search

torstenroeder / zefiro

Small Content Management Framework in PHP/MySQL
GNU Lesser General Public License v3.0
0 stars 1 forks source link

Cetralize permission and access checker logic #31

Open Rillke opened 5 years ago

Rillke commented 5 years ago

Currently, permission is checked in each PHP file separately, i.e. if a user opens z_log for example, $dbi->requireUserPermission ('admin') is executed.

This makes auditing and managing groups, permission and access unnecessarily hard.

torstenroeder commented 5 years ago

It would probably require a simple table to register all script names and their respective basic permission. Zotero should check automatically if the permissions are sufficient. This needs to be discussed, as we also talked about single entry points before.