Adjusting menus

Tags
Security

What we want

For anon, we want the top menu to be:

Anon menu

Admins have user list links, a logout link, and no login link:

Admin menu

Managers have sales list links, a logout link, and no login link:

Manager menu

Show all

The top menu

Here's code for that. It's Boostrap navbar code.

  1. <ul class="navbar-nav mr-auto">
  2.     <li class="nav-item">
  3.         <a class="nav-link" href="products.php" title="Our products">Products</a>
  4.     </li>
  5.     <?php
  6.     if (hasRole(ROLE_NAME_MANAGER)) {
  7.         ?>
  8.         <li class="nav-item">
  9.             <a class="nav-link" href="sales.php" title="Sales">Sales</a>
  10.         </li>
  11.         <?php
  12.     }
  13.     if (hasRole(ROLE_NAME_ADMIN)) {
  14.         ?>
  15.         <li class="nav-item">
  16.             <a class="nav-link" href="users.php" title="User accounts">Users</a>
  17.         </li>
  18.     <?php
  19.     }
  20.     ?>
  21.     <li class="nav-item">
  22.         <?php
  23.         if (isLoggedIn()) {
  24.             print "<a class='nav-link' href='logout.php' title='Logout'>Logout</a>";
  25.         }
  26.         else {
  27.             print "<a class='nav-link' href='login.php' title='Login'>Login</a>";
  28.         }
  29.         ?>
  30.     </li>
  31. </ul>

The products link is always there, no matter who the user (lines 2 to 4).

The sales link is output for people with the manager role:

  1.     if (hasRole(ROLE_NAME_MANAGER)) {
  2.         ?>
  3.         <li class="nav-item">
  4.             <a class="nav-link" href="sales.php" title="Sales">Sales</a>
  5.         </li>
  6.         <?php
  7.     }

Don't have the manager role? The output is skipped. We'll need to make the program sales.php to show the sales.

The users link shows for people with the admin role (lines 13 to 19).

Show all

The login/logout links are done in a similar way.

  • If the user is logged in, you want to show the logout link, but not the login link (since they're already logged in).
  • If the user is not logged in, you want to show the login link, but not the logout link (since they're not logged in, they can't logout).
  1. if (isLoggedIn()) {
  2.     print "<a class='nav-link' href='logout.php' title='Logout'>Logout</a>";
  3. }
  4. else {
  5.     print "<a class='nav-link' href='login.php' title='Login'>Login</a>";
  6. }

Instead of testing the role, the code tests whether the user is logged in, or not.

We'll make login.php and logout.php soon.

Show all

Home page link list

The home page has links, too. For example, for admins, there are links to products and users:

Admin menu

The code for that is similar to that for the top menu, just without the navbar stuff:

  1. <li>
  2.     <a href="products.php">Products</a>
  3. </li>
  4. <?php
  5. if (hasRole(ROLE_NAME_MANAGER)) {
  6.     ?>
  7.     <li>
  8.         <a href="sales.php" title="Sales">Sales</a>
  9.     </li>
  10.     <?php
  11. }
  12. if (hasRole(ROLE_NAME_ADMIN)) {
  13.     ?>
  14.     <li>
  15.         <a href="users.php" title="User accounts">Users</a>
  16.     </li>
  17.     <?php
  18. }

The link to the products report is always there. The other two links depend on the user's role.

Show all

Up next

Let's make a DB table to store user data in.