Revision as of 00:52, 11 January 2008

Access control is a way you to give your users different permissions while working on folders and files. The default setting in the config.php file gives permission to every user and permits all the options. In order to change this configuration you must firstly know the basic of the $config['AccessControl'] function placed in the config.php file. 

The syntax of the function:

$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => '*',
'folder' => '/', 
'folderView' => true,
'folderCreate' => true,
'folderRename' => true,
'folderDelete' => true,

'fileView' => true,
'fileUpload' => true,
'fileRename' => true,
'fileDelete' => true);

The three most important parameters of the "Access Control" function are:

role

The role is an attribute which sets the type of the user. It is set to "*" as default and you may treat as 'every user'. You may set this parameter to other name like: 'user' or 'limited_functions'. The name of the user type will be directly connected to the function the user may use.

resourceType

The resourceType defines the resources handled in CKFinder. A resource type is nothing more than a way to group files under different paths, each one having different configuration settings, e.g. Images, Flash, Files. It is set to '*' as default and means that all of the resources are available.

folder

Folder determines where your limitations will be used. By placing the folders name you specify the place you want to put your restrictions in. It is set to '/' as default so no folder is set.

folder and file options

The rest of the variables are bool type and can be set as true or false. True of course enables an option, false disables it.
Example:
If you want to restrict the upload, rename or delete of files in the "Logos" folder of the resource type "Images":

$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => 'Images',
'folder' => '/Logos', 
'fileUpload' => false,
'fileRename' => false,
'fileDelete' => false);

The above example only refers to file operations in the folder '/Logos' itself. It doesn't restrict operations on the folder so the user can delete or rename the folder. In order to limit users ability to modify the folder (not its context) you should change permissions in the parent folder.
Example:

$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => 'Images',
'folder' => '/', 
'folderView' => true,
'folderCreate' => true,
'folderRename' => false,
'folderDelete' => false);

Now a user can view and create a folder, but he will be unable to rename or delete it. 

sessions

In order to enable the access control options for different users you should initialize the session data by uncommenting the "session_start()" call:

$config['RoleSessionVar'] = 'CKFinder_UserRole';
session_start();

The session is a mechanism which will allow you to give different permissions to different users.
Example:
In your config.php file you create three different roles:

First role admin (*):

$config['AccessControl'][] = Array(
'role' => '*',
'resourceType' => '*',
'folder' => '/', 
'folderView' => false,
'folderCreate' => false,
'folderRename' => false,
'folderDelete' => false,

'fileView' => false,
'fileUpload' => false,
'fileRename' => false,
'fileDelete' => false);

Second role user:

$config['AccessControl'][] = Array(
'role' => 'user',
'resourceType' => '*',
'folder' => '/', 
'folderView' => true,
'folderCreate' => true,
'folderRename' => false,
'folderDelete' => false,

'fileView' => true,
'fileUpload' => true,
'fileRename' => false,
'fileDelete' => false); 

Third role guest:

$config['AccessControl'][] = Array(
'role' => 'guest',
'resourceType' => '*',
'folder' => '/', 
'folderView' => true,
'folderCreate' => false,
'folderRename' => false,
'folderDelete' => false,

'fileView' => true,
'fileUpload' => false,
'fileRename' => false,
'fileDelete' => false);  

You've created three different users permissions.

Important: Note that when the role is set to * the user always has administrative privileges even though all the options are set to false.

Now you must create a place where you will point out the role you want to use e.g. a file. In this file you put initialize the session by writing session_start(); and write the command which will access you pre-defined role:

$_SESSION['CKFinder_UserRole'] ='*' - if you want to use the admin role.
$_SESSION['CKFinder_UserRole'] ='user' - if you want to use the user role. 
$_SESSION['CKFinder_UserRole'] = 'guest' - if you want to use the guest role