RE: [SMARTY-DEV] Re: Smarty and object support

> From: Monte Ohrt [mailto:monte@ispi.net] > > On Tue, 2002-12-17 at 11:08, André Rabold wrote: > > Yep, basically you are right. > > > > The proplem for me is that I use alot of constants for > example to check > > access rights within the template. Here's a real-life example: > > > > {if $nextgen->user->isAuthorized(null, null, _NGAUTH_EDIT)} > > <a href="{ng_moduleurl ...}">edit</a> > > {/if} > > The problem is you are crossing the line of keeping application logic > out of the templates. You really should do something like this: > > {if $user_is_authorized} > ... > {/if} > IMHO, simply checking something like $nextgen->user->isAuthorized() for purposes of displaying (or not displaying) some markup is not application logic. There could be thousands of things that a user may be authorized to do, _NGAUTH_EDIT is only one of those things. It is completely reasonable for a page designer to decide that he/she needs display logic that shows, or hides an icon based on a user's permission. It's a design decision, thus it belongs in the template...the application logic would handle the condition where a user actually attempted to do something he was not authorized to do, whereas the designer would design pages that (hopefully) prevent the user from having the option of doing things he is not allowed to do. I'm working on a similar problem. I want the designer to have access to the full range of permissions (so that I don't have to go add application logic every time the designer decides to make an element dependent on users' permissions). It would be unreasonable to set each possible permission into a smarty variable as $user_is_authorized_for_<SOME_PERMISSION>. However, I do think that $nextgen->user->isAuthorized(null, null, _NGAUTH_EDIT) is a bit complex for a smarty template. It's not the use of the constant that bothers me, it's the two null parameters that concern me. What are they used for? I'm currently planning to do something like this: (note the use of the string, 'EDIT', rather than a constant) {if $current_user->hasPermission('EDIT', $billing_contact)} ...display a button... {/if} I think that this will work pretty well. The first parameter is the name of the permission to check. The second parameter may be either an object type (a string), an object instance (a reference), or it may be omitted - which is expected depends on which permission being queried. I also want to have a set of functions on my Role object for checking which roles a user holds. those would look something like this: (Role is just a higher grouping of access control on User) Check to see if the user holds at least one CourseManager role: {if $rolehelper->hasRole( $current_user, 'CourseManager' ) } ... {/if} -OR- Check to see if the user holds the Admin Role: {if $rolehelper->isAdmin($current_user)} ... {/if} -OR- Check to see if the user holds a CourseManager role for the given Course: {if $rolehelper->isCourseManager( $current_user, $current_course ) } ... {/if} -AND so on- I don't know if that was useful or not...but I thought it might help out a bit. good luck, -lee