[eluser]clancey[/eluser]
Our website is subscriber based and the status of a user may be changed while they are online. As written, the Auth library uses the session data to determine the authorization level of the logged in user.
It would seem that if the authorization level changes, that change is ignored until the session/cookies is destroyed and a new one generated. This is not good enough.
To solve the problem I wrote a function to determine if the user's group had changed and call that whenever the user's logged in status is checked. If the group has changed, I regenerate the session/cookie. I made the changes in library/Auth.php
There is some overhead in the extra database calls to check the user's group status. My execution time for creating the document is around 0.6 seconds compared to around 1.2 seconds when a new session/cookie value needs to be generated.
I have not created the user management panel for the site yet.
I suppose it would be simpler to incorporate the ability to change a cookie for a user while they are logged in from the user management module. But, is that easily done without creating an invalid session/cookie and forcing the user to log back on. That would be a bad effect.
My added functions are:
Code:
/**
* Check to see if the user's group has changed since they logged in
*/
function _group_changed()
{
$saved_group = $this->CI->session->userdata('group_id');
$username = $this->CI->session->userdata('username');
$userdata = $this->CI->db->query("SELECT * FROM `$this->user_table` WHERE `username` = '$username'");
$row = $userdata->row_array();
if($saved_group != $row['group_id'])
{
return TRUE;
}
else
{
return FALSE;
}
} // function _group_changed()
/**
* reset the cookie when the user is ccessing a restricted area
* this allows us to change their group with immediate effect
*/
function _reset_cookie()
{
$username = $this->CI->session->userdata('username');
$userdata = $this->CI->db->query("SELECT * FROM `$this->user_table` WHERE `username` = '$username'");
$row = $userdata->row_array();
$data = array(
'username' => $username,
'user_id' => $row['id'],
'group_id' => $row['group_id'],
'logged_in' => TRUE
);
$this->CI->session->set_userdata($data);
if($this->config['auth_remember'] === TRUE)
{
$this->_generate();
}
} // function _reset_cookie
The _reset_cookie() function could be renamed _set_cookie() and be called wherever needed from the code.
