模塊權限類錯誤

Question

我在我的用戶類中創建了CheckModulePermission函數，該函數檢查模塊表以確保用戶有權查看頁面。以下是功能

public function CheckModulePermissions($moduleId) { 

     if(isset($_SESSION['userId'])) { 

      // If the user is admin, allow regardless 

      if($this->IsAdmin()) { 

       return true; 

      } 

      $sql = "SELECT `userModuleId` 

        FROM `userModules` 

        WHERE `userId` = " . $_SESSION['userId'] . " 

        AND `moduleId` = " . $moduleId . ";"; 

      mysql_select_db(DB_USER_DATABASE_NAME, $this->conn); 

      $result = mysql_query($sql, $this->conn); 

      $x = mysql_fetch_row($result); 

      if($x[0] == 1) { 

       return true; 

      } else { 

       return false; 

      } 

     } else { 

      return false; 

     } 

    } 

} 

這工作正常在我的所有頁面，除了一個頁面失敗。我有一個下拉框和一個文本框，將根據用戶的權限進行更新。我登錄的用戶具有權限，但不顯示下拉框。

if(isset($_GET['orderNumber'])) { 

    // If post is set then update the prima reference and order status 

    // Only if user has sufficient privileges 

    if(isset($_POST['orderStatus'])) { 

     if($user->CheckModulePermissions(11)) { 

      $cid->UpdateOrderStatus($_GET['orderNumber'], $_POST['orderStatus']); 

      $cid->UpdateOrderReference($_GET['orderNumber'], $_POST['PReference']); 

     } 

    } 




if($user->CheckModulePermissions(11)) { 

          $content .= "<select name='orderStatus'> 

          <option value='1'"; 

          if($orderDetails['status'] == 1) $content .= " selected='selected'"; 

          $content .= ">Incomplete</option> 

          <option value='2'"; 

          if($orderDetails['status'] == 2) $content .= " selected='selected'"; 

          $content .= ">Submitted</option> 

          <option value='3'"; 

          if($orderDetails['status'] == 3) $content .= " selected='selected'"; 

          $content .= ">Processed</option> 

         </select>"; 

        } else { 

         if($orderDetails['status'] == 1) $content .= "Incomplete"; 

         if($orderDetails['status'] == 2) $content .= "Submitted"; 

         if($orderDetails['status'] == 3) $content .= "Processed"; 

        } 

        $content .= "</td> 

        </tr> 

        <tr> 

         <th>Prima Order Number</th> 

         <td>"; 

         if($user->CheckModulePermissions(11)) { 

          $content .= "<input type='text' name='pReference' value='" . $orderDetails['PReference'] . "' /></td> 

          </tr> 

          <tr> 

           <td colspan='2'><input type='submit' /></td> 

          </tr>"; 

         } else { 

          $content .= $orderDetails['PrimaReference'] . "</td></tr>"; 

         } 

         $content .= "</table> 

       </form> 

      </td> 

它是下拉框失敗的邏輯嗎？

Answer 1

這是你CheckModulePermissions()方法更有效的/可讀的版本...

public function CheckModulePermissions ($moduleId) { 

    // Deny immmediately if no userId is set 
    if (!isset($_SESSION['userId'])) return FALSE; 

    // If the user is admin, allow regardless 
    if ($this->IsAdmin()) return TRUE; 

    // Generate an SQL statement - does this need sanitising? 
    $sql = "SELECT `userModuleId` 
      FROM `userModules` 
      WHERE `userId` = '{$_SESSION['userId']}' 
      AND `moduleId` = '$moduleId' 
      LIMIT 1"; 
    // Is this line really necessary? Are you actually working with more than one database? 
    // Even if you are, it's probably better to do it in the query, like this: 
    // SELECT whatever FROM DB_USER_DATABASE_NAME.tablename WHERE... 
    mysql_select_db(DB_USER_DATABASE_NAME, $this->conn); 
    // Since you only want one row, it's slightly more resource efficient 
    // to abandon the $result variable 
    $x = mysql_fetch_row(mysql_query($sql, $this->conn)); 
    // This means the same thing as your if ... else 
    return $x[0] == 1; 

} 

...這裏是的HTML生成代碼重寫的版本。

// Get this once, at the beginning, to minimise SQL traffic 
$hasPermissions = $user->CheckModulePermissions(11); 

// Uncomment this line to make sure that $user->CheckModulePermissions is returning the value you expect 
//var_dump($hasPermissions); 

if (isset($_GET['orderNumber'])) { 
    // If post is set then update the prima reference and order status 
    // Only if user has sufficient privileges 
    if (isset($_POST['orderStatus']) && $hasPermissions) { 
    $cid->UpdateOrderStatus($_GET['orderNumber'], $_POST['orderStatus']); 
    $cid->UpdateOrderReference($_GET['orderNumber'], $_POST['PReference']); 
    } 

    // Map of status numbers to string descriptions 
    $statusStrs = array(1 => 'Incomplete','Submitted','Processed'); 

    if ($hasPermissions) { 
    // Generate a <select> 
    $content .= "<select name='orderStatus'>"; 
    foreach ($statusStrs as $val => $str) { 
     $content .= "\n<option value='$val'".(($orderDetails['status'] == $val) ? " selected='selected'" : '').">$str</option>"; 
    } 
    $content .= "\n</select>"; 
    } else { 
    // Print the current status string 
    $content .= $statusStrs[$orderDetails['status']]; 
    } 

    // Close the table cell (layout tables are nasty nasty) 
    $content .= "</td> 
    </tr> 
    <tr> 
    <th>Prima Order Number</th> 
    <td>"; 

    if ($hasPermissions) { 
    // add an input for changing the reference number 
    $content .= "<input type='text' name='pReference' value='{$orderDetails['PReference']}' /></td> 
    </tr> 
    <tr> 
    <td colspan='2'><input type='submit' /></td> 
    </tr>"; 
    } else { 
    // Display the current reference number 
    $content .= $orderDetails['PrimaReference'] . "</td></tr>"; 
    } 
    $content .= "</table> 
    </form> 
</td> 

我認爲你的問題的最可能的原因是CheckModulePermissions()正在恢復FALSE當你希望它返回TRUE。取消註釋var_dump()行來驗證這一點，我們會從那裏採取。