to use the admin role.
<source lang="php">$_SESSION['CKFinder_UserRole'] ='registered';</source>
if you want to use the role assigned to registered users.
<source lang="php">$_SESSION['CKFinder_UserRole'] = 'guest';</source>
''guest'' doesn't have assigned any specific permissions, so the default values are used (defined with "*")
<source lang="php">$_SESSION['CKFinder_UserRole'] = 'any_other_value';</source>
same situation, default values are used.

@@ Line 48: / Line 48: @@
 'fileUpload' => true,
 'fileRename' => true,
-'fileDelete' => true);</source>||wildcard_resource='resourceType' => '*'}}
+'fileDelete' => true);</source>||wildcard_resource=('resourceType' => '*')}}
 {{CKFinder_2.x Sessions|lang=PHP|roleSessionVar=RoleSessionVar|file=<code>config.php</code>|code1=<source lang="php">$config['RoleSessionVar'] = 'CKFinder_UserRole';</source>|code2=<source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";</source>|code3=

@@ Line 48: / Line 48: @@
 'fileUpload' => true,
 'fileRename' => true,
-'fileDelete' => true);</source>}}
+'fileDelete' => true);</source>||wildcard_resource='resourceType' => '*'}}
 {{CKFinder_2.x Sessions|lang=PHP|roleSessionVar=RoleSessionVar|file=<code>config.php</code>|code1=<source lang="php">$config['RoleSessionVar'] = 'CKFinder_UserRole';</source>|code2=<source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";</source>|code3=

@@ Line 50: / Line 50: @@
 'fileDelete' => true);</source>}}
-{{CKFinder_2.x Sessions|lang=PHP|file=<code>config.php</code>|code1=<source lang="php">$config['RoleSessionVar'] = 'CKFinder_UserRole';</source>|code2=<source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";</source>|code3=
+{{CKFinder_2.x Sessions|lang=PHP|roleSessionVar=RoleSessionVar|file=<code>config.php</code>|code1=<source lang="php">$config['RoleSessionVar'] = 'CKFinder_UserRole';</source>|code2=<source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";</source>|code3=
 <source lang="php">$config['AccessControl'][] = Array(
 'role' => '*',

@@ Line 50: / Line 50: @@
 'fileDelete' => true);</source>}}
-=== Sessions ===
+{{CKFinder_2.x Sessions|lang=PHP|file=<code>config.php</code>|code1=<source lang="php">$config['RoleSessionVar'] = 'CKFinder_UserRole';</source>|code2=<source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";</source>|code3=
 <source lang="php">$config['AccessControl'][] = Array(
 'role' => '*',
@@ Line 76: / Line 64: @@
 'fileUpload' => false,
 'fileRename' => false,
-'fileDelete' => false);</source>
+'fileDelete' => false);
-Second role, '''registered user''':
+</source>|code4=
 <source lang="php">$config['AccessControl'][] = Array(
 'role' => 'registered',
@@ Line 91: / Line 79: @@
 'fileUpload' => true,
 'fileRename' => false,
-'fileDelete' => false);</source>
+'fileDelete' => false);
-Third role, '''admin''':
+</source>|code5=
 <source lang="php">$config['AccessControl'][] = Array(
 'role' => 'admin',
@@ Line 106: / Line 94: @@
 'fileUpload' => true,
 'fileRename' => true,
-'fileDelete' => true);</source>
+'fileDelete' => true);</source>}} In this file you initialize the session with the <code>session_start();</code> command and assign one of the pre-defined roles to the user in the following way &mdash; using the admin role:
-You've created three different users permissions. The default user (everybody) is allowed to browse all files and folders. Registered user has also the ability to upload files and create folders. The administrator has full permissions.<br>
+{{CKFinder_2.x Sessions_Details|code1=
+<source lang="php">$_SESSION['CKFinder_UserRole'] ='admin';</source>|code2=
-'''''<br>'''''
+<source lang="php">$_SESSION['CKFinder_UserRole'] ='registered';</source>|code3=
+<source lang="php">$_SESSION['CKFinder_UserRole'] = 'guest';</source>|code4=
-Now let's say you have an authentication mechanism somewhere in your web application. In this file you initialize the session with '''session_start();''' command and assign one of the pre-defined roles to the user:<br>
+<source lang="php">$_SESSION['CKFinder_UserRole'] = 'any_other_value';</source>}}

@@ Line 68: / Line 68: @@
 <source lang="php">$_SESSION['CKFinder_UserRole'] = "admin";
 </source>
-{{CKFinder Sessions|lang=PHP}}
+{{CKFinder_2.x Sessions|lang=PHP}}
 ==== Example 3 ====