Security Settings

Field Description:

Advanced Security

Advanced Security feature allows you to setup User ID, assign User Levels to users and create a complete user registration system. To setup, click the [Advanced] button.

PHPMaker supports two types of security - User ID and User Level. User ID Security secures data at record level. User Level Security secures data at table level. They complements each other and they can work independently or together. Users get their User ID and User Level after login. Before login, an user's identity is unknown and the user is an Anonymous User.

User ID
User ID Security secures data at record level. Protected tables must have an User ID field for identifying which user a record belongs to. The User ID field names can be different in tables though. When User ID security is enabled, users can only access their own data.

Steps to setup User ID security for different tables/views:

1. Click on User ID in the left pane.
   
2. Select the [User ID field] from your user table, this field is usually the primary key of the User Table. (Note: if this field is not set, the feature is disabled)
   
3. (Optional) Select the [Parent User ID field] from your user table. Parent User ID field stores the parent User ID that the user belongs to, parent user can modify the child user's records. Parent User ID is hierarchical, parent users can access the records owned by the child users of their child users. (Note: if this field is not set, the Parent User feature is disabled.)
   
4. In the [User ID Field] column, select the User ID Field for the tables/views that requires User ID security.
   
5. (Optional) Enable [Allow View All] if you allow all logged in users (not including Anonymous User) to list/search/view (but not add/copy/edit/delete) all records in the table.

User Level
User Level Security secures data at table level. Each user level is granted with specific permissions to tables in the database.

There are 2 types of User Level security:

1. Static User Levels - the User Levels and the permissions are defined in this form and the User Levels are not to be changed after script generation.

Steps to setup static User Level security for different tables/views:

1. Click on User Levels in the left pane,
   
2. Select an integer field in your user table as the [User Level field], (Note: if this field is not set, the feature is disabled)
3. Define your user levels, click icon the add an user level and icon to delete an user level.

2. Dynamic User Levels - the User Levels and the permissions are defined in 2 tables in the database, the User Levels can still be changed with the generated scripts.

Steps to setup dynamic User Level security for different tables/views:

1. Click on User Levels in the left pane,
2. Select an integer field in your user table as the [User Level field],(note: if this field is not set, the feature is disabled)
3. Switch to the [Dynamic User Levels] tab, check [Enable Dynamic User Levels],
4. Select your User Level Table and User Level Permission Table and the required fields.

The User Level Table and User Level Permission Table must have the following fields, note the data types, User Level ID and the Permission fields must be of integer type, the field names can be different though:

If you want PHPMaker to create these 2 tables in your database, click the [Create tables] button, the following form will display for you to change the table/field names if necessary. You can change the table/field names and then click OK to continue.

If you have projects created by previous versions of PHPMaker you may want to use dynamic User Levels and migrate the previously defined static User Levels in the project to the database. After selecting or creating the User Level and User Level Permission tables/fields, just click the [Migrate] button to let PHPMaker do that for you.

After setting the user levels, PHPMaker will populate the user levels to the User Level field's Edit Tag (also see Field Setup) so administrators can assign user levels using the generated pages.

There are three built-in user levels:

Anonymous - Anonymous user level is a built-in user level for the anonymous user (i.e. users that have not logged in). The User Level ID of the anonymous user is -2.

Administrator - Administrator user level is a built-in user level that has all permissions plus the privileges to modify User IDs and User Levels. Its permissions are same as that of the hard-coded Administrator. The User Level ID of Administrator is -1.

Default - Default user level is built-in user level with user level = 0. Since User Level field is an integer field, if you set a default value of 0 for this field, this user level will become the default user level for the user after registration and before the Administrator assigning another higher user level.

User Login Options
User Login Options allows you to create a complete user registration system for your Web site, with options to let user register, change password and recover password.

Email Template

The email sending function and the email contents can be customized in the template. The following special tags are used in the email templates:

<!--$From--> is sender email address
<!--$To--> is user email address
<!--$Password--> is user password
<!--FieldName--> (without the $ symbol) is the field value. For example, <!--LastName--> is the field value of the field "LastName".

You can also dynamically change the email by code using Email_Sending event before the email is sent. (See Server Events and Client Scripts)

Also See:

Tutorial - User ID Security
Tutorial - Static User Level Security
Tutorial - Dynamic User Level Security
Tutorial - User Registration System
Tutorial - Multi-Language Project Setup