Codeigniter中基于角色的登录系统的最佳实践是什么 [英] what is the best practice for role based login system in Codeigniter

问题描述

我正在研究一种基于角色的登录系统.实际上，在基于角色的登录系统中，我应该对控制器，模型和视图执行哪些操作，以分配不同的访问条件.

I am working on one role based login system. Actually, What should I do to the controller, model and the views in this role based login system to allocate different access criteria.

我对如何根据角色设置和访问用户感到困惑.

I am little confused about how to set and access for the user according to the role.

主要我不确定如何分配不同的视图作为角色.

Mainly I am not sure about how to allocate different view as a role.

例如我应用条件检查角色，然后根据角色查看菜单显示不同的链接.像主管理员一样只能观看帐户"标签.用户看不到帐户"标签.

ex. I apply if condition to check role and then view according to the role the menu show the different links. like main admin can only watch account tab. the user can not see the account tab.

我还对控制器中的会话设置了相同的if条件，以防止直接访问该页面.

I also set the same if condition with the session in the controller for preventing direct access to that page.

这是我应用于菜单和控制器的代码.

Here is my code which I applied to menu and controller.

<?php 
        $login_role= $this->session->userdata('user_data');
        if($login_role['user_role'] === 'super_admin'){

            ?><li><a href="<?php echo base_url('account/view_account'); ?>">
            <div>Account</div></a></li><?php
        }
    ?>

和控制器中的相同条件

 public function index() 
{
    $login_role= $this->session->userdata('user_data');

    if($login_role['user_role'] === 'super_admin')
    {
        $this->load->model('location_model');
        $city_list = $this->location_model->get_city_list();
        $state_list = $this->location_model->get_state_list();
        //log_message('info', 'City and State list will sucessfully loded.');         
        $this->load->view('admin/account_insert',['city_list'=>$city_list,'state_list'=>$state_list]);    
    } else {

        redirect('admin/dashboard','refresh');
    }


}

我不确定这样使用安全吗?否则我必须做其他事情作为一种好习惯.

I am not sure about is this safe to use like this way. or I have to do something else as a good practice.

推荐答案

我正在为所有用户角色使用单个Controller Login系统.我有一个用户角色表，并且在用户表中有角色ID.然后，我有与这些角色匹配的控制器名称.用户登录时，我检查角色，并在验证后将用户重定向到该控制器.以下是我的登录控制器的索引功能.

I am using a single Controller Login system for all user roles. I have a table of user roles and I have role id in users table. Then I have controller names matching those roles. When user login, I check for role and redirect the user to that controller after verification. Following is the index function of my Login Controller.

public function index()
{
    if(!$this->isLoggedIn())
    {
        $data['title']='Title You want to set on Page';
        if($_POST)
        {
            $config=array(
                array(
                    'field' => 'email',
                    'label' => 'Email',
                    'rules' => 'trim|required|valid_email',
                ),
                array(
                    'field' => 'password',
                    'label' => 'Password',
                    'rules' => 'trim|required',
                ),
            );
            $this->form_validation->set_rules($config);
            if($this->form_validation->run()==false)
            {
                $data['errors']=validation_errors();
                $this->load->view('static/head', $data);
                $this->load->view('admin/login');
            }
            else
            {
                $user=$this->admin_model->checkUser($_POST);
                if(!empty($user))
                {
                    if($user['role']==1)
                    {
                        $user['type']='admin';
                    }
                    elseif($user['role']==2)
                    {
                        $user['type']='team';
                    }
                    elseif($user['role']==3)
                    {
                        $user['type']='client';
                    }
                    elseif($user['role']==4)
                    {
                        $user['type']='manager';
                    }
                    $this->session->set_userdata($user);
                    redirect(base_url().$user['type']);
                }
                else
                {
                    $data['errors']='The credentials you have provided are incorrect or your account has not been approved yet.';
                    $this->load->view('static/head', $data);
                    $this->load->view('admin/login');
                }
            }
        }
        else
        {
            $this->load->view('static/head', $data);
            $this->load->view('admin/login');
        }
    }
    else
    {
        redirect(base_url().$this->session->userdata['type']);
    }

}

它非常适合我.此外，在每个Controller中，我都有一些功能来检查用户是否以这种身份登录

Its working perfectly for me. Furthermore in each Controller I have functions to check if the user is logged in for this role like this

public function isLoggedIn()
{
    if(!empty($this->session->userdata['id'])&& $this->session->userdata['type']=='team')
    {
        return true;
    }
    else
    {
        return false;
    }
}

然后渲染该控制器的索引函数.例如，以下是团队负责人索引功能

And I render my index function of that controller. E.g Following is the team controller index function

public function index()
{
    if($this->isLoggedIn())
    {
        $data['menu']=$this->team_model->getMenuItems();
        $data['task_logs']=$this->admin_model->getAllLogs();

        $data['title']='Title';
        $this->load->view('static/head',$data);
        $this->load->view('static/header');
        $this->load->view('static/sidebar');
        $this->load->view('team/dashboard');
        $this->load->view('static/footer');
    }
    else
    {
        redirect(base_url());
    }

}

这篇关于Codeigniter中基于角色的登录系统的最佳实践是什么的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！