Permissions to read/write data

[mevdschee]

Permissions to read/write data

[Disane87]

Actually I got it working:

//uncomment the lines below when running in stand-alone mode:
require             "lib/php_crud_api_transform.php";
require_once    "lib/medoo.php";

function checkPermission($action,$database,$table,$user,$pass){
    $database = new medoo([
    'database_type' => 'mysql',
    'database_name' => '',
    'server' => 'localhost',
    'username' => '',
    'password' => '',
    'charset' => 'utf8'
    ]);

    $uid =  $database->get("Benutzer", "ID", ["Alias" => $user] );
    $sid =  $database->get("SecuritygroupsUsers", "Securitygroup_ID", ["User_ID" => $uid] );
    $p =        $database->get("SecuritygroupsPermissions", ucfirst($action), ["AND" =>  ["Securitygroup_ID" => $sid, "Tablename" =>  $table]] );

    $database->insert("APILog", [
        "User" => $user,
        "Table" => $table,
        "Action" => ucfirst($action),
        "Granted" => (bool) $p
    ]);

    return (bool) $p;
}

if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="My Realm"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Du musst eingeloggt sein um die API nutzen zu koennen';
    exit;
} elseif ($_SERVER['PHP_AUTH_USER']=='anonym' && $_SERVER['PHP_AUTH_PW']=='anonym') {

} else {
    header('HTTP/1.0 403 Forbidden');
}

$api = new PHP_CRUD_API(array(
    'dbengine'=>'MySQL',
    'hostname'=>'localhost',
    'username'=>'',
    'password'=>'',
    'database'=>'',
    'charset'=>'utf8',
    'table_authorizer' => function($action,$database,$table) {
        return checkPermission($action,$database,$table, $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
    }
));
$api->executeCommand();

I only have to implement the way for other users than "anonym".
My SecurityTable-Structure is like:

I also included a table for logging api-calls:

I initially generated default permissions for new tables like this:

INSERT INTO SecuritygroupsPermissions (`Table`, `create`, `retrieve`, `update`, `delete`, `Securitygroup_ID`, Kommentar) 

SELECT 
    Table_NAME, 
    0 as `create`, 
    0 as `retrieve`,
    0 as `update`,
    0 as `delete`,
    Securitygroups.ID,
    CONCAT(table_name,' ',Securitygroups.`Name`) as `Name`
FROM 
    information_schema.`TABLES` 
    CROSS JOIN Securitygroups
WHERE 
    TABLE_SCHEMA = 'd020a380'

It was a bit tricky cause first I used the api to check the security, which results in a very bad recursion, so I decided to check them with a third party mysql class and fire "stupid" sql statements.

I know, this is not the best aproach at all but if you have some better ones, I would appreciate them.

[mevdschee]

Maybe you can check for a header value in the permission function?

[mevdschee]

Check out: https://github.com/mevdschee/php-crud-api/blob/master/tests/tests.php#L33

You may do something like:

return ($action=='list' || $action=='read');

Hope that helps.

[mevdschee]

Or first try to debug this callback using:

die(json_encode(array($action,$database,$table)));

Then you may better understand how it works.

[Disane87]

Great! I will check that and will report back :) Have a nice and sunny sunday!

[mevdschee]

Feel free to reopen the ticket if you have further questions.