Show files in directory based on permission level of user.

[DeZiner]

I am trying to set permissions for users to only have access to particular files in a directory based on their employment status. I set one table with their name, username, password and access_level. I set the access level to a, b, c, d etc. A user with level A should be able to view files 1.xls, 2.xls, 3.xls, 4.xls and 5.xls. Where a user with a level of B should only have access to 1, 2, 3 and 4 and so on.

In another table I set the association of access level. Column access_level stores the A, B, C, D etc. Column files contains 1, 2, 3, 4, 5 or the file name (without extension) that that level should be able to view. I query the user table to retrive that persons level then want to only display files they should be able to view.

I have used cfdirectory to list the files in the directory. The file names will not change however the number oof files may vary. I set the access level files permision 1, 2, 3, 4 to a list. I set the file names in the directory to a list.

How can I only display the files listed in the access level.

Hope I have been clear. DeZiner
Never be afraid to try something new.
Remember that amateurs built the Ark.
Professionals built the Titanic

 

[rahul75]

You can use a separate page to show the file contents using a CFCONTENT tag afyter checking for necessary permissions !!
Just use CFDIRECTORY to list all the files first & then link them to a page where u will check whether the file user is trying to access can be accessed by him/her ..
eg :
a.xls ...link this file to authorize.cfm?file=a.xls
In the authorize.cfm just perform the dadtabse operation to fetch the user access level.Take the accesslevel in a list & just do a listfind to find the url.file in the access list. if the file is there in the list just serve the user with the url.file using CFCONTENT with mime type of application/vnd.ms-excel else display a message saying User not authorize

Hope this helps !

 

[GunJack]

Hey DeZiner,

Would something like this do what you want?

<cfdirectory name=&quot;fileList&quot; ....>
<cfquery name=&quot;Perms&quot;>
select files from fileTable where access_level = ....

<cfoutput query=&quot;fileList&quot;>
<cfif listFind(valueList(Perms.files),listgetat(fileList.name,1,&quot;.&quot) gt 0>
#fileList.name#<br>
</cfoutput>

Hope this helps,
GJ

 

[DeZiner]

The only problem I see with that GunJack, is the files nor the file name, nor the path to the file is in the database. The user that created this file will simply ftp the updated files into a directory called files replacing existing files. The files will be named 1, 2, 3, 4, 5.htm. In the database I am storing the 1, 2, 3, with out the extension for the creator to easily mange permission levels.

I think I have figured it out. Still testing. My issue now is how to stop the end user from storing a link directly to the file. These are excel sheets converted to html. Can I loaad the file in a child frame and check the login status in the parent frame maybe?

Thanks for the above suggestions! DeZiner
Never be afraid to try something new.
Remember that amateurs built the Ark.
Professionals built the Titanic