How give special permission for user to view or edit that page. 1

[yogi564]

Hi all,

Is there a way to give a special permissions for users to view, add or edit a page. Currently what is happening is that with a Username or password that person has full access permission.
What I need to happen is restrict some users from editing add information to the pages. For example the USername and password is stored in a table called T_ACCOUNT and it coming from the SQL server. Iam using Cold fusion server 5 with SQl Server.
How can I pull out the permission from the SQl server where I have set Admin, User permission to read in the cold fusion pages. IN the sql server the 'Admin permission' gives full permission for a particular user to view, add and edit any pages he or she like. But in 'User permission' it only give for viewing. This is working on the Sql server when I test it out. But I need to interact this with the cold fusion pages I ahve developed. Is there a way to do this, if so can you help me out. Thank's
From
Yogi

 

[calista]

I had to do something similar when I wanted only certain people to delete information. The only people who can delete an item is the person who entered it in the first place, or, an administrator. I have a table that holds the user information, and I added a column to it, PersonAdmin, that has a value of yes or no. In my template, I use CFPARAM Persmission EQ "No". By a cookie or session variable, I know who the user is, so I query the user table to see if PersonAdmin is "Yes" for that user. I also check the user against the table that stores the ID of the person who entered the record. If the user matches either the person who entered the record or one of the administrators, I set "Permission to "Yes". Then, before I process a delete, I check the value of "Permission". If it's "Yes", I process the delete, otherwise, the user gets a message that he does not have permission to delete that record.

Hope this helps! Calista :-X
Jedi Knight,
Champion of the Force

 

[yogi564]

Hi calista

Can you give the code for this part and also a working Url for this . Thank's

 

[neofactor]

We just added a security level of 1-4

Then we could control what "permissions" these groups had.
This worked great for the 1st year but no we need to move away from the 1-4 and make another table that are called groups. We then assign people to a group and then make sure certain groups are the only ones to perform certain functions.

We are currently testing LDAP to allow us to use the Domain Controller.

Good luck.

 

[calista]

Well, here's what I've got:

<CFSET Permission = &quot;No&quot;>

<!--- Query for the Administrators --->
<CFQUERY NAME=&quot;GetAdmins&quot;
     DATASOURCE=&quot;#Application.Datasource#&quot;
      DBTYPE=&quot;ODBC&quot;>
	SELECT	*
        FROM	PersonTable
	WHERE	PersonAdmin = Yes
</CFQUERY>

<!--- Get user name --->
<CFQUERY NAME=&quot;GetName&quot;	DATASOURCE=&quot;#Application.Datasource#&quot;
        DBTYPE=&quot;ODBC&quot;>
        SELECT	PersonFirstName
        FROM	PersonTable
        WHERE 	PersonID = '#Cookie.User.ID#'
</CFQUERY>

<!--- Here, I query for the record the user wants to update --->
<CFQUERY NAME=&quot;GetAddress&quot;
         DATASOURCE=&quot;#Application.Datasource#&quot;
        DBTYPE=&quot;ODBC&quot;>
	SELECT	*
	FROM	#AdrTable#
	WHERE	#AdrID# = #Form.ReleaseID#
</CFQUERY>

<!--- For convenience, I set the ID of the owner of the record to a variable --->				
<CFOUTPUT QUERY=&quot;GetAddress&quot;>
	<CFSET Owner = GetAddress[AdrPerson][CurrentRow]>
</CFOUTPUT>

<!--- Here, I'm just getting the rest of the info about the owner so I can display personalized messages. --->				
<CFQUERY NAME=&quot;GetOwner&quot;
         DATASOURCE=&quot;#Application.Datasource#&quot;
         DBTYPE=&quot;ODBC&quot;>
	SELECT	PersonFirstName,PersonLastName
	FROM	PersonTable
	WHERE	PersonID = '#Owner#'
</CFQUERY>

