If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding admin menu" for those users?

I was thinking of 3 ways:

1) Javascript, check if Admin menu is empty and then hide it.

2) Check for all permissions in Admin menu, with a counter, and show it if counter > 0. And then also re-check the permissions for each item to show.

3) Save all permissions in associative array. Test all and assign ' true' to granted items. When building the menu, have a function that tests if there is at least one permission granted. I wouldn't need to re-check permissions against DB, just against the array for each item.

Is there any better way?

  • 4
    Generally since the server is the one who knows permissions, the server should be the one to decide whether or not to render the admin section or its dependencies.
    – Travis J
    May 9 '14 at 8:24

You haven't specified neither the template engine you use, nor the framework, so it's difficult to be more specific, but usually, template engines let you display specific HTML for a list, and a different HTML if the list contains nothing. In Django, for example, the syntax is the following:

{% for task in administrative_tasks %}
    <li>{{ task.name }}</li>
{% empty %}
    <li>You should be an administrator to access the tasks.</li>
{% endfor %}

Note: you added "security" tag to your question. Displaying or not a link reserved to administrators on a web page has nothing to do with security. If you need to be sure that non-administrators cannot access a specific resource, you should check their permissions during the request and return 401 Unauthorized or 403 Forbidden accordingly.

  • I use Yii framework, and no template engine. In your example, in the UL is part of a Menu with a name, that would be displayed regardless of tasks in administrative_tasks. I'm trying to completely hide it. I think I will go for option 3, so I have not to check permissions again.
    – JorgeeFG
    May 8 '14 at 14:51
  • 2
    @Jorge Your comment seem a bit strange. If by "again" you mean on the server, you don't have any security. You cannot trust the client. Nov 4 '14 at 17:07

Id depends. Do we have users that are not admin and can't have admin tasks? Then it's option 3) because the logic for displaying any admin-associated things should not even be called.

If we have admins with an empty task list, then Option 1) is correct/best. Option 2) would have the drawback that if it comes, that you later want to port it to another environment with different view and you want to show an empty admin-task-menu (for whatsoever reason) you have a problem. It is about how data are displayed not what data are to be displayed and that would be CSS or if CSS is not sufficient then CSS with javascript support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.