Development:New permissions evaluation in 2.0: Difference between revisions
From MoodleDocs
| Line 19: | Line 19: | ||
# evaluate permissions in given context for each role separately (going from bottom to top in context tree, first found wins unless there is a CAP_PROHIBIT on any level) | # evaluate permissions in given context for each role separately (going from bottom to top in context tree, first found wins unless there is a CAP_PROHIBIT on any level) | ||
# user has capability if he/she has at least one role which evaluated to CAP_ALLOW and at the same time no role which was evaluated to CAP_PROHIBIT | # user has capability if he/she has at least one role which evaluated to CAP_ALLOW and at the same time no role which was evaluated to CAP_PROHIBIT | ||
http://tracker.moodle.org/secure/attachment/19670/Allowed_roles.png | http://tracker.moodle.org/secure/attachment/19670/Allowed_roles.png | ||
Revision as of 08:23, 1 March 2010
Note: This article is a work in progress. Please use the page comments or an appropriate moodle.org forum for any recommendations/suggestions for improvement.
| New permissions evaluation | |
|---|---|
| Project state | Implementation (patch in tracker) |
| Tracker issue | MDL-21710 |
| Discussion | n/a |
| Assignee | Petr Škoda (škoďák) |
Moodle 2.0
Goals
The main goals are:
- replace current confusing permission evaluation
- improve performance
- enable improvements in permission overriding UI
Permission evaluation algorithm
- find all roles with given capability used in definition or override
- evaluate permissions in given context for each role separately (going from bottom to top in context tree, first found wins unless there is a CAP_PROHIBIT on any level)
- user has capability if he/she has at least one role which evaluated to CAP_ALLOW and at the same time no role which was evaluated to CAP_PROHIBIT
http://tracker.moodle.org/secure/attachment/19670/Allowed_roles.png
Performance improvements
has_capability() and get_users_by_capability() uses fixed number of queries. The result could be returned as sql query instead of database records.
Backwards compatibility
The only potential problem is CAP_PREVENT in overrides when user has several conflicting roles. Originally this was highlighted as a special feature, unfortunately it was in fact the major source of confusion.