				
<CFOUTPUT QUERY=&quot;GetAddress&quot;>
     <!--- Is the current user the owner? ---> 
     <CFIF #Owner# EQ Cookie.User.ID>
          <!--- If so, give permission. --->
	  <CFSET Permission = &quot;Yes&quot;>
     <CFELSE>
          <!--- If not, is the current user one of the administrators? ---> 
          <CFLOOP QUERY=&quot;GetAdmins&quot;>
		<CFIF Cookie.User.ID EQ PersonID>
                     <!--- If so, give permission. --->   
		    <CFSET Permission = &quot;Yes&quot;>
		</CFIF>
	  </CFLOOP>
	</CFIF>
</CFOUTPUT>
<CFIF Permission EQ &quot;Yes&quot;> <!--- Remember, this was set to &quot;No&quot; earlier. --->
<!--- Update the database. --->
<CFQUERY NAME=&quot;UpdateInfo&quot;
	DATASOURCE=&quot;#Application.Datasource#&quot;
	DBTYPE=&quot;ODBC&quot;>
	UPDATE 	#AdrTable#
	SET		#AdrPerson# = '',
			#AdrAvailable# = 1
			WHERE	#AdrID# = #Form.ReleaseID#
</CFQUERY>
<CFELSE>
    <!--- Inform user he does not have permission. --->
</CFIF>

dmacintosh makes some very good points. I am dealing with a small, departmental intranet. I put three people as administrators. dmacintosh's plan is a good one for a larger operation, but it's still the same basic idea.

Good luck! Calista :-X
Jedi Knight,
Champion of the Force

 

[yogi564]

Hi calista,

Where do you place this coding, I have got a login page, and when the username and password is been OK, it goes to a menu.cfm, where there is a selection of three hyperlink. The first one is called 1) Add a new data 2)Edit existing data and finally the third one is called 3) Locate the data. What I need to happen is to restrict options 1 and 2 for some people, so will the above coding work, when someone clicks on option 1 and 2. saying the guest users are not allow to add or edit this section. So how to I separate or put all this code in the menu.cfm page.
I know that I need to change the table names and also the datasource connection occuring to my liking but I need to know where to place this code so that it will function properly. Thanks

From
Yogi

 

[calista]

I think I would put this on your menu page. By the the time the user gets there, you know who he is because he has passed your login procedure. At the top of your menu page, determine if this user is authorized to Add and/or Edit. If he is authorized, display all the links. If he is not authorized, either display only the link he is allowed to use, or diplay disabled links. Calista :-X
Jedi Knight,
Champion of the Force

 

[yogi564]

Hi calista

Is that mean I need to create two separate pages menu pages. For two different kinds of users. One for add and another for viewing.

 

[calista]

No, you don't need two pages. The psuedo code would go something like this:

Is user authorized?

If Yes:
Display all working links
Else
Display one link
OR
Display one working link and two disabled links
End-if Calista :-X
Jedi Knight,
Champion of the Force

 

[yogi564]

Iam not that good in psuedo code I need you to specific what to do in this part a bit clearly when I login from Login page to Menu. I need the 1 and 2 optinion mentioned above disable when I login as Guest. Thank's

 

[calista]

OK, wrote this up for you. Of course, you'll have to use your own page names and variable names.

<!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.0 Transitional//EN&quot;>

<html>
<head>
	<title>Menu Page</title>
</head>

<body>

<CFPARAM NAME=&quot;Permission&quot; DEFAULT=&quot;No&quot;>

<!--- First, determine if the user is a guest. --->
<!--- If the user is a guest, set &quot;Permission to &quot;No&quot; --->
<CFIF Session.User.Name EQ &quot;Guest&quot;>
	<CFSET Permission=&quot;No&quot;>
<!--- Otherwise, set Permission to &quot;Yes&quot; --->
<CFELSE>
	<CFSET Permission=&quot;Yes&quot;>
</CFIF>


