1
\$\begingroup\$

I've added a function that checks if the user is trying to use/access something which requires a session. I'd love to hear some criticisms of my choice of design.

class MY_Controller extends CI_Controller {

    function __construct() {
        parent::__construct();
        if(!$this->input->is_ajax_request()) {
            if(!$this->session->userdata('is_logged_in')) {
                $this->load->view('header_public_view');
                if($this->login_required())
                  //do something, redirect etc..
            }
            else {
                $this->load->model('user_model');
                $data['user'] = $this->user_model->get_user($this->session->userdata('userid'));
                $this->load->view('header_user_view', $data);
            }
        }

    }

    function login_required() {
        if($this->uri->total_segments() > 3)
            $request = $this->uri->segment(3);
        else
            $request = $this->uri->segment(2);
        foreach(unserialize(SESSION_RESOURCES) as $required) {
            if($request == $required)
                return true;
        }
    }

}
\$\endgroup\$
1
\$\begingroup\$

You don't really need to check for is_logged_in. If you destroy/build the session data correctly all you should care about is "Does a user id exist in the session?", then you can let your main controller handle the rest.

class MY_Controller extends CI_Controller{

    //here we just build some constants to check against values
    //in the permissions array
    const PERM_READ = "read";
    const PERM_EDIT = "update";
    const PERM_DELETE = "delete";

    //here we let the main controller take care of our auth/permissions/roles etc
    //first check if a user id exists in the session
    //if so assign a user, group, permissions and check for authentication where
    //you need it ( ie: child controllers)

    protected $_user, $_group, $_permissions = array();

    public function __construct(){
        parent::__construct();

        //check for a user id in the session
        $this->user = ( $this->session->userdata('uid') )
                    ? User::find_by_id( $this->session->userdata('uid') )
                    : NULL;

        //if user exists assign permissions and group
          if ($this->user !== NULL) {
              $this->_assign_group();
              $this->_assign_permissions();
              $this->_check_for_banned_users();
          }

    }

    protected function _assign_group() {
        return $this->group = $this->user->group->name;
    }


    // {["read", "update", "delete"]}
    protected function _assign_permissions() {
        return  $this->permissions = json_decode($this->user->permissions);
    }

    protected function _check_for_banned_users() {
        if ($this->group === 'banned') {
            show_error('You have been banned from this website!');
            return;
        }
    }

    protected function _can_read(){
        return (bool) ( in_array( self::PERM_READ, $this->permissions) );
    }

    public function _can_edit(){
        return (bool) ( in_array( self::PERM_EDIT, $this->permissions) );
    }

    public function _can_delete(){
        return (bool) ( in_array( self::PERM_DELETE, $this->permissions) );
    }
} 

This might give you some idea, as your user table won't look like that, I'm sure.

Now, you have control over any child classes.

class some_child extends MY_Controller{

     public function __construct(){
         parent::__construct();
     }
     public function show_something(){

          if($this->is_ajax_request()){
              if($this->user && $this->_can_read()){
              //yes a user exists and is logged in,
              //yes he has permission to read from this section
              $this->load->view('some_view');
              }
          }
          else
             show_404();
     }
}

Just be careful to destroy your session properly.

function logout(){
    $this->session->set_userdata(array(
         'uid'  => 0,
         //any others you created upon user login
    ));
    return (bool) $this->session->sess_destroy();
}
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.