Zen Cart Logo
Forums / Zen Cart Code Suggestions / Suggestion for admin access check for non super users

Suggestion for admin access check for non super users

Views: 129

Results 1 to 3 of 3
08 Mar 2018, 22:05
#1
swguy avatar

swguy

Administrator

Join Date:
Feb 2006
Location:
Tampa Bay, Florida
Posts:
10,682
Plugin Contributions:
56

Suggestion for admin access check for non super users

admin/includes/functions/admin_access.php line 832: if we wrap this in

if (defined($result->fields['pageName']) && defined($result->fields['main_page'])) {
...
}

then the cart won't whitescreen if someone removes a mod prior to deleting the entries in the database for that mod.

08 Mar 2018, 22:47
#2
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,065
Plugin Contributions:
56

Re: Suggestion for admin access check for non super users

While making that edit, one of the things that's frustrated me is that calling check_page when a super-user is logged in will return false, so you have to check if the admin's a super-user or if they're authorized for that page.

Suggested edit to /admin/includes/functions/admin_access.php's check_page function:

function check_page($page, $params) {
    if (zen_is_superuser()) {
        return true;
    }
...
14 Mar 2018, 13:50
#3
mc12345678 avatar

mc12345678

Totally Zenned

Join Date:
Jul 2012
Posts:
16,908
Plugin Contributions:
2

Re: Suggestion for admin access check for non super users

Or adapt the foreach method introduced in ZC 1.5.5:

    $results = $db->Execute($sql);
    foreach ($results as $result)
    {
      if (!(defined($result['pageName']) && defined($result['main_page']))) continue;

      $retVal[$result['menu_key']][$result['page_key']] = array('name' => constant($result['pageName']),
                                                                                'file' => constant($result['main_page']),
                                                                                'params' => $result['page_params']);
    }

Otherwise for readability/historical versions would suggest something similar placed after the start of the while and before the assignment:

      if (!(defined($result->fields['pageName']) && defined($result->fields['main_page']))) {
      $result->MoveNext();
      continue;
    }

Regarding the modification to the check_page function, would suggest adding a parameter to the list defaulted to skip that additional test as the test/return modifies the type of information that the function returns. Currently it returns if the specific user has been specifically added to access the page requiring a further determination of whether the page should be shown to say super users or not (envision a "window" that is displayed only to non-super users or to specific super users.) Further it almost seems as if the assignment of the super user admin profile should enable all pages against that user as well as during the install/assignment of new such page(s) which is a different issue. In short, the function as currently written returns the condition of the specific user being granted permission rather than the possible "bigger picture" of granting all super users permission regardless of whether one should or should not be granted. It is as if almost that a denial group should be considered for addition like is used in other permission based systems (authorized user/group as well as denied user/group).