<!--- Now, display the links Option 1 --->
<CFIF Permission EQ &quot;Yes&quot;>
	<TABLE>
	<TR>
		<!--- Notice these are all working links. --->
		<TD><A HREF=&quot;Add Data.cfm&quot;>Add Data</A></TD>
		<TD><A HREF=&quot;EditData.cfm&quot;>Edit Data</A></TD>
		<TD><A HREF=&quot;ViewData.cfm&quot;>View Data</A></TD>
	</TR>
	</TABLE>
<CFELSE>
	<!--- Here, the text for the links will show, but as --->
	<!--- you can see, I've taken out the anchor tags on Add and Edit. --->
	<!--- Therefore, there is nothing for the guest to click on. --->
	<!--- All user will see three labels, but the guest will --->
	<!--- not be able to click on Add or Edit. --->
	<TABLE>
	<TR>
		<TD>Add Data</TD>
		<TD>Edit Data</TD>
		<TD><A HREF=&quot;ViewData.cfm&quot;>View Data</A></TD>
	</TR>
	</TABLE>
</CFIF>

<!--- Now, display the links Option 2 --->
<CFIF Permission EQ &quot;Yes&quot;>
	<TABLE>
	<TR>
		<!--- Notice these are all working links. --->
		<!--- This part is the same as option 1. --->
		<TD><A HREF=&quot;Add Data.cfm&quot;>Add Data</A></TD>
		<TD><A HREF=&quot;EditData.cfm&quot;>Edit Data</A></TD>
		<TD><A HREF=&quot;ViewData.cfm&quot;>View Data</A></TD>
	</TR>
	</TABLE>
<CFELSE>
	<!--- This time, I'm only displaying the link to view the data. --->
	<!--- A guest will see only this one link. --->
	<TABLE>
	<TR>
		<TD><A HREF=&quot;ViewData.cfm&quot;>View Data</A></TD>
	</TR>
	</TABLE>
</CFIF>

</body>
</html>

Hope this helps! Calista :-X
Jedi Knight,
Champion of the Force

 

[yogi564]

Hi Calista

here is my code for the Menu page.

<!--- Get user name --->
<cfquery name=&quot;GetUser&quot; datasource=&quot;test&quot; >
SELECT * FROM T_ACCOUNT WHERE login ='#Form.USERNAME#' And password= '#Form.PASSWORD#'
</cfquery>
<!--- Get user's details from the database --->
<!--- Check if we have a winner! --->
<cfif GetUser.RecordCount gt 0>
<!--- Store the user id in session variables and cookies. --->
<cfset Session.login = GetUser.login>
<cfset Session.firstname= GetUser.firstname>
<cfset Session.lastname= GetUser.lastname>
<cfcookie name=&quot;login&quot; value=&quot;#GetUser.login#&quot; expires=&quot;NEVER&quot;>
<table width=&quot;691&quot; border=&quot;1&quot; height=&quot;96&quot;>
<tr>
<td colspan=&quot;2&quot;>
<div align=&quot;center&quot;><font size=&quot;3&quot; face=&quot;Arial, Helvetica, sans-serif&quot;><b>Main
Menu </b></font></div>
</td>
</tr>
<tr>
<td width=&quot;49%&quot;>
<div align=&quot;center&quot;><font size=&quot;2&quot; face=&quot;Arial, Helvetica, sans-serif&quot;><b><a href=&quot;study.cfm?accountadmin=#yes#&quot;>Enter
New Site Data</a></b></font></div>
</td>
<td width=&quot;51%&quot;>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../lab/lablocate.cfm&quot;>Enter
Lab Data - Existing Site </a> </font></b></div>
</td>
</tr>
<tr>
<td>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../search/locatesite.cfm&quot;>Locate
Site</a></font></b></div>
</td>
<td>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../editfolder/locatesite.cfm&quot;>Edit
existing data</a></font></b></div>
</td>
</tr>
</table>
<cfelse>
<!--- User does not exist --->
<!--- Pass the variables back in the URL - message and UserName --->
<cfset loginpage = &quot;login1.cfm?Message=&quot; & URLEncodedFormat(&quot;Invalid User Name/Password Combination&quot>
<cfset loginpage = loginpage & &quot;&USERNAME=&quot; & URLEncodedFormat(#USERNAME#)>
<cflocation url=&quot;#loginpage#&quot;>
</cfif>
Now if I place your code within this page do you think it will work clearly. Thank's

 

[calista]

Sure, here it is:

<!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01 Transitional//EN&quot;>

