-2

I have prepared a script which allows registered users to edit some records (which belong to them) in a table of JDatabase. Here's how?

This is the first script which detects the logged in user and shows all the records present in the database belonging to that user in a HTML table :

$db = JFactory::getDbo();
$query = $db->getQuery(true);
$query->select('*')
      ->from($db->quoteName('#__submission'))
      ->where($db->quoteName('username') . " = ". $db->quote($user->username));


    $db->setQuery($query);
    $rows = $db->loadRowList();

echo '<table border="1">';
echo '<tr>';
echo ' <th>Project Name</th>';
echo ' <th> Details</th>';
echo ' <th> Action</th>';
echo '</tr>';
echo '<tr>';
foreach($rows as $row) {
echo "<tr>";
echo "<td>" .$row['2']. "</td>";
echo "<td>" .$row['4']. "</td>";

echo "<td>";
// this hyperlink leads to the edit page of that specific record 
// $row['0'] returns the value of the id for that specific record
echo "<a href='edit.php?id={$row['0']}'>Edit</a>";
echo "</td>";
echo "</tr>";
}
echo '</tr>';
echo '</table>';

Now this is the second script (edit.php) :

<?php
// provides access to the database
include '/libs/connect.php';

if($_POST){
//update the record if the form was submitted
$sql="UPDATE `submissions` SET

Details='" . mysql_real_escape_string($_POST['Details']) . "'   
WHERE 
id=" . mysql_real_escape_string($_POST['id']);

if(mysql_query($sql)){
    //this will be displayed when the query was successful
    echo "<div>Record was edited.</div>";
}else{
    die("SQL: " . $sql . " >> ERROR: " . mysql_error());
}
}


  $id=$_REQUEST['id']; //the user id

//this query will select the user data which is to be used to fill up the form
$sql="select * FROM `submissions` WHERE id=" . mysql_real_escape_string($_GET['id']);
$rs=mysql_query($sql) or die("SQL: ".$sql." >> ".mysql_error());
$num=mysql_num_rows($rs);

//just a little validation, if a record was found, the form will be shown
//it means that there's an information to be edited
if($num>0){ 
$row=mysql_fetch_assoc($rs);
extract($row);
?>
<!--we have our html form here where new user information will be entered-->


<form action='#' method='post' border='0'>
<table>

          <tr>
        <td>Project Details</td>
        // displays a text box already having the value present in the database
        <td><input type='text' name='Details' value='<?php echo $Details;  ?>' /></td>
    </tr>


        <td></td>
        <td>
<!-- so that we could identify what record is to be updated  -->
<input type='hidden' name='id' value='<?php echo $_GET['id'] ?>' />

  <!-- we will set the action to edit -->
     <input type='hidden' name='action' value='edit' />
     <input type='submit' value='Edit' />
            <a href='/database.php'>Back to index</a>
        </td>
    </tr>
   </table>
   </form>

Now, what exactly happens here is..

When the registered user, click on the edit button (on the main page - first script), the URL becomes (example) : example.com/edit.php?id=3

Now, the draw back here is if any one tries to reach this URL directly, even he will have the access to edit that record? I am confused, how can i allow only those records be edited which belong to the logged in user only?

  • 4
    Why in your first script have stuck to fairly good Joomla coding standards and then in your second script decided to use mysql_* functions? As for your actual question, you could either start a session and check the session on the edit page – Lodder Jun 10 '14 at 21:02
7

You are making this way too difficult. Joomla provides you with a feature called ACL that allows just that. For each record, Joomla will create an extra line in the #__assets table.

What you need to do is add an asset_id field to the database table:

`asset_id` INT(10) UNSIGNED NOT NULL DEFAULT '0',

create a role in a component (usually in a /administrator/com_your_component/config.xml) file as such:

<action name="core.edit.own" title="JACTION_EDITOWN" description="JACTION_EDITOWN_COMPONENT_DESC" />

then when you first create the record, if you inherit from jModelForm Joomla will take care of it; otherwise look at the store() method in

libraries/joomla/database/table.php

When you access it check the user can create new items in this section

       $authorised = $user->authorise('core.edit.own', 'com_your_component');

(you don't need to be inside your component to check it)

Please see the official documentation on using ACL and the older version for J2.5, which has more info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.