<html>
<head>
<title>Untitled</title>
</head>

<body>

<CFPARAM NAME=&quot;Permission&quot; DEFAULT=&quot;No&quot;>

<!--- Get user name --->
<cfquery name=&quot;GetUser&quot; datasource=&quot;test&quot;>
SELECT * FROM T_ACCOUNT WHERE login ='#Form.USERNAME#' And password= '#Form.PASSWORD#'
</cfquery>
<!--- Get user's details from the database --->
<!--- Check if we have a winner! --->
<cfif GetUser.RecordCount gt 0>
<!--- Store the user id in session variables and cookies. --->
<cfset Session.login = GetUser.login>
<cfset Session.firstname= GetUser.firstname>
<cfset Session.lastname= GetUser.lastname>
<!--- I am assuming GetUser.AccountAdmin is what tells you if the user is authorized to add or edit. --->

<CFIF GetUser.AccountAdmin EQ &quot;Yes&quot;>
<CFSET Permission=&quot;Yes&quot;>
</CFIF>

<cfcookie name=&quot;login&quot; value=&quot;#GetUser.login#&quot; expires=&quot;NEVER&quot;>
<CFIF Permission EQ &quot;Yes&quot;>

<!--- This is your table, unchanged. --->
<table width=&quot;691&quot; border=&quot;1&quot; height=&quot;96&quot;>
<tr>
<td colspan=&quot;2&quot;>
<div align=&quot;center&quot;><font size=&quot;3&quot; face=&quot;Arial, Helvetica, sans-serif&quot;><b>Main
Menu </b></font></div>
</td>
</tr>
<tr>
<td width=&quot;49%&quot;>
<div align=&quot;center&quot;><font size=&quot;2&quot; face=&quot;Arial, Helvetica, sans-serif&quot;><b><a href=&quot;study.cfm?accountadmin=#yes#&quot;>Enter
New Site Data</a></b></font></div>
</td>
<td width=&quot;51%&quot;>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../lab/lablocate.cfm&quot;>Enter
Lab Data - Existing Site </a> </font></b></div>
</td>
</tr>
<tr>
<td>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../search/locatesite.cfm&quot;>Locate
Site</a></font></b></div>
</td>
<td>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../editfolder/locatesite.cfm&quot;>Edit
existing data</a></font></b></div>
</td>
</tr>
</table>
<CFELSE>
<!--- This is the table for guest users. The only working --->
<!--- link is the third one for &quot;Locate Site&quot;. --->

<table width=&quot;691&quot; border=&quot;1&quot; height=&quot;96&quot;>
<tr>
<td colspan=&quot;2&quot;>
<div align=&quot;center&quot;><font size=&quot;3&quot; face=&quot;Arial, Helvetica, sans-serif&quot;><b>Main
Menu </b></font></div>
</td>
</tr>
<tr>
<td width=&quot;49%&quot;>
<div align=&quot;center&quot;><font size=&quot;2&quot; face=&quot;Arial, Helvetica, sans-serif&quot;><b>Enter
New Site Data</b></font></div>
</td>
<td width=&quot;51%&quot;>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;>Enter
Lab Data - Existing Site </font></b></div>
</td>
</tr>
<tr>
<td>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;><a href=&quot;../search/locatesite.cfm&quot;>Locate
Site</a></font></b></div>
</td>
<td>
<div align=&quot;center&quot;><b><font face=&quot;Arial, Helvetica, sans-serif&quot; size=&quot;2&quot;>Edit
existing data</font></b></div>
</td>
</tr>
</table>
</CFIF>

<cfelse>
<!--- User does not exist --->
<!--- Pass the variables back in the URL - message and UserName --->
<cfset loginpage = &quot;login1.cfm?Message=&quot; & URLEncodedFormat(&quot;Invalid User Name/Password Combination&quot>
<cfset loginpage = loginpage & &quot;&USERNAME=&quot; & URLEncodedFormat(#USERNAME#)>
<cflocation url=&quot;#loginpage#&quot;>
</cfif>



</body>
</html>
Calista :-X
Jedi Knight,
Champion of the Force

 

[yogi564]

Hi Calista

Thank you very much for heliping me out. It is finally working. Thanks a million !

from
yogi